a41a4dfef9e66695497df2b639b6a67c1740bbbf8ce63a8c6842329fac709339

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 06:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_8bab52797a0d743e30a2e24c3aa0c6aa_amadey_elex_glassworm_poet-rat_smoke-loader.exe
Size 7.8MB
Sample260727-hbd9maxset
SHA256 a41a4dfef9e66695497df2b639b6a67c1740bbbf8ce63a8c6842329fac709339
MD5 8bab52797a0d743e30a2e24c3aa0c6aa
SHA1 3c558e072d055ac776ae38022fc47998e0f76d51
SHA512 9fc704ba1fa69f9fdc5cf9a49e3e6ea15ab8870bf33c0f4b468cb962ac2137ce0394ff13328d5a06c5bdabccc25997139017671627cd4837b46757efaa478c72
SSDEEP 98304:emhd1UryehHHzP6evaX39nV7wQqZUha5jtSyZIUbu:ellieA39n2QbaZtlir
TLSH
T190869D01EBF8DE1EC5BF0375A8B211158BF5F8D5DB53DB9E6900B0AD7A923406A42363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5320	5EC0.tmp

Executes dropped EXE 1 IoCs

pid	Process
5320	5EC0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_8bab52797a0d743e30a2e24c3aa0c6aa_amadey_elex_glassworm_poet-rat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5EC0.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 5320	2932	2026-07-27_8bab52797a0d743e30a2e24c3aa0c6aa_amadey_elex_glassworm_poet-rat_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-27_8bab52797a0d743e30a2e24c3aa0c6aa_amadey_elex_glassworm_poet-rat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_8bab52797a0d743e30a2e24c3aa0c6aa_amadey_elex_glassworm_poet-rat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Users\Admin\AppData\Local\Temp\5EC0.tmp
  "C:\Users\Admin\AppData\Local\Temp\5EC0.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-27_8bab52797a0d743e30a2e24c3aa0c6aa_amadey_elex_glassworm_poet-rat_smoke-loader.exe AE6F8E1CA8DAED1767E11316BE0E793BAF26AD3E149FC11C3287CCC0B4C34075522D0BD6712C670791F9A96B2B9121DF83928D9691DF990A6DB195871167B346
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5EC0.tmp

Path C:\Users\Admin\AppData\Local\Temp\5EC0.tmp
Size 7.8MB
SHA256 d5c620a65a860e601bb98a9318e3872e39c3ce1ca0f7eae36e134c26661230ae
MD5 1f3890bee692a858c6e77a260d2da263
SHA1 f7bbbe553666e17e0a00c27aff5204a1763e5398
SHA512 c6be39ed3c2734d7334122c15ebf9c6576d8b2a42e3712c731dcfea17aeb502124dd80d3514cc99d3738c20eced08f0a94844f6c8e3aefcd188c11af2d1511c5
SSDEEP 98304:emhd1UryeScO5dCAuX5fV7wQqZUha5jtSyZIUbu:elycOSAud2QbaZtlir
TLSH
T1C0869D01EBF8DE1ED5BF0375A8B211118BF5F8D5DB53DB9E6900B0AD7A923406A42363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2932-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/5320-6-0x0000000000400000-0x0000000000849000-memory.dmp