06a253e5b5c6b1054362305add68af8bceb772534cde052c6b01d43c087830c6

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 14:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_d9812410a1c8b29eff1b24080aca0dab_amadey_elex_glassworm_smoke-loader.exe
Size 2.2MB
Sample260721-rw6daaah87
SHA256 06a253e5b5c6b1054362305add68af8bceb772534cde052c6b01d43c087830c6
MD5 d9812410a1c8b29eff1b24080aca0dab
SHA1 9aefd6c7a6a81460ba9b2d2349368daacb24c531
SHA512 1e5e230e7da8f83b56153c055ad1d86cae4c3d5fa0e1c89e1ba41d7eb10135a70bb9126f4597eeabb257c3dc76ab97a56fc4d8ce6c752d2b16c00e6aac1ec314
SSDEEP 49152:hoa1taC070UI1VvvYIfJW3yjQmNk+IQBv4v9VC4tR8xvOJFIw4i:hoa1taC0mvvYeg+NzIwo
TLSH
T19FB50102F60070F3C11A6BB0B555D7D79660EC7B7740ADC36988539E28DBBC8AB87B25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2940	4B86.tmp

Executes dropped EXE 1 IoCs

pid	Process
2940	4B86.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4B86.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_d9812410a1c8b29eff1b24080aca0dab_amadey_elex_glassworm_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 2940	4920	2026-07-21_d9812410a1c8b29eff1b24080aca0dab_amadey_elex_glassworm_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-21_d9812410a1c8b29eff1b24080aca0dab_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_d9812410a1c8b29eff1b24080aca0dab_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Users\Admin\AppData\Local\Temp\4B86.tmp
  "C:\Users\Admin\AppData\Local\Temp\4B86.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-21_d9812410a1c8b29eff1b24080aca0dab_amadey_elex_glassworm_smoke-loader.exe 45EE26A1451F4D7DED13669DB7620E5D17CF5C4B6CAABD442253943E9B1EFDBBAF4FE4A1E84D6E69C1C9DCB07DD387CFEB041EDEB40F4E7AC34E158A6BC0C9AA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4B86.tmp

Path C:\Users\Admin\AppData\Local\Temp\4B86.tmp
Size 2.2MB
SHA256 edbeb30cede064a43a6be445d258e107e07a5852841fac447f0d5d743ff73778
MD5 8945e63c622a805299aead5873bc25c4
SHA1 913e06e157f2ef589284599e0171a9de19454ff2
SHA512 e42898b12416ef80c6c25ba061b71c9027cff0d2ff912ffb42e67e5f148a2da7622516ac03f0b9ff6495a4c9866b457c1f9b77c7db332f347ff825216ebd2808
SSDEEP 49152:hoa1taC070UVC+IM1KpFfeNQwk2OuZbgjQ5R8xvOJFIw4i:hoa1taC0XFKpFfUQOOuRgjQJ
TLSH
T1B3B50101F60470F3C11A57B07555A7979660ECBB7B04ADC72AC8136E28DBBC8AB9BF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download