8f1ef16d7ce2ff9bd3f2629656a16152e283e43cc64741d87e755c5e5fc54650

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 22:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_56f929afcde710bb020d29b89296964a_amadey_elex_glassworm_smoke-loader.exe
Size 3.6MB
Sample260719-2jkwxshs21
SHA256 8f1ef16d7ce2ff9bd3f2629656a16152e283e43cc64741d87e755c5e5fc54650
MD5 56f929afcde710bb020d29b89296964a
SHA1 692ea01934a36f7e3e25416a3b4fdb86358ad404
SHA512 ffc7b95d8d250074fd7c73099dbc85434f19795f18f910124452580355edd8400f7293e35fdc206e2d5261e46af80c2aa11a0b86a9dee45302b6e5083082e384
SSDEEP 98304:Noa1taC0M/Hyfhtsrh+GEcHa6jmrnLrHp:Noa3ktfrc9kr
TLSH
T16B068C57EB814AE8E28D0936EF544150DB2AF22997EF1361356C020CDE83387BF65A7D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3184	4E55.tmp

Executes dropped EXE 1 IoCs

pid	Process
3184	4E55.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_56f929afcde710bb020d29b89296964a_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4E55.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 3184	2432	2026-07-19_56f929afcde710bb020d29b89296964a_amadey_elex_glassworm_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-19_56f929afcde710bb020d29b89296964a_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_56f929afcde710bb020d29b89296964a_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Users\Admin\AppData\Local\Temp\4E55.tmp
  "C:\Users\Admin\AppData\Local\Temp\4E55.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-19_56f929afcde710bb020d29b89296964a_amadey_elex_glassworm_smoke-loader.exe B17D0BDCE6170AE0FBC9AD67E9E84DC4CAB96B967D31E723289CD3E2E7039AEC2614889B9ED49CE80D998E98ABD7A174EC431558008C035D00DCF75D07FB9767
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E55.tmp

Path C:\Users\Admin\AppData\Local\Temp\4E55.tmp
Size 3.6MB
SHA256 3e262d4c98bbd8107d79ba914a062493780e8c2aae21dd17e3557ac5fff93ba0
MD5 c2383e0f6455f6b7f7a2a42cbe7da424
SHA1 f1acf4ef85b33255e612c612b2b73e461d1a6c1d
SHA512 46e33c9277199552e6e24b1383b0bb493bb2a3c12115fb7f5a0c6bcbfb9fe379e26e195f40397395072b737b75c2675ce01a176f2bf4b9d602851da03d4c36ed
SSDEEP 49152:Noa1taC070URl6JFSmrVMCHXOgvi5i0fFkMCdPVmgbQIzZMPXpB91rHp:Noa1taC0Dl6JFScaC10NR5nLrHp
TLSH
T105068B53EB814AE8E28D0436EF544150DB2AF229A7EF1361756C420DDE87387BF61A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download