4c190474ab7e04525d0ca007a783d49bbea8458f81b4a8d84e3eac2b72800d4b

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_e4efdde10091dc84908d9d3f4c77d67d_amadey_elex_glassworm_smoke-loader.exe
Size 3.1MB
Sample260728-e1fxzayvc1
SHA256 4c190474ab7e04525d0ca007a783d49bbea8458f81b4a8d84e3eac2b72800d4b
MD5 e4efdde10091dc84908d9d3f4c77d67d
SHA1 007d16a481d9c91da1ed1809d9306b7accdc332d
SHA512 98a20da869575c2775b247ae4cce4b51100bdee9b5870cf645160c8aa8172b072de0f930faf937b3b72b11287e05dbd4dff1492c983eff84959e503232063b00
SSDEEP 49152:Noa1taC070UrJ4vLaJmwav6jK0scCltTt3VmgbQIzZ:Noa1taC0g+JgyfscIZ
TLSH
T125E5AE57EB818AE8F25D08376B584150DA2EF621AB4F2351796C420DDF8738B8F61E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4996	5BA3.tmp

Executes dropped EXE 1 IoCs

pid	Process
4996	5BA3.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_e4efdde10091dc84908d9d3f4c77d67d_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5BA3.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 4996	4316	2026-07-28_e4efdde10091dc84908d9d3f4c77d67d_amadey_elex_glassworm_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-28_e4efdde10091dc84908d9d3f4c77d67d_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_e4efdde10091dc84908d9d3f4c77d67d_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Users\Admin\AppData\Local\Temp\5BA3.tmp
  "C:\Users\Admin\AppData\Local\Temp\5BA3.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-28_e4efdde10091dc84908d9d3f4c77d67d_amadey_elex_glassworm_smoke-loader.exe 65F544A6F4074790FC146CE7993425869AC83968B0E1AB02FAA6A17B7DD2C4CD31C15FBAB960C82D78C01739D3E48D5D2C962566B9D18DE36B4660C9E6374403
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5BA3.tmp

Path C:\Users\Admin\AppData\Local\Temp\5BA3.tmp
Size 3.1MB
SHA256 e4f771bae8c5d330d001734a4f8978591d755c015d48009c9d00e026381ab2fc
MD5 902b0d2c65b17bb6440d85ccd5b43159
SHA1 1a2a4efb97e357a298d34d3d84d00225d66b7242
SHA512 e3a547d1f58e7951bbd068305772c73da70c0c08ff5d2883411c9e78b071ef65a10ab58e04a595de854ea489cd4f9c60e186708c7a5177e6cb6dc8fd62f8f7c3
SSDEEP 49152:Noa1taC070US9tCaazCWz79DK6WzZxpIA+6NJVVmgbQIzZ:Noa1taC0U9tdazCWz751WzvpK6N
TLSH
T1F1E5BD57EB818AE8F64D08376B584150DA2EF621AB4F2351396C420DDF8738B8F65E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download