fe5324dd4e07934a8b7cf07307a1cf39e5b77ab1d7a4fb165a7274ff88c0fb21

Analysis

max time kernel
148s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 14:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_bdf46dd91f5dd7e36e83e18053878dc0_amadey_elex_glassworm_poet-rat_smoke-loader.exe
Size 7.8MB
Sample260714-rwewbshs8w
SHA256 fe5324dd4e07934a8b7cf07307a1cf39e5b77ab1d7a4fb165a7274ff88c0fb21
MD5 bdf46dd91f5dd7e36e83e18053878dc0
SHA1 786113b6d4e08cdd7a0eef9674a450de71b2cecc
SHA512 f0fdc3397b2781ee14a901a6c8dec859ac956a51150741191708de1dde1afbc0f93f1e0c2ce8f8461fa824702ce7958cd02e4dae6c21dfa04f08d0e449585442
SSDEEP 98304:emhd1UryePZdKg3sv8zfqu+0HmKjzV7wQqZUha5jtSyZIUbu:elvug3dbM0H7jz2QbaZtlir
TLSH
T15C869D01EBF89E1ED5BF0375A8B211158BF5F8D4DB53DB9E6900B0AD7E923406A42363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2856	B80B.tmp

Executes dropped EXE 1 IoCs

pid	Process
2856	B80B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_bdf46dd91f5dd7e36e83e18053878dc0_amadey_elex_glassworm_poet-rat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B80B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5676 wrote to memory of 2856	5676	2026-07-14_bdf46dd91f5dd7e36e83e18053878dc0_amadey_elex_glassworm_poet-rat_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-14_bdf46dd91f5dd7e36e83e18053878dc0_amadey_elex_glassworm_poet-rat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_bdf46dd91f5dd7e36e83e18053878dc0_amadey_elex_glassworm_poet-rat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5676
- C:\Users\Admin\AppData\Local\Temp\B80B.tmp
  "C:\Users\Admin\AppData\Local\Temp\B80B.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-14_bdf46dd91f5dd7e36e83e18053878dc0_amadey_elex_glassworm_poet-rat_smoke-loader.exe F5331C26CBF1F6A632DDB8D6DDA3709C017BFB13F1D0BE307754C394546FF8C46CBB5456702D4F9E520DE659BCA4A88708324B0785FD233B9E6952C7345A8107
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B80B.tmp

Path C:\Users\Admin\AppData\Local\Temp\B80B.tmp
Size 7.8MB
SHA256 90e1c6f3e9685a34e939e41b65cd48b6c23426ac00ef092dbe9b3b8e30ef0ec1
MD5 dceac6cac726c96eef387fbd1f5c4075
SHA1 2b498b1649f4ef1b95381b54b241e7dd6048d769
SHA512 152cea8e5e0210e29f9d64554d5436761f9ff4df86fe2aea644034e3675bdf85e49f88c4d5bc8ea4c693a51d6884ed39d4d56d8a2bb37667cd547e33b1e270ff
SSDEEP 98304:emhd1UryeIU7XHXV7wQqZUha5jtSyZIUbu:eloUj2QbaZtlir
TLSH
T1CE869D01EBF8DE1ED5BF0375A8B211118BF5F8D5DB53DB9E6900B0AD7A923406A42363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2856-6-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/5676-0-0x0000000000400000-0x0000000000849000-memory.dmp