1f79d7dac4599e1fc988699d232dbb9a124eeafb43c3353e58d039bcf3e48c84

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 15:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_1105757b3eded1e97e93899dcda3f863_amadey_elex_glassworm_smoke-loader.exe
Size 4.2MB
Sample260722-tdmvbscn5x
SHA256 1f79d7dac4599e1fc988699d232dbb9a124eeafb43c3353e58d039bcf3e48c84
MD5 1105757b3eded1e97e93899dcda3f863
SHA1 9576bdc3e63267b3dd7f1ceacc3c4eb0ab6e7c9b
SHA512 c9fa52f5b7c9c80b3e231e5b07f92ff0ca55f030f51bb3dc9245629a59ea5c871c2f3081e00bff18711c1150834ea789ce87e75fb3b9be151639f4f1a45543cc
SSDEEP 98304:9mSWOiIyUh0VwTRT20K6yAVLUjH5oxFbx:9Xr0oR24yAVUjZEd
TLSH
T182169C53EB814AD9E38D0476EF458150972AF22997FF1261395802CCEE87387BF61A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4492	E73E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_1105757b3eded1e97e93899dcda3f863_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E73E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 4492	3164	2026-07-22_1105757b3eded1e97e93899dcda3f863_amadey_elex_glassworm_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-22_1105757b3eded1e97e93899dcda3f863_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_1105757b3eded1e97e93899dcda3f863_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Users\Admin\AppData\Local\Temp\E73E.tmp
  "C:\Users\Admin\AppData\Local\Temp\E73E.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-22_1105757b3eded1e97e93899dcda3f863_amadey_elex_glassworm_smoke-loader.exe D8C0D90A2A412592264E378A85079869D57FD13056608A4E2965EDC8C26F98437B46FB5CED46715434DD99B1CFBF5F4DEBE1EC0F60FF5A3B7A1B659067CF4E6E
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E73E.tmp

Path C:\Users\Admin\AppData\Local\Temp\E73E.tmp
Size 4.2MB
SHA256 2806bcbc1d4b1859f9e755154c907fd41103abe7555afd149d5012607e2a78f4
MD5 78b83422105da6aae9b1519984bb3782
SHA1 582da5776ad31ed8f9ed9311df4757be4dcbb49f
SHA512 757842b48e40952c4722c4c19418def9b6aaa4ca7f9fe1c886f0a96243376d06ced7704a3ce53ddff8d2037a997b4b3be1f15252109a40edd1e0893f1c41817a
SSDEEP 98304:9mSWOiIyUH55lnOCbafKp2/UH4m5VLUjH5oxFbx:9Xp55YCboupVUjZEd
TLSH
T1FF169C53EB814AD9E38D0476DF458150972AF22997FF2261395802CCEE87387BF61A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download