606d181cb981eb964a789b21954065d1391d121a7280180ec4ec359f3be80eda

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 05:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_d9226ce43464b9379cd937a29317a95f_amadey_elex_glassworm_smoke-loader.exe
Size 4.2MB
Sample260804-fyb2nssalg
SHA256 606d181cb981eb964a789b21954065d1391d121a7280180ec4ec359f3be80eda
MD5 d9226ce43464b9379cd937a29317a95f
SHA1 c8cec271a8d0f8d1fc29e6e339de2e0c932dbe31
SHA512 1a87ca464e6edc6913fbb6f7fdc0fddf99b2576a8707c98edac9e63d9be1d4d205171da01eb912f491d30d84585577bcde8cf165f93434650b92dfbc108a6beb
SSDEEP 98304:9mSWOiIyUNru0Fbrj0+kBdVLUjH5oxFbx:9XnruY3j0+2dVUjZEd
TLSH
T13B169C53EB814AD9E38D0876DF558150972AF22997FF1261385802CCEE87387BF61A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3540	4D4B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_d9226ce43464b9379cd937a29317a95f_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4D4B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 3540	5000	2026-08-04_d9226ce43464b9379cd937a29317a95f_amadey_elex_glassworm_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_d9226ce43464b9379cd937a29317a95f_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_d9226ce43464b9379cd937a29317a95f_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Users\Admin\AppData\Local\Temp\4D4B.tmp
  "C:\Users\Admin\AppData\Local\Temp\4D4B.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-04_d9226ce43464b9379cd937a29317a95f_amadey_elex_glassworm_smoke-loader.exe C665C63FFE7190E8FC0D7A6291EE61CF93F7E93C76EF102D157614A24AD6BB3DAEC4268A69E9E1EA82EC482348EF9CAE64B6D650F745933B7338D5EFF8B9F8F5
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4D4B.tmp

Path C:\Users\Admin\AppData\Local\Temp\4D4B.tmp
Size 4.2MB
SHA256 2bba14b7a1728f8b6d14cc358901aba19812b641bf38ae8fd6d87f46f834e256
MD5 bdb3258523c5329b64fd49c249636697
SHA1 56f0ead38f8fafd78d4567d133040a1d73dd44a0
SHA512 87e57af1647789fe09b00ee117064106715b5d4c8beb04d011b708c86eaab2b6af28c9cd83dcc193388c80d0a24c235f6a2e6efe29497baa277c0d80d81c5af3
SSDEEP 98304:9mSWOiIyUACxxqUYnPCUpriUVLUjH5oxFbx:9Xv8UYaUpriUVUjZEd
TLSH
T13F169C53EB814AD9E38D0476EF558150972AF22997FF1261385812CCEE83387BF61A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download