842a4235a6e103bebaa468ac019878cd0c05540f009a5cc795b5fd3235e04293

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_9d052b4ad90f0aca34c564cc7902ab73_amadey_elex_glassworm_smoke-loader.exe
Size 2.6MB
Sample260715-e5yctabx2m
SHA256 842a4235a6e103bebaa468ac019878cd0c05540f009a5cc795b5fd3235e04293
MD5 9d052b4ad90f0aca34c564cc7902ab73
SHA1 71385bc814e56e46ff4334ec00b5baa2758149a1
SHA512 abe72310c72939a507c7b4e27837105f9df9ce37653a0106b4385a3b1c59f657acc8f87f4ad968297e8695ecb1fd19f63221d04003298624f26ee31ae67cf1ae
SSDEEP 49152:Koa1taC070UCvx3Rb+RA4DU7uZvPwsr+mTj4BrV:Koa1taC0YJRb+RA4DUypIsr+mTjK
TLSH
T1E8D5CF67EB818AE8E64D04766F144241D62EF621A74F671179AC131DCF8378B8F62E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4888	3118.tmp

Executes dropped EXE 1 IoCs

pid	Process
4888	3118.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_9d052b4ad90f0aca34c564cc7902ab73_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3118.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5980 wrote to memory of 4888	5980	2026-07-15_9d052b4ad90f0aca34c564cc7902ab73_amadey_elex_glassworm_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-15_9d052b4ad90f0aca34c564cc7902ab73_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_9d052b4ad90f0aca34c564cc7902ab73_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5980
- C:\Users\Admin\AppData\Local\Temp\3118.tmp
  "C:\Users\Admin\AppData\Local\Temp\3118.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-15_9d052b4ad90f0aca34c564cc7902ab73_amadey_elex_glassworm_smoke-loader.exe A9ABE315AB2A369023E681BBE828E6F986415AFE4F64236E88F1A66CA578ECBDFD8BE684F2F57A43061AE3067D8F772EBA5A9F6418E363B246E1E2992A51C2CB
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3118.tmp

Path C:\Users\Admin\AppData\Local\Temp\3118.tmp
Size 2.6MB
SHA256 faf4127449031040251829ce85067804a5a0d448f8163656b0dda5437a42f1a7
MD5 871f0ddf93467af53fd2df256b4030ef
SHA1 1acfe0fc5c2b637830de6e56ed9b8d7f2aeee19c
SHA512 6ade630781dc91a2448309434b8430dfc747dfd169b7086fe2e53fb3d16dd436a176008077baf7ec76adfe5bee0cba7716ce9daaf9dcf2f40440cd80f4518634
SSDEEP 49152:Koa1taC070UTjUxbiwUs+lYD/W/REVtGXng7zx9mmt1STZ6V:Koa1taC0tUxiHlYLWJg6mz3pGTZ
TLSH
T1D9D5CF53EB818AE8E64D04766F544241D62EF221AB4F635179AC131DCF8378B8F66E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download