Analysis
- max time kernel
148s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
31/07/2026, 17:14
Behavioral task
behavioral1
Sample
2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe
- Size 1.9MB
- Sample260731-vr8jmaythy
- SHA256 35a4b1b952f7bcbc0b51b58a664a278c1c642766d266915275db6a111a69ce77
- MD5 a5a2c7c6764de014e7915ce3493d9de7
- SHA1 dea02bd9a2d00fe123bbb339256a6f79cbaffc4a
- SHA512 43fc0a5d1dfcb45188ad94454a419820168fbabd4966dfb1c22fdf18690159e862d45afc1cde6f4540d5fb1fcccba38e27cb5c42565447d45e405a56d18c19e3
- SSDEEP 49152:jj9LxcO4Q5YtNPFxd1qkqe8ZbnU41qkqnCg2887eIqZBsEZ9:jjBxcO4EYt111qfr1qfp2Ugs
- TLSH T148958C1277D24075E8F322B0552EB7399678FA100B2293CF87449DA9AF71BC25E39397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\System Database Administration Service = "C:\\Windows\\system32\\DbTasker.exe" 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe - Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\DbTasker.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\DbTasker.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File created C:\Windows\SysWOW64\hal.dll 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File created C:\Windows\SysWOW64\DBTASK.EXE 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File created C:\Windows\SysWOW64\dbzip2.dll 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File created C:\Windows\SysWOW64\dbexe2.dll 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe -
resource yara_rule behavioral1/memory/4696-0-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/files/0x0007000000024513-5.dat upx behavioral1/memory/4696-1044-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/4696-1447-0x0000000000400000-0x0000000000450000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\WinTask.zip 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1820 4696 WerFault.exe 85 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe 4696 2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_a5a2c7c6764de014e7915ce3493d9de7_amadey_elex_glassworm_smoke-loader.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4696 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 105442⤵
- Program crash
PID:1820
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4696 -ip 46961⤵PID:1076
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\wkw4D2.tmp
- Size 896KB
- SHA256 de31f04ceab3afe7e6147829367bd82579f4198db1a20b9367a6053760292c6d
- MD5 48d56c1b34b1ea2a7238f1f774656235
- SHA1 d46f9517048745b981de0ed590c41c523f1b4a6b
- SHA512 5376e46d87357be0e24b133ec53fe4f1d23852e33cf43bec3c79690af4f118039cc60d537dfad96ecdbbd76bfda8ac0bf1272b6c805d626755fc2e0eac8a7926
- SSDEEP 24576:jj9Lw63ct04QFzYtNP2k9DCfa1nlLokqZ8e:jj9LxcO4Q5YtNPFxd1qkqee
- TLSH T142154B1272934075D9F225B0056EA73A5678FA500B2293CF9744E9ADEFB2EC15E383D3
- MD5 SHA1 SHA512 SSDEEP TLSH