88ad59a3794d8f27f47468c6790c6928fd505f08fa7601be2cf4139cd01b4222

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 09:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_9e6ed5f4ed6ccc9c3b5814119eeebb08_amadey_elex_glassworm_smoke-loader.exe
Size 4.5MB
Sample260803-kynspafa89
SHA256 88ad59a3794d8f27f47468c6790c6928fd505f08fa7601be2cf4139cd01b4222
MD5 9e6ed5f4ed6ccc9c3b5814119eeebb08
SHA1 54feb33b450818b4dcffb723c6d18f531e652731
SHA512 a26468a2476c09e7bea5528ca327de88edb5b73479a9f3d958c548cad939db3fc43c235a19bb6374ed3541ab2f6fb68753ad1f30f38dbaff1e04de76ef3f0a85
SSDEEP 98304:umSWOiIyUh6/+/zJUjUMtVLUjH5oxFbx:uXx9UjUMtVUjZEd
TLSH
T15426DF53EB818AE8F28D04766B584251DB2EF621AA4F2351395C430DCF8738B8F65E7D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2100	3435.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_9e6ed5f4ed6ccc9c3b5814119eeebb08_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3435.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 2100	4768	2026-08-03_9e6ed5f4ed6ccc9c3b5814119eeebb08_amadey_elex_glassworm_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_9e6ed5f4ed6ccc9c3b5814119eeebb08_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_9e6ed5f4ed6ccc9c3b5814119eeebb08_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Users\Admin\AppData\Local\Temp\3435.tmp
  "C:\Users\Admin\AppData\Local\Temp\3435.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-03_9e6ed5f4ed6ccc9c3b5814119eeebb08_amadey_elex_glassworm_smoke-loader.exe BD4F67F96330697801E33E54D5AD6040407622C32653A25AD1C2A2D4429FE7FC513F7FCBE64D94BF525BA65B3EE8CADC04445806C0D2D1405ACFAC9338D61A29
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3435.tmp

Path C:\Users\Admin\AppData\Local\Temp\3435.tmp
Size 4.5MB
SHA256 cebbccf60997d37bea5bb23c89b68bcb68d6f5ced922a58fe73fd12427ffdc4b
MD5 87d71587968590a950dc5cd850bee636
SHA1 77ebac08b701ab0b7a69909dcf880b9aa1e31843
SHA512 0a89b021c44d1297abc0162493d2cadb1e179b6e1961005fe45c86efd390b20d3c88d84a24f4349b283506d45eb3663acdfc024b8964750f0470c5f88dd01871
SSDEEP 98304:umSWOiIyUMtnUpVom6iW1GVLUjH5oxFbx:uX2tci1CVUjZEd
TLSH
T10426DF53EB819AE8F28D05766B584241DB2EF621AB4F2351395C020DCF8738B8F65E7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download