842a4235a6e103bebaa468ac019878cd0c05540f009a5cc795b5fd3235e04293

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/07/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_9d052b4ad90f0aca34c564cc7902ab73_amadey_elex_glassworm_smoke-loader.exe
Size 2.6MB
Sample260715-e5yctabx2m
SHA256 842a4235a6e103bebaa468ac019878cd0c05540f009a5cc795b5fd3235e04293
MD5 9d052b4ad90f0aca34c564cc7902ab73
SHA1 71385bc814e56e46ff4334ec00b5baa2758149a1
SHA512 abe72310c72939a507c7b4e27837105f9df9ce37653a0106b4385a3b1c59f657acc8f87f4ad968297e8695ecb1fd19f63221d04003298624f26ee31ae67cf1ae
SSDEEP 49152:Koa1taC070UCvx3Rb+RA4DU7uZvPwsr+mTj4BrV:Koa1taC0YJRb+RA4DUypIsr+mTjK
TLSH
T1E8D5CF67EB818AE8E64D04766F144241D62EF621A74F671179AC131DCF8378B8F62E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2004	6A3E.tmp

Executes dropped EXE 1 IoCs

pid	Process
2004	6A3E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_9d052b4ad90f0aca34c564cc7902ab73_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6A3E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2004	2996	2026-07-15_9d052b4ad90f0aca34c564cc7902ab73_amadey_elex_glassworm_smoke-loader.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-07-15_9d052b4ad90f0aca34c564cc7902ab73_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_9d052b4ad90f0aca34c564cc7902ab73_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Users\Admin\AppData\Local\Temp\6A3E.tmp
  "C:\Users\Admin\AppData\Local\Temp\6A3E.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-15_9d052b4ad90f0aca34c564cc7902ab73_amadey_elex_glassworm_smoke-loader.exe 4A2CBAA072C3E7833F4E92694ECF018B4107B0449F0F69DB0A0C2996395C9DDBB04B659419C6F51AC49A43C74C5996D04F65BB515C1541ED054FA48ED7D8E857
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6A3E.tmp

Path C:\Users\Admin\AppData\Local\Temp\6A3E.tmp
Size 2.6MB
SHA256 dae0936c3cff3b0b4d4006379c4618850965690c4773a09c82b6544e59067281
MD5 479f68c7f2fa2d8d6c72ded5ae6c9392
SHA1 c9069757ecd2757ae639d7412b24aa618a7dd8d7
SHA512 89f07c56081fff8a2f6a6981c1b0015d2afb83ffeb583b10117ad56cd73100007ab2d32c3c7bdba0848b0c79160115cddf2f21db55793874c6a7f04338d6cc32
SSDEEP 49152:Koa1taC070Ub7pdL27R77RlJrAVb/nzIRRUV:Koa1taC0duRP5AVnz
TLSH
T108D5CF63EB818AE8E64D04766F148251D62EF221A70F6751799C131DCF8378B8F66E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download