3099464bbcb084a2e30238bc2b0da30ae2f75ee71e4bacbe5d1dc0ae50c62484

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 17:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-13_f4bfb4c65f9324eefe0fb0318dbe82a2_amadey_elex_glassworm_smoke-loader.exe
Size 2.2MB
Sample260713-vj2fcaet2t
SHA256 3099464bbcb084a2e30238bc2b0da30ae2f75ee71e4bacbe5d1dc0ae50c62484
MD5 f4bfb4c65f9324eefe0fb0318dbe82a2
SHA1 9e49427dcbe53e28c48ff8c59b1bad66a79bcec7
SHA512 3e9da4cb526c49af172bfd1437cae4ac13d47517080636bfe417830878ba80c42bdcfc39eff58d1092d3eeade832371cc2d5b4066097022a0c017b08b5879fba
SSDEEP 49152:Koa1taC070Uy2i/3YQdgmvEgdavFMgvdzCCsZABXc2hO/V+qvOJFIFRw:Koa1taC0MroQdzvxdaOWYW5xWa
TLSH
T1A7B50101B61474F3C52A17B0B85597D79622EC77BB009AC32DC8135E5CA7BC8AF9BB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4468	618F.tmp

Executes dropped EXE 1 IoCs

pid	Process
4468	618F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	618F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-13_f4bfb4c65f9324eefe0fb0318dbe82a2_amadey_elex_glassworm_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 4468	1856	2026-07-13_f4bfb4c65f9324eefe0fb0318dbe82a2_amadey_elex_glassworm_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-13_f4bfb4c65f9324eefe0fb0318dbe82a2_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_f4bfb4c65f9324eefe0fb0318dbe82a2_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Users\Admin\AppData\Local\Temp\618F.tmp
  "C:\Users\Admin\AppData\Local\Temp\618F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-13_f4bfb4c65f9324eefe0fb0318dbe82a2_amadey_elex_glassworm_smoke-loader.exe A4904BEEFDFE2BA6A5C525D8525585EEC1B456BC7DD4105FB19D6C5438E04804C028440C44068524E16DA8220993FB0D1FA54F1F498E626C0A37DE3E465D8A3C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

618F.tmp

Path C:\Users\Admin\AppData\Local\Temp\618F.tmp
Size 2.2MB
SHA256 443a6aacc6ecc223585f0f7ec1de8e08bbb08521b16b435669eaa4bf2609d312
MD5 4eddb55de72e7ec5c51216e4878dc688
SHA1 3048fc6e7fe6a70892ea97bbe2c2124091f8b923
SHA512 f4fc5639645d9c5c395b940ab4e9fa8ef0914b02e5cf303d98c1b735db128187201e9a08664c1b15a9ce7a8849d0d2f39c297e21cb9bec53a825d31e2aad51ce
SSDEEP 49152:Koa1taC070UC0pU0dXLbxaIVnuZps/Icg5GwaTdjcIqvOJFIFRw:Koa1taC05pU0dXJu/sSOjcu
TLSH
T12AB50102B714B0F3C56A57B0B84587D79621AC77BB009AC32988535E5CD7BC8AF9BF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download