8a3280205af084be6c5cfa7ba4d7765671afff5186de545261ccfac3edc093be

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_5d2e19d5976a0c5383d04ee58646e61c_amadey_elex_glassworm_icedid_njrat_smoke-loader.exe
Size 3.0MB
Sample260721-spz4csbf26
SHA256 8a3280205af084be6c5cfa7ba4d7765671afff5186de545261ccfac3edc093be
MD5 5d2e19d5976a0c5383d04ee58646e61c
SHA1 8555a13c76db7d4942460d8a6e5946eb18549463
SHA512 e8bc1d2f1f51fc2e61c384c6797eb5c9df30985d20b206fb564316eaeceff7703eb93d757b42655ba7b6ad47a0b4876559864e30fec9487d97548e4de353b70c
SSDEEP 49152:uoa1taC070UdOQnROz+LYPJsnBoVP/Lzhs7KoVb:uoa1taC0OqLXnBoVLE
TLSH
T190E57913E7814EDAE3D90536DE10C121932AF52D9BFB1632385812CDEE57387BF65A28
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3864	3A50.tmp

Executes dropped EXE 1 IoCs

pid	Process
3864	3A50.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_5d2e19d5976a0c5383d04ee58646e61c_amadey_elex_glassworm_icedid_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3A50.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 3864	3188	2026-07-21_5d2e19d5976a0c5383d04ee58646e61c_amadey_elex_glassworm_icedid_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-21_5d2e19d5976a0c5383d04ee58646e61c_amadey_elex_glassworm_icedid_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_5d2e19d5976a0c5383d04ee58646e61c_amadey_elex_glassworm_icedid_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Users\Admin\AppData\Local\Temp\3A50.tmp
  "C:\Users\Admin\AppData\Local\Temp\3A50.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-21_5d2e19d5976a0c5383d04ee58646e61c_amadey_elex_glassworm_icedid_njrat_smoke-loader.exe B2813552B2430FFD0BEF3A5D6A31B311F0F13EFA5AA7DA5C21A4600AFFB8808B33752C8CBB82C627D390782C20946A256CD27494BC5A060B76163DCCCD5FEECF
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3A50.tmp

Path C:\Users\Admin\AppData\Local\Temp\3A50.tmp
Size 3.0MB
SHA256 94d12a9e65a0aa404b9121462c16800c2adbed8c3b5e9927d430aab04b73e5e7
MD5 da03e05a77932dd01f5be80862b6b8a8
SHA1 32184d9c431bac999b2056ab81dae3a713da812d
SHA512 01511e89650bdfc9dc091c694392d31112659e8cce67b234d9805b09f9349925e630faa23165f517928a57077cefdeed405192e34cce5e163a60692ee4dbd762
SSDEEP 49152:uoa1taC070UNCdn4q43xOHsW7t6f10truuVb:uoa1taC0kCVWx40
TLSH
T1A3E57A13E7814EDAE3D90536DE10C160972AF52D9BFB1232385812CDEE57387BF65A28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download