691f14641695f418742d887fb85318a548420b8ad3a16a358aa7408cf0f2969d

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 14:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_94738e3e68af859c7ef6c7e953f68bb7_amadey_elex_glassworm_smoke-loader.exe
Size 4.5MB
Sample260721-sc7bxabc98
SHA256 691f14641695f418742d887fb85318a548420b8ad3a16a358aa7408cf0f2969d
MD5 94738e3e68af859c7ef6c7e953f68bb7
SHA1 e6400a2d374120bdd5c963b65bda12dd85f62571
SHA512 6dd5a733c836ba0af5e678163b4e00a0a855b61581b7176a47e159cebe348244118ea202977c9cdab44ae4ba30690d646099200d9086d02d2a35b20767c4571d
SSDEEP 98304:umSWOiIyUZLuD1UdNlLITQVLUjH5oxFbx:uXTuadNRZVUjZEd
TLSH
T10726DF53EB818AE8E28D08766F584251DB2EF661A74F2351395C120DCF8738B8F65E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
52	3D0F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_94738e3e68af859c7ef6c7e953f68bb7_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3D0F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 52	4236	2026-07-21_94738e3e68af859c7ef6c7e953f68bb7_amadey_elex_glassworm_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-21_94738e3e68af859c7ef6c7e953f68bb7_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_94738e3e68af859c7ef6c7e953f68bb7_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Users\Admin\AppData\Local\Temp\3D0F.tmp
  "C:\Users\Admin\AppData\Local\Temp\3D0F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-21_94738e3e68af859c7ef6c7e953f68bb7_amadey_elex_glassworm_smoke-loader.exe 5D6BBC7DD2C07F8FEC70E6C7F3EAAD13A0E1CC420F2E2149AEEE9848AB9E4D4A279C10FAAC41BC9F15D858D4865C8F2113734FB51ED9E97C8750D2B28C82767F
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:52

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3D0F.tmp

Path C:\Users\Admin\AppData\Local\Temp\3D0F.tmp
Size 4.5MB
SHA256 c2c8f49c955f77f895b6032376a45d1eaef975c178bbf4d7efc5f4908c6518da
MD5 b42cf092df44f8685234e8c286313ee9
SHA1 1357e8c206b1c49be14b6afcfe2e08822fc29801
SHA512 7da0c9f06b7d235c334811d08c7f8297913ed49a3071967639f0a1f014176956b8e611651897d12dece02e1aeb94ac0754a99192d5534850e156cbd3f633f054
SSDEEP 49152:ivm22OdWOXqrbIyUJVCRWwZ5I03lxXcRl0wLVT5kUvgJSgHT6ojkxFbxLWC3mVmH:umSWOiIyUt03lxXcrVLUjH5oxFbx
TLSH
T1DE26DF53EB818AE8F28D04766B584251DB2EF621AB4F2351395C020DDF8738B8F65E7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download