18a1e5f49848f98b2236f48e3928b78e9241c6d81fa1bb52efb679f9ca9a2af3

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_96c625cbcbed0921bb66662395fb2266_amadey_elex_glassworm_poet-rat_smoke-loader.exe
Size 7.8MB
Sample260805-raryrsttby
SHA256 18a1e5f49848f98b2236f48e3928b78e9241c6d81fa1bb52efb679f9ca9a2af3
MD5 96c625cbcbed0921bb66662395fb2266
SHA1 139cd61ac700616eb656e4beb6b08137f470e197
SHA512 b263fc4650736563aafd273bab3ac3576643ac88c58c04ce14d04d7817178bbd15765feb553e7900069be9daa28670e24377733b80de08bfa0cbbe779e3285d6
SSDEEP 98304:emhd1Uryegr93EQ1E3IYZqV7wQqZUha5jtSyZIUb:elaC+sIYZq2QbaZtli
TLSH
T11E869D01EBF8DE1EC5BF0375A8B2111587F5F8D5DB53DB9E6900B0AD7A92340AA42363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4752	8812.tmp

Executes dropped EXE 1 IoCs

pid	Process
4752	8812.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_96c625cbcbed0921bb66662395fb2266_amadey_elex_glassworm_poet-rat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8812.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 4752	3772	2026-08-05_96c625cbcbed0921bb66662395fb2266_amadey_elex_glassworm_poet-rat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-05_96c625cbcbed0921bb66662395fb2266_amadey_elex_glassworm_poet-rat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_96c625cbcbed0921bb66662395fb2266_amadey_elex_glassworm_poet-rat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Users\Admin\AppData\Local\Temp\8812.tmp
  "C:\Users\Admin\AppData\Local\Temp\8812.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-05_96c625cbcbed0921bb66662395fb2266_amadey_elex_glassworm_poet-rat_smoke-loader.exe 40DA74186FE5F374F631C5852CB89E72F41955B147940AC3CC279868A021F4127073D7E83E3CE1A26E6E3C3B239DFB7C0198DE2F221F507893B7C1F6416AE3BB
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8812.tmp

Path C:\Users\Admin\AppData\Local\Temp\8812.tmp
Size 7.8MB
SHA256 9568df54865e98c6d35cd4df4874ace75604fb9d24aa2dc3b124701015c2cc11
MD5 d1e947cfd224bf285ffb5700d13c1e2e
SHA1 26aae971b545b7fcdc5b4dee279520153265f555
SHA512 b135a21f3ff644a63e3d8e6dbb1444f0cfbdf842d52b98393a1d48693c492587fecd27f71303009ca7a8d3ded218493ba0720e450d198a44467ef43c2f77ec32
SSDEEP 98304:emhd1UryeYlVHZgAXADlqcV7wQqZUha5jtSyZIUb:el4lV5gAGqc2QbaZtli
TLSH
T12B869D01EBF8DE1EC5BF0375A8B211158BF5F8D5DB53DB9E6900B0AD7A923406A42363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3772-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/4752-6-0x0000000000400000-0x0000000000849000-memory.dmp