1f4bc54765f410891ff8030b3c0ab7765431c24a6770dadd6a2e714198d577a1

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_f58dadf0c77d9c109689a2348edf01fa_amadey_elex_glassworm_poet-rat_smoke-loader.exe
Size 7.0MB
Sample260808-phvnhs1sbs
SHA256 1f4bc54765f410891ff8030b3c0ab7765431c24a6770dadd6a2e714198d577a1
MD5 f58dadf0c77d9c109689a2348edf01fa
SHA1 0992cd04c8abb632004f698ffe7a280a595b1823
SHA512 05beb123120c8b754e7f7ca0bfddadbc628ace14a608ab371359d4c7d556b99aa206aa0928bddafaa4e0f0e34706723176af92b18b1cf9f573c6302e46eb1fab
SSDEEP 98304:emhd1UryecadYRdomRSV7wQqZUha5jtSyZIUbn:el8adYRKmE2QbaZtliK
TLSH
T12F76BE01EBA8EF2EC91F0379A4B2211197F5C5D4D743EB92AE11F5B8BD833507A06297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4424	4462.tmp

Executes dropped EXE 1 IoCs

pid	Process
4424	4462.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_f58dadf0c77d9c109689a2348edf01fa_amadey_elex_glassworm_poet-rat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4462.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5524 wrote to memory of 4424	5524	2026-08-08_f58dadf0c77d9c109689a2348edf01fa_amadey_elex_glassworm_poet-rat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-08_f58dadf0c77d9c109689a2348edf01fa_amadey_elex_glassworm_poet-rat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f58dadf0c77d9c109689a2348edf01fa_amadey_elex_glassworm_poet-rat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5524
- C:\Users\Admin\AppData\Local\Temp\4462.tmp
  "C:\Users\Admin\AppData\Local\Temp\4462.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-08_f58dadf0c77d9c109689a2348edf01fa_amadey_elex_glassworm_poet-rat_smoke-loader.exe CB4B18DF809F069121ECEB6EC4B94D03FBB3D45BF8423B52F6958DA515FFF36E0816DB210426E9DA4A0A2F0DBB53FA41D706E3BF28144161A89FAC2C15F7DB3E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4462.tmp

Path C:\Users\Admin\AppData\Local\Temp\4462.tmp
Size 7.0MB
SHA256 80934c835c292fc65c3722d09cf74782fb6f1fd8da114f43e2588619bd69cf16
MD5 a0e1526e250df8823e24ffc6bf19b723
SHA1 2c10eac5e76ace0b9b4d4fd0491b90f4f5ceeea5
SHA512 60c7364a5b435b7cd9be550ea44f2da65af129df2d65798247e4b6f17f4f5f1859a0ad6bca3f46b3b5462193186c8e53af48d406df1373a0552ed060b7493e24
SSDEEP 98304:emhd1Urye+GyNTkVwdN2Y3U0aHV7wQqZUha5jtSyZIUbn:ele8wT2IbU2QbaZtliK
TLSH
T15F76BE01EBA8EF2EC91F0379A4B2211197F5C5D4D743EB92AE11F5B8BD833507A06297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4424-6-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/5524-0-0x0000000000400000-0x0000000000849000-memory.dmp