703b810bf669ece11f43519a5428cc0d8c37ba0130021be71fee4e49e77d9a45

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 13:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_9ad174354443896a9925d76a043f88e9_amadey_elex_glassworm_smoke-loader.exe
Size 3.4MB
Sample260727-p889lasgnc
SHA256 703b810bf669ece11f43519a5428cc0d8c37ba0130021be71fee4e49e77d9a45
MD5 9ad174354443896a9925d76a043f88e9
SHA1 0e9153b8a03cc92e20e7cca9e4803cbb8f225205
SHA512 f45be0883437da9d05f5a7c9d7ce7f5680555002adc13391400a0438713ff5205bfb6493d9cc577997c6c67b61efd6622ac4888a6ad7f5aacb090c10a66b93d8
SSDEEP 49152:aoa1taC070UW58hfrEmbFfRjglINpQ3mgEx96YVmgbQIzZMPXp:aoa1taC0o5O4mbPkl8ImgI92
TLSH
T18DF57B53EB914AD9E38D0436EF548150972AF22997FF1261746842CCEE83387BF61A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4104	1CC5.tmp

Executes dropped EXE 1 IoCs

pid	Process
4104	1CC5.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_9ad174354443896a9925d76a043f88e9_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1CC5.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 4104	2960	2026-07-27_9ad174354443896a9925d76a043f88e9_amadey_elex_glassworm_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-27_9ad174354443896a9925d76a043f88e9_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_9ad174354443896a9925d76a043f88e9_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Users\Admin\AppData\Local\Temp\1CC5.tmp
  "C:\Users\Admin\AppData\Local\Temp\1CC5.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-27_9ad174354443896a9925d76a043f88e9_amadey_elex_glassworm_smoke-loader.exe 589B04831447332E372D68FF558A48ED6399D5E450417B443A1E5DBBB793EC35AE2985DA49C55E7CF9274645DE16220E3136350D8D96B317FD880AE535D9103C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1CC5.tmp

Path C:\Users\Admin\AppData\Local\Temp\1CC5.tmp
Size 3.4MB
SHA256 f68bb0cd78b38ea6a5a77d7dec3b287ceea9f30034875ae70b1daf53518f67a8
MD5 8a6b9d6d50fb115ec07d9e8660d974f4
SHA1 cbc0c392851204ff3472a6123e27895bc9b1ac85
SHA512 b1e43898b4df09a1d9eec2960bf1f1e2137d385b1f8cbcad061cd71bedc0db06def28301aec27cdd2cd658f7240f4c896ed7f3798603a3cfa4d1d95b6843e807
SSDEEP 49152:aoa1taC070U8el5/rBkW6bcoQ/iIxvDc2UPAQhMdVmgbQIzZMPXp:aoa1taC09l5DBWbi/iIgNAMME
TLSH
T1E7F57A53EB814AD9E38D0436EF548150972AF22997FF1261395812CCEE83387BF65A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download