9829e8de0fba8013f4e3a78e08e3da7f156b0c4e1545628cdd1437fc393e1b83

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 12:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_5c38715d0c1c4486baaf21d136c95d26_amadey_elex_glassworm_poet-rat_smoke-loader.exe
Size 7.8MB
Sample260715-n63hlae13x
SHA256 9829e8de0fba8013f4e3a78e08e3da7f156b0c4e1545628cdd1437fc393e1b83
MD5 5c38715d0c1c4486baaf21d136c95d26
SHA1 e41b5323a63dccfa25f98456b0d856e44ca6c6ba
SHA512 12da7f5d49807ed44aa29beeb4099bfe4e56b330e18f9f6d2e9325b30a85bb853fa9ce2439a036a9ed9239d6e9c2b5439808409acba21f98317611870c6badae
SSDEEP 98304:emhd1UryeLx3cZmjL9u1FsPV7wQqZUha5jtSyZIUbU:el94uQFe2QbaZtliT
TLSH
T10D869D01EBF8DE1EC5BF0375A8B211158BF5F8D5DB53DB9E6900B0AD7A923406A42363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5712	B0D8.tmp

Executes dropped EXE 1 IoCs

pid	Process
5712	B0D8.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_5c38715d0c1c4486baaf21d136c95d26_amadey_elex_glassworm_poet-rat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B0D8.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 5712	4872	2026-07-15_5c38715d0c1c4486baaf21d136c95d26_amadey_elex_glassworm_poet-rat_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-15_5c38715d0c1c4486baaf21d136c95d26_amadey_elex_glassworm_poet-rat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_5c38715d0c1c4486baaf21d136c95d26_amadey_elex_glassworm_poet-rat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Users\Admin\AppData\Local\Temp\B0D8.tmp
  "C:\Users\Admin\AppData\Local\Temp\B0D8.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-15_5c38715d0c1c4486baaf21d136c95d26_amadey_elex_glassworm_poet-rat_smoke-loader.exe B61E9138FF9E156C6257A464B595FA07664D17954753AC79D1EA18F78FFACE226780DA88971BB40599691AEC17BC8A074A9A84C5942FE0BE14B0CA25B417F769
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B0D8.tmp

Path C:\Users\Admin\AppData\Local\Temp\B0D8.tmp
Size 7.8MB
SHA256 3094655bf81c6a17b3f9fe7f4d6eed4877788ab7e72f5155487d0a20f306b7c4
MD5 cd8800f94dafd261dab4b59fc03cec9c
SHA1 ece36cd6e569bd4aedd37f18e1da78b29f810eba
SHA512 6eeb6583196c3d492c4242d684fabd5e90e137715532040c2cd397160809b3b1ab15f0d3de1a42d82e1183b58348c82e8bc7093a450d675b13e7953dabfdbf33
SSDEEP 98304:emhd1UryewdRK8yUyC9FwH3VtV7wQqZUha5jtSyZIUbU:elKwMyCiFt2QbaZtliT
TLSH
T10C869D01EBF8DE1EC5BF0375A8B211158BF5F8D5DB53DB9E6900B0AD7A923406A42363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4872-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/5712-6-0x0000000000400000-0x0000000000849000-memory.dmp