7540adb308184532152ddcb348087a0f1d46cbd08694925b13bae9256f7020ae

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 01:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_fbaba51ddfabe9c3ee19340fccf662b7_amadey_elex_glassworm_smoke-loader.exe
Size 2.2MB
Sample260718-brdvgabx3p
SHA256 7540adb308184532152ddcb348087a0f1d46cbd08694925b13bae9256f7020ae
MD5 fbaba51ddfabe9c3ee19340fccf662b7
SHA1 d720a740db8666bcbe9375d26865b91a9b0131ff
SHA512 0a1a8f0ab12c562c430e0fb37dd283fb638561d9da23fd018b709dce961fd8d97aa1e11b1fb6657b1083e58e3e21aaca8ec5069b392d87d79a129c2b4484a8e9
SSDEEP 49152:toa1taC070UjNCPd3lLGozPN/oqM0jRwRw:toa1taC0DI7ztD
TLSH
T135B5F116B214B1F3C06B0371B85083D68A65EC74AB51AA937ACC535E6CA3FC46EDFB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4600	584.tmp

Executes dropped EXE 1 IoCs

pid	Process
4600	584.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_fbaba51ddfabe9c3ee19340fccf662b7_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	584.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 4600	4132	2026-07-17_fbaba51ddfabe9c3ee19340fccf662b7_amadey_elex_glassworm_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-17_fbaba51ddfabe9c3ee19340fccf662b7_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_fbaba51ddfabe9c3ee19340fccf662b7_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Users\Admin\AppData\Local\Temp\584.tmp
  "C:\Users\Admin\AppData\Local\Temp\584.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-17_fbaba51ddfabe9c3ee19340fccf662b7_amadey_elex_glassworm_smoke-loader.exe B33234DEACFD6AC1B86113F17233646897350878B75B37985C95DED6A01AAD3D9E10763C156537100307913188AAB6605BB9385EE526BC863E2913BBC556AB96
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

584.tmp

Path C:\Users\Admin\AppData\Local\Temp\584.tmp
Size 2.2MB
SHA256 29364d2a2d807ad6f987f0972977d39069bbe71897224d948e44f9a4968bbd14
MD5 0d6d9fc0ad700a3972d857189f4dcef4
SHA1 1d6b22109f1f86ef9cd439d2897366707cca9d78
SHA512 f9a7e6ca782404834969b0f86ccd65d4eca0c27c4ef37e4409215f3ad7230ce93afa90ae42684b89d23a26d255b4cb3ee7eb51b84febe1950bb6f808a9c15869
SSDEEP 49152:toa1taC070ULaUGusLvUIS+VQGv5KE3IeUG6RwRw:toa1taC0Za79vUIdCGvYE3IyI
TLSH
T10DB5F106B21461F3C46A13B1B85087D68B65EC74AB51AAD37ACC532D6CA3FC46EDFB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download