8b15b7d1cb3d85c078a39d43bb7970638c48915e5493b03c7690701fd9d5b680

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_560eed061977c11763a6f13f20fc95f2_amadey_elex_glassworm_smoke-loader.exe
Size 2.2MB
Sample260715-dchk8ac18v
SHA256 8b15b7d1cb3d85c078a39d43bb7970638c48915e5493b03c7690701fd9d5b680
MD5 560eed061977c11763a6f13f20fc95f2
SHA1 1e8fdeb99ba73a68fec82e6f061d439f648db894
SHA512 63f00d03b3ac711887edbf75d20372e6f57fd0df500f2398259ed8529cc70a4ffb4174266080fd76555589629ac91ee658d4abc2bb32ce68dbd177ab83bb1800
SSDEEP 49152:hoa1taC070UWlIfSI3L9kCVrf5LsuQ/cX4R8xvOJFIw4i:hoa1taC0NKkVvQEQ
TLSH
T1C0B50101F61070F3C15A67B0655597DB9620AC7B7B40DCC36988539E2CDBBC8AB9BF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2740	E41D.tmp

Executes dropped EXE 1 IoCs

pid	Process
2740	E41D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_560eed061977c11763a6f13f20fc95f2_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E41D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 2740	3552	2026-07-15_560eed061977c11763a6f13f20fc95f2_amadey_elex_glassworm_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-15_560eed061977c11763a6f13f20fc95f2_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_560eed061977c11763a6f13f20fc95f2_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Users\Admin\AppData\Local\Temp\E41D.tmp
  "C:\Users\Admin\AppData\Local\Temp\E41D.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-15_560eed061977c11763a6f13f20fc95f2_amadey_elex_glassworm_smoke-loader.exe EB4EB494597E0F712AFDF17B631C4242A1AAFE37184969D379DF61BDCBFF4F17C4A5FDA1C1ABD07EED8C4981D39FEDD7391A8E8F3C8DA023149DBB07F669297B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E41D.tmp

Path C:\Users\Admin\AppData\Local\Temp\E41D.tmp
Size 2.2MB
SHA256 580ab3e25f9e30bf9eba889cc36f0433f5edf5e836c2c9a8bb0f12a24f465b8f
MD5 2615e0c22388f7930cd127194d406676
SHA1 de4f655873544439c13affe576c5e68bc825b7ee
SHA512 d16306e3b2c3e80c81954643971c79abbe96f31904739d715850dc775275bf1abaa7220e7ee9ebdd88f98e67b5faa5c9ade92b4ef60ef673fe885261b55c7176
SSDEEP 49152:hoa1taC070UwLf7ozpcqHhpZnGgqgh+LbR8xvOJFIw4i:hoa1taC0uL4pcqr+Y+r
TLSH
T1F4B50201B30470F3C55A6BB07955A7D79660E87B7700ADC369C8539E2CDBEC8AB87B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download