d600d617dafb3b0bb4929a1657f207041fb204eeb69fbdae7d11882d9f4b86df

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_daf0eea0239c7fc4e1537ae476ba9b49_amadey_elex_glassworm_poet-rat_smoke-loader.exe
Size 7.0MB
Sample260718-2l4f2sht2x
SHA256 d600d617dafb3b0bb4929a1657f207041fb204eeb69fbdae7d11882d9f4b86df
MD5 daf0eea0239c7fc4e1537ae476ba9b49
SHA1 49da9942aa3e097c45fc66a91b4a1fa990b920f0
SHA512 c30e2ed53ea2f5280ed6e8bdaedbc4326be82807ff58542847ca22011310086c816451a188d730b05cdc56ab56a0e1c9f4764425846645a1d23c3c0d8f540e18
SSDEEP 98304:emhd1UryegGKghaOA7LDDPw7ZV7wQqZUha5jtSyZIUbn:elSghbeLDDPwt2QbaZtliK
TLSH
T1F776BE01EBA8EF2EC91F0379A4B2211197F5C5D4D743EB92AE11F5B8BD833507A06297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
436	CD87.tmp

Executes dropped EXE 1 IoCs

pid	Process
436	CD87.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_daf0eea0239c7fc4e1537ae476ba9b49_amadey_elex_glassworm_poet-rat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CD87.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 436	5100	2026-07-18_daf0eea0239c7fc4e1537ae476ba9b49_amadey_elex_glassworm_poet-rat_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-18_daf0eea0239c7fc4e1537ae476ba9b49_amadey_elex_glassworm_poet-rat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_daf0eea0239c7fc4e1537ae476ba9b49_amadey_elex_glassworm_poet-rat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Users\Admin\AppData\Local\Temp\CD87.tmp
  "C:\Users\Admin\AppData\Local\Temp\CD87.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-18_daf0eea0239c7fc4e1537ae476ba9b49_amadey_elex_glassworm_poet-rat_smoke-loader.exe C18C76D49BEE9F50B110563A9D4CC9D5B658A96E53DA50C5FA3213FF5995517C7A3C2DC2E43CE2B57C8D4585258F3FC2919BD218D5D6B7667F8A261A9F25878A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CD87.tmp

Path C:\Users\Admin\AppData\Local\Temp\CD87.tmp
Size 7.0MB
SHA256 a2c40dc50b81a143f86c01bc1734871600399ad53789db8c4ed39c13879b66ab
MD5 2ec6cc2c38a9d4c323c67a6c5b0bf1c0
SHA1 8ceaa37547ebecfecb1929a0b1c246f1f4d35a42
SHA512 e6799c48d9f704aeb971c4af6935b754bb2130dda42ccec2eb10db38c19c684f91b2c2be5eecfa5ae5d5d6d533f8702fe9c4dda86c1e43544d1554cceb8f35a4
SSDEEP 98304:emhd1UryentbzfUM9681+0Gf4NV7wQqZUha5jtSyZIUbn:elHtcM9/hGwN2QbaZtliK
TLSH
T1AC76BE01EBA8EF2EC91F0379A4B2211197F5C5D4D743EB92AE11F5B8BD833507A06297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/436-6-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/5100-0-0x0000000000400000-0x0000000000849000-memory.dmp