eac41f1734b90a736d67bb869a09bd9ca2ff0c5788937862d54b9e59123296c1

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_a0a487ec11b5e8497899f8b1035dfc7b_amadey_elex_glassworm_smoke-loader.exe
Size 2.2MB
Sample260802-afkcfazway
SHA256 eac41f1734b90a736d67bb869a09bd9ca2ff0c5788937862d54b9e59123296c1
MD5 a0a487ec11b5e8497899f8b1035dfc7b
SHA1 4be0a408db442d91f669d38800504c619da0e6b5
SHA512 f66a4e15843cf54d38efb59b1f63cf47e4e365e580e3c9d6bb310db404f23f0917c4f903c0173427552fc465d780a54a1def0ccbb4ab5d47c203150ad001bdf3
SSDEEP 49152:toa1taC070UHXD++pp3WWEqvDbINtpltjmlNRwRw:toa1taC0xC+pp32qvfwltjmh
TLSH
T1C3B5F106F214A1F3C46B03B1B85082D69665EC74AB516A837ECC536E6CA3FC46EDFB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4876	8776.tmp

Executes dropped EXE 1 IoCs

pid	Process
4876	8776.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_a0a487ec11b5e8497899f8b1035dfc7b_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8776.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 4876	4828	2026-08-01_a0a487ec11b5e8497899f8b1035dfc7b_amadey_elex_glassworm_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-01_a0a487ec11b5e8497899f8b1035dfc7b_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_a0a487ec11b5e8497899f8b1035dfc7b_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Users\Admin\AppData\Local\Temp\8776.tmp
  "C:\Users\Admin\AppData\Local\Temp\8776.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-01_a0a487ec11b5e8497899f8b1035dfc7b_amadey_elex_glassworm_smoke-loader.exe 66F665D0BC5BDF1A92F5F7DBA95C243E3B497EAACE8FA9B98AC612978AF8E4621E687DF1AA44ACB774B2C31E6D4EA16B2C0E8F67272BDF3556E3913BD0FE7E47
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8776.tmp

Path C:\Users\Admin\AppData\Local\Temp\8776.tmp
Size 2.2MB
SHA256 39fc24f6128163b6e64e0361c8556ad9a9618362190647a3fa1e4f0abc4be474
MD5 40381d4fcc0350eff78b6f9220aab4eb
SHA1 b71d5ddc9bf3292bde4f3ecdee00dbd2e9c94e07
SHA512 9975bf9a7eef9194717cfe55b223c2311330515b16085e0470ea1337ad2fc9e8cd68f3d42fdf0800f9a4e15edf46c3f184695e1d21221cd3b9034a38fbb115b7
SSDEEP 49152:toa1taC070UjmxuUX5amXl+EM+B+2IbCMRwRw:toa1taC03L++92IbCi
TLSH
T155B5F116B61461F3C46B03B1B85083D69665EC70AB516AC37ACC532D2DA3FC8AEDFB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download