4c190474ab7e04525d0ca007a783d49bbea8458f81b4a8d84e3eac2b72800d4b

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_e4efdde10091dc84908d9d3f4c77d67d_amadey_elex_glassworm_smoke-loader.exe
Size 3.1MB
Sample260728-e1fxzayvc1
SHA256 4c190474ab7e04525d0ca007a783d49bbea8458f81b4a8d84e3eac2b72800d4b
MD5 e4efdde10091dc84908d9d3f4c77d67d
SHA1 007d16a481d9c91da1ed1809d9306b7accdc332d
SHA512 98a20da869575c2775b247ae4cce4b51100bdee9b5870cf645160c8aa8172b072de0f930faf937b3b72b11287e05dbd4dff1492c983eff84959e503232063b00
SSDEEP 49152:Noa1taC070UrJ4vLaJmwav6jK0scCltTt3VmgbQIzZ:Noa1taC0g+JgyfscIZ
TLSH
T125E5AE57EB818AE8F25D08376B584150DA2EF621AB4F2351796C420DDF8738B8F61E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
700	6666.tmp

Executes dropped EXE 1 IoCs

pid	Process
700	6666.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_e4efdde10091dc84908d9d3f4c77d67d_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6666.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 700	2344	2026-07-28_e4efdde10091dc84908d9d3f4c77d67d_amadey_elex_glassworm_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-28_e4efdde10091dc84908d9d3f4c77d67d_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_e4efdde10091dc84908d9d3f4c77d67d_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Users\Admin\AppData\Local\Temp\6666.tmp
  "C:\Users\Admin\AppData\Local\Temp\6666.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-28_e4efdde10091dc84908d9d3f4c77d67d_amadey_elex_glassworm_smoke-loader.exe 2EC3DDB1FF3A91C608AABA5DE6B2983356940A372340684121513857A7E55BC908C84424C9BCD49550F79F6AE765D3A98D3EF84EA214E25463B72C1716FD38EF
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6666.tmp

Path C:\Users\Admin\AppData\Local\Temp\6666.tmp
Size 3.1MB
SHA256 40397a8b1b2c493a3e8c2291653813cca7bf064b473ebab0e223f5391549a1aa
MD5 67af5664f60081475ae8421a5f46998f
SHA1 e2fc776c046eb0e6794c0adb18123b80a686460d
SHA512 fced08246b1463e3d3ef0e5d317bf85927e8462c2dfc87332e0fa09d1a8fe0d9878b311898e57c2b836cd4d4c2d93b4210d0eaebe628fd14b50b5a81faed371d
SSDEEP 49152:Noa1taC070UTXKE7qS7xJEmvK3Tfwrg9VmgbQIzZ:Noa1taC0J1mStJbvK3DS
TLSH
T10EE5BE57EB818AE8F64D08376B584150DA2EF661A74F2351796C420DDF8338B8FA1E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download