0e68c4ebc48f0c1d31fad9b939367c14aa8e0265e702e2512a578e33bdcc9322

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_1e00a1aa90ccda9e7059c9a1263dfa8a_amadey_elex_glassworm_smoke-loader.exe
Size 2.2MB
Sample260805-tsk92sck6v
SHA256 0e68c4ebc48f0c1d31fad9b939367c14aa8e0265e702e2512a578e33bdcc9322
MD5 1e00a1aa90ccda9e7059c9a1263dfa8a
SHA1 f20056a36dcd37272a646196ce9add6781635c67
SHA512 0dbee55baabea50cf0c8bd3b8d6ce9b3c3f3e4a199017397e0ca67541553127d3479de1e4508186fca478768834cf03c5550cc745014c98b5d6694b60261bc1f
SSDEEP 49152:toa1taC070UzoYWvX7oNxQKWJQrSz/4dVXqVwBaRwRw:toa1taC0YXc3Wis4L6
TLSH
T1CDB5F106B25461F2C06B03B1B85087D75666EC74AB51AAC37ECC532D6CA3FC4AE9FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5812	FC7C.tmp

Executes dropped EXE 1 IoCs

pid	Process
5812	FC7C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_1e00a1aa90ccda9e7059c9a1263dfa8a_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FC7C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 5812	4388	2026-08-05_1e00a1aa90ccda9e7059c9a1263dfa8a_amadey_elex_glassworm_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-05_1e00a1aa90ccda9e7059c9a1263dfa8a_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_1e00a1aa90ccda9e7059c9a1263dfa8a_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Users\Admin\AppData\Local\Temp\FC7C.tmp
  "C:\Users\Admin\AppData\Local\Temp\FC7C.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-05_1e00a1aa90ccda9e7059c9a1263dfa8a_amadey_elex_glassworm_smoke-loader.exe 87BF7B4D4705782BC7A21B57588F08424230AF110AE8317FEA2187E6C3C77116FCBD5DEF1FE39D7DCD128A592C3B60B3CF06855EECFE2650999113067770D817
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FC7C.tmp

Path C:\Users\Admin\AppData\Local\Temp\FC7C.tmp
Size 2.2MB
SHA256 1fe19d9502fa06baa5b3b6320ded0bdba3afa86500343bbfda1ebc328aada913
MD5 256f191fc53103890c7473c140ff02c3
SHA1 7063995f559b7b958483ef534ac0b488bae17f3b
SHA512 524d57fb6bf91b91e94d94f47a8a5816dd37a4ae0b0b70ff7687bb21782b9306130679fc898b18b576c835835f99cea2d6f7e792b148f56fe6d4d4919652d2d5
SSDEEP 49152:toa1taC070UvesK01c3wGmDvaQe43B2TIe3pQZQ9/vRwRw:toa1taC0C0SgF7aQe4cO8Z
TLSH
T112B5F106B25471F3C46B03B1A85087D79B65EC70AB506A837ACC536D6CA3FC86EDBB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download