33271e9cb7aa5eb4a5a93c7625066351fa64b2436eb826f1ff9640c65e79a7da

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 17:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_90a341c6f84e34e900a3099eb4b94cff_amadey_elex_glassworm_poet-rat_smoke-loader.exe
Size 7.8MB
Sample260808-v52cgaar2z
SHA256 33271e9cb7aa5eb4a5a93c7625066351fa64b2436eb826f1ff9640c65e79a7da
MD5 90a341c6f84e34e900a3099eb4b94cff
SHA1 9665d92563ddff1cc9b7828d3e40b13431fc8ccd
SHA512 adb60f5cd591d7240d6581e78c2bf5f5423cf940b925a37b372605eee6eb738bf1e72ef500283c69aa88ba27084823025645bc7e5b86f43b9218703926275bc6
SSDEEP 98304:emhd1UryeNqjvMheGhb7V7wQqZUha5jtSyZIUb:elpThf2QbaZtli
TLSH
T158869D01EBF8DE1EC5BF0375A8B211158BF5F8D5DB53DB9E6900B0AD7A92340A942363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1224	778.tmp

Executes dropped EXE 1 IoCs

pid	Process
1224	778.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_90a341c6f84e34e900a3099eb4b94cff_amadey_elex_glassworm_poet-rat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	778.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5800 wrote to memory of 1224	5800	2026-08-08_90a341c6f84e34e900a3099eb4b94cff_amadey_elex_glassworm_poet-rat_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-08_90a341c6f84e34e900a3099eb4b94cff_amadey_elex_glassworm_poet-rat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_90a341c6f84e34e900a3099eb4b94cff_amadey_elex_glassworm_poet-rat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5800
- C:\Users\Admin\AppData\Local\Temp\778.tmp
  "C:\Users\Admin\AppData\Local\Temp\778.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-08_90a341c6f84e34e900a3099eb4b94cff_amadey_elex_glassworm_poet-rat_smoke-loader.exe D8EAB75283E49E3081114F11764938A915366056F23F1F5A7A35126832B9963BC699CA0C39DDA1E38EB8E7209C361C5B2D898DEB8A2C08F26787D03B926D682D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

778.tmp

Path C:\Users\Admin\AppData\Local\Temp\778.tmp
Size 7.8MB
SHA256 b4be80999470ce3dc295282af0ae1c998e55dfc49a0ba15ff1c53b3a4f13aebb
MD5 82c96c3ca4e91d7d12f130eb40a25ca5
SHA1 98f1aad5cbf9742ee25c562e751b37522a63ba67
SHA512 8714620e22be41788fb359230800fde5bb859e023708e647d465e6cda1e685cee6cdfa323b83a04a25c599a68bbdb832916436255e1406cc17b4f3590b41645a
SSDEEP 98304:emhd1UryeWCjwBJ2yha4cDV7wQqZUha5jtSyZIUb:el2C8FhY2QbaZtli
TLSH
T1CE869D01EBF8DE1EC5BF0375A8B211158BF5F8D5DB53DB9E6900B0AD7A923406A42363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1224-6-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/5800-0-0x0000000000400000-0x0000000000849000-memory.dmp