70e143192ffcd5b2556314a1e4ba3a7d337aa57dc28462d4f2f295b38cec9971

Analysis

max time kernel
148s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 22:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_17f3955f01fa94258556b2e6bc7b97d2_amadey_elex_glassworm_smoke-loader.exe
Size 4.2MB
Sample260810-2wh8vsbl7w
SHA256 70e143192ffcd5b2556314a1e4ba3a7d337aa57dc28462d4f2f295b38cec9971
MD5 17f3955f01fa94258556b2e6bc7b97d2
SHA1 ccd3408dd1ac0b7d27179e1bc57e1a519b68cf22
SHA512 b14047518c1fb344f5632a4ee4d6a415cededd397eea5569a4b7e80f2dad442802d11551c6915a1d05873bf0025812fd5d31e689fd614371f465d331ecef5e25
SSDEEP 98304:9mSWOiIyUE0Inz6kfkVlcRo9BrgVLUjH5oxFbx:9XjInzhfkKoHgVUjZEd
TLSH
T137169B53EB814AD9E38D0476EF558150972AF22997FF1261395802CCEE83387BF61A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4740	4646.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_17f3955f01fa94258556b2e6bc7b97d2_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4646.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 4740	2952	2026-08-10_17f3955f01fa94258556b2e6bc7b97d2_amadey_elex_glassworm_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-10_17f3955f01fa94258556b2e6bc7b97d2_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_17f3955f01fa94258556b2e6bc7b97d2_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Users\Admin\AppData\Local\Temp\4646.tmp
  "C:\Users\Admin\AppData\Local\Temp\4646.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-10_17f3955f01fa94258556b2e6bc7b97d2_amadey_elex_glassworm_smoke-loader.exe 41A90029672F24D6DBC230920D92292DFB81426E549567121B39D6066AE47E410197E3C2464688BE2DF507BFC6985B7C30747885876E9FEF790B05189088BBB1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4646.tmp

Path C:\Users\Admin\AppData\Local\Temp\4646.tmp
Size 4.2MB
SHA256 73c975d4a426ad8e23e440221eea5dd04fdb7b9c0c8086b4b0ce1af3beceac2c
MD5 03c5ace7dac9de79f550e56290b72edf
SHA1 cbc34d5f66d799e867295ac7fb695d1d1bdb2538
SHA512 9fc22392bdf1c6c660a062cf069fb1c93952769cec7c69625473317418fa373e1c5becfd35cfc85c2ec60c87a879bf513bb0ef712732878af0fac654dd24811c
SSDEEP 49152:xvm22OdWOXqrbIyUJVE/YAOFL+eRKiBKcGJjoopBd0wLVT5kUvgJSgHT6ojkxFbt:9mSWOiIyUsY5dMcG5NVLUjH5oxFbx
TLSH
T184169B53EB814AD9E38D0476EF458150972AF22997FF1261385802CDEE87387BF61A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download