7674b96dffd1114956a51ed83ddafb0ed83fc9d32e45d685e06cc1c32e915658

Analysis

max time kernel
150s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_f2e2b6eec2a8bd6e7f1eb8235c7a94d0_amadey_elex_glassworm_smoke-loader.exe
Size 3.6MB
Sample260727-ssc31abf88
SHA256 7674b96dffd1114956a51ed83ddafb0ed83fc9d32e45d685e06cc1c32e915658
MD5 f2e2b6eec2a8bd6e7f1eb8235c7a94d0
SHA1 18945cf3977bc68cca6c5eacb6fa7642b1608c87
SHA512 ad56f4776e7c03c39663c7107745e5340100ef2a326393fd106097b4c2ef202fd5ff7741d8024a1fec7846a7ccc1336df205bb20ba49e29393f9200a482d083f
SSDEEP 49152:joa1taC070UxW9SP7tHdLfnbyzryK7L22FKWAm7bzRVmgbQIzZMPXpB91rHp:joa1taC0rY2HpfKy/2QuwnLrHp
TLSH
T17A068B53EB814AD9E38D0436EF548150D72AF62997FF12613858528CEE83387BF61A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5064	2C08.tmp

Executes dropped EXE 1 IoCs

pid	Process
5064	2C08.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2C08.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_f2e2b6eec2a8bd6e7f1eb8235c7a94d0_amadey_elex_glassworm_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 5064	4596	2026-07-27_f2e2b6eec2a8bd6e7f1eb8235c7a94d0_amadey_elex_glassworm_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-27_f2e2b6eec2a8bd6e7f1eb8235c7a94d0_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_f2e2b6eec2a8bd6e7f1eb8235c7a94d0_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Users\Admin\AppData\Local\Temp\2C08.tmp
  "C:\Users\Admin\AppData\Local\Temp\2C08.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-27_f2e2b6eec2a8bd6e7f1eb8235c7a94d0_amadey_elex_glassworm_smoke-loader.exe 989CE774A8437EA9881398177F6F0FEC1D3B81305E9DBE9985FCFA6AE8E2D2E2482B5CD9B9030E8AEFCC234BBC0EB243201EA0EADEF34941895E725FEAA62778
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2C08.tmp

Path C:\Users\Admin\AppData\Local\Temp\2C08.tmp
Size 3.6MB
SHA256 e197f00f34ee362acababb62c395dbf446314ac761339c0198546eedb8982600
MD5 8328abe6ebe7a58e3e4aa8a33e0a481e
SHA1 18942e7ab01617dce70315cafa9bfbfe2c9475d8
SHA512 df9acc814607ed42bd5899e667a00dfc67ce0000c5e78eabe8d25e8435442ab161552c345cb0b22f2f97e5e82e4ec94915bde29ab9c0a746eaf7a6b6f981d806
SSDEEP 49152:joa1taC070UAF/40VcWtVHftybg306DKZSlcYPetrl+VmgbQIzZMPXpB91rHp:joa1taC0440WWtVtyU306WZXBpnLrHp
TLSH
T1C3068B53EB814AD9E38D0436EF548150D72AF22997FF12613958128DEE83387BF61A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download