606d181cb981eb964a789b21954065d1391d121a7280180ec4ec359f3be80eda

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 05:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_d9226ce43464b9379cd937a29317a95f_amadey_elex_glassworm_smoke-loader.exe
Size 4.2MB
Sample260804-fyb2nssalg
SHA256 606d181cb981eb964a789b21954065d1391d121a7280180ec4ec359f3be80eda
MD5 d9226ce43464b9379cd937a29317a95f
SHA1 c8cec271a8d0f8d1fc29e6e339de2e0c932dbe31
SHA512 1a87ca464e6edc6913fbb6f7fdc0fddf99b2576a8707c98edac9e63d9be1d4d205171da01eb912f491d30d84585577bcde8cf165f93434650b92dfbc108a6beb
SSDEEP 98304:9mSWOiIyUNru0Fbrj0+kBdVLUjH5oxFbx:9XnruY3j0+2dVUjZEd
TLSH
T13B169C53EB814AD9E38D0876DF558150972AF22997FF1261385802CCEE87387BF61A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4352	561A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_d9226ce43464b9379cd937a29317a95f_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	561A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 4352	2752	2026-08-04_d9226ce43464b9379cd937a29317a95f_amadey_elex_glassworm_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-04_d9226ce43464b9379cd937a29317a95f_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_d9226ce43464b9379cd937a29317a95f_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Users\Admin\AppData\Local\Temp\561A.tmp
  "C:\Users\Admin\AppData\Local\Temp\561A.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-04_d9226ce43464b9379cd937a29317a95f_amadey_elex_glassworm_smoke-loader.exe B8A942B183A25B5928C56BAB81264C2641D169C851B94FF78984C3A72A23CE408F3EEC14DD86B4CB0E9802BECFD0BC912E1675A5A32B288826DD79F7BD8DB2AB
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

561A.tmp

Path C:\Users\Admin\AppData\Local\Temp\561A.tmp
Size 4.2MB
SHA256 cd9c2a1ea0ddd369687a3aa398113843cb173cfe22df213183b39f8af3aa9442
MD5 305114f551898e9b47d1776c2a1c2e0e
SHA1 4cb93ea07b099a6beca1d7f391ef9074b84fb5c4
SHA512 8319d14fc9ab7b6360ddd3d821d76a689fe207300b0430fc7f00acb06363524b388efa6c3a3216c7bae54c75459dcadea5c439c3081c85ec6f81ab2d9f8f3703
SSDEEP 49152:xvm22OdWOXqrbIyUJVJpIUkt46V5HjvGGxZacNKwLVT5kUvgJSgHT6ojkxFbxLWQ:9mSWOiIyUzsbz7TxwWxVLUjH5oxFbx
TLSH
T172169B57EB814AD9E38D0476EF558150972AF22997FF1221385802CCEE87387BF61A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download