Analysis
- max time kernel
148s - max time network
117s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/07/2026, 19:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe
- Size 2.4MB
- Sample260727-yf4cbazelc
- SHA256 9f4c1e0669d7761af8774d68354e82379df726d3397f635483db21cd877d6ee4
- MD5 e8c0c91154aae63e4d880e4448cc634e
- SHA1 511ac583afade2dd998542500d395bc7f56762ae
- SHA512 984d498a330cc67ee57a09b606812effc7dd99bcb3c4b7ab59fa8bbd4e3e6fd0c7f6aa90c04535e4eba5dce4698cebd31ba98dfd90c4e9bf7dd95fde527fe497
- SSDEEP 49152:nj9LxcO4Q5Yb6AOK+JLRH0mMrm1RF4c3Xpp:njBxcO4EYiK+JLCmMrm1RF4Y
- TLSH T1A0B53922B6E14038E4F3367059BD6775067ABC615B39C2CF5288959D9EB2FC0AD343A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\System Database Administration Service = "C:\\Windows\\system32\\DbTasker.exe" 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe - Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\DbTasker.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\DbTasker.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File created C:\Windows\SysWOW64\hal.dll 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File created C:\Windows\SysWOW64\DBTASK.EXE 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File created C:\Windows\SysWOW64\dbzip2.dll 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File created C:\Windows\SysWOW64\dbexe2.dll 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_101250\java.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\Windows Media Player\wmprph.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\WinTask.zip 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1644 2276 WerFault.exe 84 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe 2276 2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_e8c0c91154aae63e4d880e4448cc634e_amadey_elex_glassworm_smoke-loader.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2276 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 105242⤵
- Program crash
PID:1644
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2276 -ip 22761⤵PID:556
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\wkw4D2.tmp
- Size 2.2MB
- SHA256 410ab036750f8ac6f3382ec5b32ac25d0463d0dad0949ddcd2fe881c69591e13
- MD5 44d4135f86e8b29aa4d2d0adf14f7063
- SHA1 f11a1cac41ef1da7a086505a94cd0116f8290019
- SHA512 c9015d3ee8da8c9be252ecdb99537d3fdfa6659397cbb7b8dabe679e27d42994b58652cd2c757b587f62863b5a0d93986072b7cf59b33b81c34e5675c1e151a9
- SSDEEP 49152:nj9LxcO4Q5Yb6AOK+JLRH0mMrm1RF4c3Xp9:njBxcO4EYiK+JLCmMrm1RF4I
- TLSH T1F8B52812B6E54038E4F3367059BD6735067ABC605B39C2CF9288959D9EB2FC1AD343A3
- MD5 SHA1 SHA512 SSDEEP TLSH