41a3481d89ce289ad2dc9456636b151e562e66aadbda7ef68ef572a7631b97c9

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_5a5fdc5b5531e28a200282d0625eae7c_amadey_elex_glassworm_smoke-loader.exe
Size 3.6MB
Sample260718-ea4aksaw5x
SHA256 41a3481d89ce289ad2dc9456636b151e562e66aadbda7ef68ef572a7631b97c9
MD5 5a5fdc5b5531e28a200282d0625eae7c
SHA1 14070ae1590f7e137c48193ce59220850d3e3e7e
SHA512 bba8b4ad5aac01fed77cca2f7c99190520f08abc3f71fb41092ba125dafdd644a0e3a0bcb5065b25f0afc8b487aa89c7290fbfb34593285a25b2a4d2ca981174
SSDEEP 49152:yoa1taC070Uv/Qp3j18ohVTVFICFh5JVmgbQIzZMPXpB91rHp:yoa1taC01+BEO6nLrHp
TLSH
T1A306CF57EB918AE8E28D09366B544150DA2EF621ABCF1351396C420DCF87387BF61E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5700	1515.tmp

Executes dropped EXE 1 IoCs

pid	Process
5700	1515.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_5a5fdc5b5531e28a200282d0625eae7c_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1515.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 5700	2776	2026-07-17_5a5fdc5b5531e28a200282d0625eae7c_amadey_elex_glassworm_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-17_5a5fdc5b5531e28a200282d0625eae7c_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_5a5fdc5b5531e28a200282d0625eae7c_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Users\Admin\AppData\Local\Temp\1515.tmp
  "C:\Users\Admin\AppData\Local\Temp\1515.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-17_5a5fdc5b5531e28a200282d0625eae7c_amadey_elex_glassworm_smoke-loader.exe A1E53CF32090D354FBCF47B6686D93FD0A4883A9542BE62EAB43D961EEAB9A9618B9197E425E3F9C83CCF8E459BBCEEC1CA8224898B254EBB022CF083E1A6D59
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1515.tmp

Path C:\Users\Admin\AppData\Local\Temp\1515.tmp
Size 3.6MB
SHA256 4599e39a5cf6021a159d2cca109725222d5cb603f079f2accab306bac72e8e14
MD5 ee63565dff10fb3623798ac9b11a6d04
SHA1 9fabb2b82a24976dd9354a88a67eed1df07fed5d
SHA512 e01382129e3c901e11ae0f0d34005d9ab992e086a47decc5c7dee38e6fd48641d38d4d37a3f0e4e4bd778a8ea0eed42c397503725439511f70c256d3b55303e6
SSDEEP 49152:yoa1taC070UrQN3UkS3d8vxodOBurLXjkKTvVmgbQIzZMPXpB91rHp:yoa1taC0tc3UkSNaed6urrjkKynLrHp
TLSH
T18406CF57EB914AE8E64D08376B584151DA2EF221ABCF2351396C520CCF87387AF61E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download