bad693f4034bb3b39ac3280642690edce99fc7751dde17967c059e6591bc0ccb

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 13:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_3e5ab805ac0c022b9d2ae6ad29c3c0dc_amadey_elex_glassworm_poet-rat_smoke-loader.exe
Size 7.0MB
Sample260712-qvmdcacy5v
SHA256 bad693f4034bb3b39ac3280642690edce99fc7751dde17967c059e6591bc0ccb
MD5 3e5ab805ac0c022b9d2ae6ad29c3c0dc
SHA1 3c4796a2fd5008536bb2f751b4c4e6737e27593a
SHA512 c3709f1fb7569cb37996b258abb18492b7059e999cd0b9b1e2f34118330f82443d3d238b5e01d9a2a95d42824e60a6a4ab4e80a615cfe185889e6bab95388cdf
SSDEEP 98304:emhd1UryeVlTWLAJtazV7wQqZUha5jtSyZIUb0:el15rtw2QbaZtlij
TLSH
T18176BE01EBA8EF2EC91F0379A4B2211197F5C5D4D743EB92AE11F5B8BD833507A06297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3024	759.tmp

Executes dropped EXE 1 IoCs

pid	Process
3024	759.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_3e5ab805ac0c022b9d2ae6ad29c3c0dc_amadey_elex_glassworm_poet-rat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	759.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 3024	2340	2026-07-12_3e5ab805ac0c022b9d2ae6ad29c3c0dc_amadey_elex_glassworm_poet-rat_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-12_3e5ab805ac0c022b9d2ae6ad29c3c0dc_amadey_elex_glassworm_poet-rat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_3e5ab805ac0c022b9d2ae6ad29c3c0dc_amadey_elex_glassworm_poet-rat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Users\Admin\AppData\Local\Temp\759.tmp
  "C:\Users\Admin\AppData\Local\Temp\759.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-12_3e5ab805ac0c022b9d2ae6ad29c3c0dc_amadey_elex_glassworm_poet-rat_smoke-loader.exe 26105B80F1199608486E5230B7E459E1C238257C6130ADE34760072A3B156666E6606D9CFADFF2CEADF2104988EA41CA937AE56F4FF07D6E9EC926C8AFBDA98E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

759.tmp

Path C:\Users\Admin\AppData\Local\Temp\759.tmp
Size 7.0MB
SHA256 f6f67ce92237b6f9966a258e83704d5be4413ce6013c31633c4c0ede096624bd
MD5 68b73fec02800a87a3a249d70c283d21
SHA1 b594813bc8171d9c70724c37b1c2b85d43374cb6
SHA512 ecbf3dacab5cbba88d325c6def408ccb4ba299cbf347cc11fc56a474d65a61cd2b1e3fad1fcfc596085909cb525e5ef1040693d996cec3e822ca251850420c37
SSDEEP 98304:emhd1Urye69NycAurytGWHV7wQqZUha5jtSyZIUb0:elaScFrTI2QbaZtlij
TLSH
T19E76BE01EBA8EF2EC91F0379A4B2211197F5C5D4D743EB92AE11F5B8BD833507A06297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2340-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/3024-6-0x0000000000400000-0x0000000000849000-memory.dmp