ec7068d2fd8f735b46bbdaa0d449b6781ac89160d69d83020eb1e5d1de417b6e

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 00:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_b5e4e12f239302e39d0e38fcd8ad4fd6_amadey_elex_glassworm_smoke-loader.exe
Size 3.1MB
Sample260718-a7ldtaey3v
SHA256 ec7068d2fd8f735b46bbdaa0d449b6781ac89160d69d83020eb1e5d1de417b6e
MD5 b5e4e12f239302e39d0e38fcd8ad4fd6
SHA1 57db02712217dd848a8d213977d4ba05e014cff3
SHA512 706d48c51ede8958e1e5d47026ef596a4ffb13c1e5b88a283dc244e9a2ea051bf66793975c7354dd83e5ccca5ca528292798fa8b76fa21e7e3fd29d26ecc2f23
SSDEEP 49152:Noa1taC070UZOyezu0yljp3iylfC/u9eEVmgbQIzZ:Noa1taC03suFltiA
TLSH
T166E5AE57EB918AE8F64D08376B584150DA2EF661AB4F2351796C020DCF8738B8F61E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3352	93BA.tmp

Executes dropped EXE 1 IoCs

pid	Process
3352	93BA.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_b5e4e12f239302e39d0e38fcd8ad4fd6_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	93BA.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 3352	1144	2026-07-18_b5e4e12f239302e39d0e38fcd8ad4fd6_amadey_elex_glassworm_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-18_b5e4e12f239302e39d0e38fcd8ad4fd6_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_b5e4e12f239302e39d0e38fcd8ad4fd6_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Users\Admin\AppData\Local\Temp\93BA.tmp
  "C:\Users\Admin\AppData\Local\Temp\93BA.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-18_b5e4e12f239302e39d0e38fcd8ad4fd6_amadey_elex_glassworm_smoke-loader.exe 047DC802574BCC3834A68A68812C78B013A529B037C9037EA3633173E439F808FEF59A29724D8953C834C2AE57CD6544837B4E87BF6C21FD0E6932B6E9ADB2B2
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

93BA.tmp

Path C:\Users\Admin\AppData\Local\Temp\93BA.tmp
Size 3.1MB
SHA256 94f3a3d01b82f858945259d40dd9c55fd4036b539f685d4fcca0093bea7f3d72
MD5 1df2cf97b513399ea1f248b79ef3975e
SHA1 44b9760a388020689101de9920f71a029d3e382d
SHA512 664be9c1abadbf5376d2beeaebe578f2ca122ebdf842b7f9729f6940899e4dce5d8bd3924530d92254816b4b6bbe45431bd95b8574fde8622be6a19459a05071
SSDEEP 49152:Noa1taC070UdpU88AqrY8qjutl+TTVmgbQIzZ:Noa1taC0TW885Yf
TLSH
T1C2E5BE67EB815AE8F68D08376B584150DA2EF621A74F2351796C420DCF8738B8F61E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download