41a3481d89ce289ad2dc9456636b151e562e66aadbda7ef68ef572a7631b97c9

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_5a5fdc5b5531e28a200282d0625eae7c_amadey_elex_glassworm_smoke-loader.exe
Size 3.6MB
Sample260718-ea4aksaw5x
SHA256 41a3481d89ce289ad2dc9456636b151e562e66aadbda7ef68ef572a7631b97c9
MD5 5a5fdc5b5531e28a200282d0625eae7c
SHA1 14070ae1590f7e137c48193ce59220850d3e3e7e
SHA512 bba8b4ad5aac01fed77cca2f7c99190520f08abc3f71fb41092ba125dafdd644a0e3a0bcb5065b25f0afc8b487aa89c7290fbfb34593285a25b2a4d2ca981174
SSDEEP 49152:yoa1taC070Uv/Qp3j18ohVTVFICFh5JVmgbQIzZMPXpB91rHp:yoa1taC01+BEO6nLrHp
TLSH
T1A306CF57EB918AE8E28D09366B544150DA2EF621ABCF1351396C420DCF87387BF61E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6040	197E.tmp

Executes dropped EXE 1 IoCs

pid	Process
6040	197E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_5a5fdc5b5531e28a200282d0625eae7c_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	197E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 6040	3492	2026-07-17_5a5fdc5b5531e28a200282d0625eae7c_amadey_elex_glassworm_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-17_5a5fdc5b5531e28a200282d0625eae7c_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_5a5fdc5b5531e28a200282d0625eae7c_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Users\Admin\AppData\Local\Temp\197E.tmp
  "C:\Users\Admin\AppData\Local\Temp\197E.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-17_5a5fdc5b5531e28a200282d0625eae7c_amadey_elex_glassworm_smoke-loader.exe C4A03B7485326FAD7DC30ABD4E7217EB21BF503B1E9A762FDED657038313A82C7F1098F3486F868E38858DD121A67A221314AA34B32511A8390BC04B07F9323F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

197E.tmp

Path C:\Users\Admin\AppData\Local\Temp\197E.tmp
Size 3.6MB
SHA256 98e797a8d2eee93f6ee6642762d4677640c6fa110fc525c43f4442dd0e7c3118
MD5 3d2d943c94332c059cc6ffdf18f6cde8
SHA1 cec6536af42e7b8c9caeb4081ebb21443ee22f05
SHA512 8039343fbe66a8ca6fe9885f3220a633228d8c884b53e3cf26aaf16a4dce2722164904ea7576414c7fd08517a7a99d2f9ff375ad5a1d89d0efc8eec24ed47f35
SSDEEP 49152:yoa1taC070UUotwiyYuXggvVJYxoMzVRtVmgbQIzZMPXpB91rHp:yoa1taC0uuuX7nPMRRUnLrHp
TLSH
T1A206CF53EB914AE8E24D08376B584150DA2EF621ABCF2351796C520DCF83387AF61E7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download