3ca15332fb6a5ee159f9f105aa5f2b7705a74e20c15bd27f5561ea60f69de26a

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 00:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_cbc21adc6bcb08011dec177e9900658c_amadey_elex_glassworm_smoke-loader.exe
Size 3.1MB
Sample260718-a6b4raex8x
SHA256 3ca15332fb6a5ee159f9f105aa5f2b7705a74e20c15bd27f5561ea60f69de26a
MD5 cbc21adc6bcb08011dec177e9900658c
SHA1 8da3bb69db16f18c80daeb2067810a353c23fa71
SHA512 5b0ef86d7fd43b9f010a789822ab94f7ee5cebc24e2dd665a73c32e30d59a029dd616fa35589caf86aaa216cf0b922751c90161bb6d6fa2b7fe18a97f403f4cc
SSDEEP 49152:Noa1taC070UTFPRyjLpxlFbUhAupgRe7e+Q1/IOVmgbQIzZ:Noa1taC0hFPALpxDY1gb
TLSH
T1B5E5AE57EB818AE8E24D08776B584150DB2EF221A74F2351796C520DDF8738B8FA1E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3976	3BD6.tmp

Executes dropped EXE 1 IoCs

pid	Process
3976	3BD6.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_cbc21adc6bcb08011dec177e9900658c_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3BD6.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 3976	4112	2026-07-18_cbc21adc6bcb08011dec177e9900658c_amadey_elex_glassworm_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-18_cbc21adc6bcb08011dec177e9900658c_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_cbc21adc6bcb08011dec177e9900658c_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Users\Admin\AppData\Local\Temp\3BD6.tmp
  "C:\Users\Admin\AppData\Local\Temp\3BD6.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-18_cbc21adc6bcb08011dec177e9900658c_amadey_elex_glassworm_smoke-loader.exe 095DA5C36698DF685A61457CE0A067442DA93BD75028D3EF57D8C991C7697B450385750C4F834AAB064E66DDC043C39EE8F1A9DB6B4B461839785433E7A6FE04
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3BD6.tmp

Path C:\Users\Admin\AppData\Local\Temp\3BD6.tmp
Size 3.1MB
SHA256 15918ebeeee1052a6ffaff6c82adc5eb3e44a7ffab7c9fcaaad07ea266a23a84
MD5 695ec1d78e2063f80792f813b12fc08c
SHA1 1f0bf685ef185a660845dce2c9fa39b4ea759b1c
SHA512 f9bb0174b0e719dc392f3030e4962e381e3eea81c395031c7068147310725b24dc5c6ded63bd7f9a24b17ee5a990a589a8eb235ebdcc8b342cf8c6ef80b85a4f
SSDEEP 49152:Noa1taC070Ukprp4HDkI0FE/d56+oppDsa/VmgbQIzZ:Noa1taC0iYDD0Fwd5Vopy
TLSH
T1C7E5BE53EB819AE8E24D08776B584150DB2EF661AB4F2351796C420DCF873878FA1E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download