0e68c4ebc48f0c1d31fad9b939367c14aa8e0265e702e2512a578e33bdcc9322

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_1e00a1aa90ccda9e7059c9a1263dfa8a_amadey_elex_glassworm_smoke-loader.exe
Size 2.2MB
Sample260805-tsk92sck6v
SHA256 0e68c4ebc48f0c1d31fad9b939367c14aa8e0265e702e2512a578e33bdcc9322
MD5 1e00a1aa90ccda9e7059c9a1263dfa8a
SHA1 f20056a36dcd37272a646196ce9add6781635c67
SHA512 0dbee55baabea50cf0c8bd3b8d6ce9b3c3f3e4a199017397e0ca67541553127d3479de1e4508186fca478768834cf03c5550cc745014c98b5d6694b60261bc1f
SSDEEP 49152:toa1taC070UzoYWvX7oNxQKWJQrSz/4dVXqVwBaRwRw:toa1taC0YXc3Wis4L6
TLSH
T1CDB5F106B25461F2C06B03B1B85087D75666EC74AB51AAC37ECC532D6CA3FC4AE9FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4560	2AF3.tmp

Executes dropped EXE 1 IoCs

pid	Process
4560	2AF3.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_1e00a1aa90ccda9e7059c9a1263dfa8a_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2AF3.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 4560	4676	2026-08-05_1e00a1aa90ccda9e7059c9a1263dfa8a_amadey_elex_glassworm_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-05_1e00a1aa90ccda9e7059c9a1263dfa8a_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_1e00a1aa90ccda9e7059c9a1263dfa8a_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Users\Admin\AppData\Local\Temp\2AF3.tmp
  "C:\Users\Admin\AppData\Local\Temp\2AF3.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-05_1e00a1aa90ccda9e7059c9a1263dfa8a_amadey_elex_glassworm_smoke-loader.exe 0355187A632B0C55235C31604D235DAFE7592E1C52032BC43717858EC7B9502A4358A6D0F4CF42471F77936356C87215859D99526E6CDDCF80AED3C39BD6D4B7
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2AF3.tmp

Path C:\Users\Admin\AppData\Local\Temp\2AF3.tmp
Size 2.2MB
SHA256 52c5e73cbdd639388fb868045a3da1fe00974b9d2c0a894b0900bb5a64998da6
MD5 7c31c27e6272b9f1c18178e7bb2fe2e3
SHA1 6bb5ef1d571e7e3594ace467d2019d3d62b1b8f0
SHA512 0a14e213878af8e2337ec8f52b4c5372f31e4a7d67d764d9915e6cdf6efa57a1c13a4b6619209c78e994ee14999c8e48ddbd27ef371602d2c40567e3f6d97f6e
SSDEEP 49152:toa1taC070UBA9vvqUFXPJDOv0EXz97wS/IsDbKGRwRw:toa1taC049hD/2zNwSgsHKM
TLSH
T1BDB5F102B25461F3C06B0371B85487D68B65EC74AB516AC37ACC531E6CA7FC4AEDBB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download