c91cf35cb202253729555da330f5cc4862b230d47244d0151a20d94dd8ab8299

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 14:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_b2d9e45321f3ee207910710ab5787de1_amadey_elex_glassworm_smoke-loader.exe
Size 4.2MB
Sample260721-r52fpabb72
SHA256 c91cf35cb202253729555da330f5cc4862b230d47244d0151a20d94dd8ab8299
MD5 b2d9e45321f3ee207910710ab5787de1
SHA1 01e8ce422b512efa8ae2e5a1c387f0bcc4c3ebf7
SHA512 efada27de1981777b8604f48ad21238ac6ca26b0fdf8be953b3ccbefee5dc9c2059e4d3047e8c9f197990bc153224acba5b99c7fab7177c5dba3038b07d317df
SSDEEP 49152:xvm22OdWOXqrbIyUJVFqhaYbRNkzNZTIcxdr92rUheAwLVT5kUvgJSgHT6ojkxFp:9mSWOiIyU7XN9f3r4vVLUjH5oxFbx
TLSH
T1FE169B57EB814AD9E38D0476EF548150972AF22997FF1261385802CCEE87387BF61A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2412	8CB6.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_b2d9e45321f3ee207910710ab5787de1_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8CB6.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6084 wrote to memory of 2412	6084	2026-07-21_b2d9e45321f3ee207910710ab5787de1_amadey_elex_glassworm_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-21_b2d9e45321f3ee207910710ab5787de1_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_b2d9e45321f3ee207910710ab5787de1_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6084
- C:\Users\Admin\AppData\Local\Temp\8CB6.tmp
  "C:\Users\Admin\AppData\Local\Temp\8CB6.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-21_b2d9e45321f3ee207910710ab5787de1_amadey_elex_glassworm_smoke-loader.exe 524EBA58F7E9B5EDB020F53E5AF6FC7F856FE07F579B1284655AFEF13477EBD67F9FBE4F3AF22EDD23D6D4C010B4ECB18060E9F13F5AF1EFF4600F6F4095399E
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8CB6.tmp

Path C:\Users\Admin\AppData\Local\Temp\8CB6.tmp
Size 4.2MB
SHA256 810923221096ad6c8ad9e43518596314f44fba3ee8d6e299175f80ef337762f3
MD5 4507535e1e7193620191653c7065a55a
SHA1 a83b26a07994047f71eb2f20ac1a500e3ab9137a
SHA512 869aeae390733a0dcb764a922cd32535fd13be82f9b66728efabff8af739562c40a8c618be4495775ac44dfbeb2702dbee5a70f8bbc9f8a7c73385d82138fd9c
SSDEEP 49152:xvm22OdWOXqrbIyUJVdCHkVmBB3C1QqAMVTIX3U8WyxwLVT5kUvgJSgHT6ojkxFp:9mSWOiIyU0HkQBZS4/WVLUjH5oxFbx
TLSH
T15A169C57EB814AD9E38D0476DF448150972AF22997FF2261385812CCEE87387BF61A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download