2732733375f486e13f4b97cc1e08589c1482951adbdf63b5057eabc06d835296

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 00:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_3fb18ce10063cb1c54b5c736820f0736_amadey_elex_glassworm_smoke-loader.exe
Size 2.2MB
Sample260802-a9zdfsar2s
SHA256 2732733375f486e13f4b97cc1e08589c1482951adbdf63b5057eabc06d835296
MD5 3fb18ce10063cb1c54b5c736820f0736
SHA1 0b5be7b578f9d21c0b85b103efde62397c0aa923
SHA512 ebabe96bbdb4a45cd5e69938b01d698d27993392f4663d79a7c9c8b29329d58a77a0d85e75b6c70d967b23ae2328c860920089e9b39630ffd63b3103487541b4
SSDEEP 49152:toa1taC070U5am71dk3PLzFhN1wNOCYmnzKHBB+WFb9CRwRw:toa1taC0Wm7yzFhfw0Epwq
TLSH
T11BB5F106B21471F3C46B03B1B85087E69A65EC74AB515A837ACC531E6CA3FC4AEDFB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4148	1B6E.tmp

Executes dropped EXE 1 IoCs

pid	Process
4148	1B6E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_3fb18ce10063cb1c54b5c736820f0736_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1B6E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 4148	4536	2026-08-01_3fb18ce10063cb1c54b5c736820f0736_amadey_elex_glassworm_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-01_3fb18ce10063cb1c54b5c736820f0736_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_3fb18ce10063cb1c54b5c736820f0736_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Users\Admin\AppData\Local\Temp\1B6E.tmp
  "C:\Users\Admin\AppData\Local\Temp\1B6E.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-01_3fb18ce10063cb1c54b5c736820f0736_amadey_elex_glassworm_smoke-loader.exe D1D32824EA455A8E9913DBFD4DE50383B424177EA950946EA7C810D00F5A41D78E70660A3A4AEB0E5A0C45A2C24C25F6D90703D74710AE9A9A8A9D8673E83C65
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1B6E.tmp

Path C:\Users\Admin\AppData\Local\Temp\1B6E.tmp
Size 2.2MB
SHA256 80e7e91b6cb8c2921f048180ffcada12d55f70b98501ecc020617c2b92e17496
MD5 da6e06e33d9f56ac21560df9abdcb8cc
SHA1 e57d283ded7a75879c9f5c2e3227f2fb1e7c8a9b
SHA512 4a03be02b54360e0c751a3bd21ec869c47d1e5a2cd84c29a98d00ad87afaa1224cc1d06ae7ed64b62a7090b437a348b080e28001ea0901bdfa45b5548098e716
SSDEEP 49152:toa1taC070U9pAa3cfZQiJbVlbEgAmH2Z/vJRwRw:toa1taC036PQSxlbEgVH2Fvr
TLSH
T1ABB5F106B254B1E3C46A03B1B85087D69A65EC74AB506AC37ECC531D6CA3FC4AEDFB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download