930ca00e018a4788fa289d6aeb7109bf52875db2c713eed46afa4bec626cb791

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_d7d1fea0b2e4712ef5344caf67659cbb_amadey_elex_glassworm_smoke-loader.exe
Size 2.2MB
Sample260723-mtpwasbh85
SHA256 930ca00e018a4788fa289d6aeb7109bf52875db2c713eed46afa4bec626cb791
MD5 d7d1fea0b2e4712ef5344caf67659cbb
SHA1 e689ae73bb0914316a373073dae64fd2334c7a95
SHA512 adaae842f53acbc80335dbcbbc1a2a4d212a5b48570db673bf22ab31e401c25ce92e392ba05d3404746e69ca615fb95dd7e689cfa324b2e68791ddd91c17c19f
SSDEEP 49152:hoa1taC070Uw6YYfrJ648ZTuuqOqxhJ4oPR8xvOJFIw4i:hoa1taC0m6XryZTeJB7
TLSH
T15FB50102F30070F3C51A6BB0655597D75620ECBB7B01ADC769C8536E28DBBC8AB8BB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3612	7E7D.tmp

Executes dropped EXE 1 IoCs

pid	Process
3612	7E7D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_d7d1fea0b2e4712ef5344caf67659cbb_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7E7D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5732 wrote to memory of 3612	5732	2026-07-23_d7d1fea0b2e4712ef5344caf67659cbb_amadey_elex_glassworm_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-23_d7d1fea0b2e4712ef5344caf67659cbb_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_d7d1fea0b2e4712ef5344caf67659cbb_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5732
- C:\Users\Admin\AppData\Local\Temp\7E7D.tmp
  "C:\Users\Admin\AppData\Local\Temp\7E7D.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-23_d7d1fea0b2e4712ef5344caf67659cbb_amadey_elex_glassworm_smoke-loader.exe 184B27F2B889BAD355821BBD74816675E644AF679992EBB9E654B966007F8005526EE4FC5DE82DCAE7E407FDCE7DB8F343051B2364B5BFC9C042E08ECB3B13DD
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7E7D.tmp

Path C:\Users\Admin\AppData\Local\Temp\7E7D.tmp
Size 2.2MB
SHA256 0a6dd8d8dad55f9a35bc444908f01d5464a5e22a696f93e1715e351751f7389b
MD5 a7e14852de5ff1fa263125531432fb3f
SHA1 516aae064ba8c57eb3d44259ca75f0af0ca07318
SHA512 6fa77f3fdada6700a13d71058e56e76e417d4cb23a570a9f642db9b9caa8ed4c39fa61909718bbf5c654ef65ac72a5a2ed7755bc490ed951ad23ef4bee545af4
SSDEEP 49152:hoa1taC070UgkA/v8VosVinZPszR8xvOJFIw4i:hoa1taC0Wk3VosVin1E
TLSH
T1D4B50102B20470F3C51A27B06555D79B9660FCBB7B04ADC36988535E2CDBFC8AB9BB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download