25d94486c12e514d279f219a5acb09954a9ac8e648268ac121d1069b13e2aca0

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 09:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_88532d92cd4ffd4894d2606877d88348_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
Size 79.2MB
Sample260807-k4vs7aar6s
SHA256 25d94486c12e514d279f219a5acb09954a9ac8e648268ac121d1069b13e2aca0
MD5 88532d92cd4ffd4894d2606877d88348
SHA1 c8e9ce526864c358c58e3dc9f4924cec070d235d
SHA512 badfc85fddd2cf631a1bafcd5f03e20fbcd377a4e9e033226408e150d841a724defaf6b997f482058f17250ff132dbad211322e1ea9def15406239f7c5c02b09
SSDEEP 1572864:c7uvrJIALFCLrmyYsibhebpJjjhqhteT1LAbAPSVl5SxYZXTr:c7WKAxqRYrhebpJnhUtE1LiAP05SYZXf
TLSH
T149083304B6BDCC79E669A135CFE742EEE18BAC702EF113D73089378CA6704A95D21671
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_88532d92cd4ffd4894d2606877d88348_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeBackupPrivilege	1676	2026-08-07_88532d92cd4ffd4894d2606877d88348_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
Token: SeRestorePrivilege	1676	2026-08-07_88532d92cd4ffd4894d2606877d88348_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-07_88532d92cd4ffd4894d2606877d88348_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_88532d92cd4ffd4894d2606877d88348_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sfx_thimble_bark_2.mp3

Path C:\Users\Admin\Desktop\MissionUS_pc_v3.07\audio\d5\sfx_thimble_bark_2.mp3
Size 18KB
SHA256 92b778bf9d2ad5ab5d53539b415bc6633029c5ba3e539c3130ccc8e1ae95586f
MD5 19e60e1198aee9d744c2330c74562e0c
SHA1 8976b25847c522069a16c84d0f60aa85c79f1241
SHA512 c3f5f87860a5364afd5539c3f3c502e6d3680d5fab6e02fe5d4fcab06bdbffc48e939ea72a91a9dfc71bf12b3ce87d5998ad5f9dda4f6bf361f18fb10a115250
SSDEEP 384:SSzg90myIYGKVGLNU/LObibh8E5qgdDSB3/KDz/q:SQg9XYGbNUBbhlGBvKDzC
TLSH
T19182CF3F221441EEF5166F77D21B9900D361B9E999623993FEF6023A872B7C187036B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3_col_001_n02_p1.mp3

Path C:\Users\Admin\Desktop\MissionUS_pc_v3.07\audio\dlgs\d3\d3_col_001_n02_p1.mp3
Size 124KB
SHA256 b3716679f835748ba7488953c94617aa46a5173368da57ccdff5a3470abba1c2
MD5 79d83c56f9d3d5839acc54c6d1233e7e
SHA1 b36c7850f7131168e4589d4888c60f60ba38e8ca
SHA512 9dd4eb2cbce36abf3fa17151834ca7b416b4abd23924c8cec30e93725bba873e9b846353283ae330b9b08e1dc4fc9f040936056998393d45e4ae79b7bccc89f7
SSDEEP 3072:giNeJFRcLto+NyI6t24DunImC1Gr2e9L62:gAgv8tuI6vuIm4Gae9L62
TLSH
T162C312C78F139B73FF2A9BF97129A251F6748CB65B55381AF9A9340AC5330A5038C48C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3_mre_001_n08_p2.mp3

Path C:\Users\Admin\Desktop\MissionUS_pc_v3.07\audio\dlgs\d3\d3_mre_001_n08_p2.mp3
Size 198KB
SHA256 c4dba8433e622712ffad281963413b3f2e18db2391a53e0da7f838687064d30f
MD5 fe09d05fe212317320855b36bedca043
SHA1 a7235422500edec4a70a02cdf62e8c64586fd206
SHA512 f8973ded6346170fa5898cc18ee364e97ddc75fa750012e4c3ffde4af771e2ea987eba731cb00d019056b43d8050f010cc49164b22adcc3552bdc7e4faffe628
SSDEEP 3072:Hz0zDcnzIWAZR7NimVWxTdBX3zi9Jh39GMur0o5EGQE8vdqjFcsEnFTQEN:HcczIHziRBXm9Jvur/+GQEUdqJXEnFL
TLSH
T17B141392CBE862FBF04AE1B1C5F54561D2D86C26356824D264CC328693F3E9ED74AC4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1676-0-0x0000000000400000-0x0000000000479000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads