db94c6719da61b0c92876e9df1e181d765547941c1be2b76171f2ec71814cb49

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 01:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_b25b213a9ef253bf4565921730217e18_amadey_elex_glassworm_poet-rat_smoke-loader.exe
Size 7.8MB
Sample260731-brhteshl8v
SHA256 db94c6719da61b0c92876e9df1e181d765547941c1be2b76171f2ec71814cb49
MD5 b25b213a9ef253bf4565921730217e18
SHA1 8ec96787b655fc57c76e136bb9ad71a7a3d73da1
SHA512 6491adc97748414930cd096cf9f86d4543f1ea831c54f3559d7e25dd98ea12485174d11216dd3b87bf69e6fc0df6170276150e06e139ae50ea353b52560870d5
SSDEEP 98304:emhd1Urye0AyNIGB8Sq1EaWyoV7wQqZUha5jtSyZIUb:elU5O51EaWV2QbaZtli
TLSH
T1B6869D01EBF8DE1EC5BF0375A8B211158BF5F8D5DB53DB9E6900B0AD7A923406A42363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2996	DAB0.tmp

Executes dropped EXE 1 IoCs

pid	Process
2996	DAB0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_b25b213a9ef253bf4565921730217e18_amadey_elex_glassworm_poet-rat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DAB0.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 2996	1120	2026-07-31_b25b213a9ef253bf4565921730217e18_amadey_elex_glassworm_poet-rat_smoke-loader.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-07-31_b25b213a9ef253bf4565921730217e18_amadey_elex_glassworm_poet-rat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_b25b213a9ef253bf4565921730217e18_amadey_elex_glassworm_poet-rat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Users\Admin\AppData\Local\Temp\DAB0.tmp
  "C:\Users\Admin\AppData\Local\Temp\DAB0.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-31_b25b213a9ef253bf4565921730217e18_amadey_elex_glassworm_poet-rat_smoke-loader.exe 7CCA1D5DC1D9B14F3D4CDC4E8CB7DBEB3918F0D410C7B01638CDC453D0D79526621DD77C7E2184603416D78D73874C34B5B03783F760A927DD09E34520613A35
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DAB0.tmp

Path C:\Users\Admin\AppData\Local\Temp\DAB0.tmp
Size 7.8MB
SHA256 694bf1934ec068f7640b8972fc0ba683f4ea71bbd0ade9b081275ef8689a6eaa
MD5 a123d95755ae5b6a68f80111b6d65efd
SHA1 bdba05032cb4cfae81f91d2bcc2bd2b301dc67b9
SHA512 ebbf74aa3eadb47d14bcfc83b4c2e4fcc69f5b366070a5f3e474abdb32e95bab804e97faeb10fc45136ffc01e264114b641c14319675f3bc5c0197c472e0b70e
SSDEEP 98304:emhd1UryeOjjb8q5PHV7wQqZUha5jtSyZIUb:eluf3H2QbaZtli
TLSH
T197869D01EBF8DE1ED5BF0379A8B211158BF5F8D5DB53DB9E6900B0AD7A923406902363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1120-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/2996-5-0x0000000000400000-0x0000000000849000-memory.dmp