deb49d50e5fd8401fa9d572b0d3cbb649f95e78037d64390d4a7e6bc30af145d

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_7868f70a9a16a0cd75055489d5fba769_amadey_elex_glassworm_smoke-loader.exe
Size 2.2MB
Sample260813-e6wkls1hpe
SHA256 deb49d50e5fd8401fa9d572b0d3cbb649f95e78037d64390d4a7e6bc30af145d
MD5 7868f70a9a16a0cd75055489d5fba769
SHA1 d5c96c744e3e4b821fde78d696a24ea6cb95d729
SHA512 f1eed99c64b96204e22f4db50bfb6534b7fa59af156836764d0e50ac4f2dd98c0daec8ae0a635cf61d98ad550b38267f728ccb0333a5b7845e501c1b1aa20ade
SSDEEP 49152:hoa1taC070UU9QKd4XCtsMF5aLcbQiyR8xvOJFIw4i:hoa1taC0uH2XE5lQ
TLSH
T1FDB50101B30470F3C51A5BB06555E7E7AA60EC7B7B04A9C72988539E2CCBFC4AB97B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5860	DF2B.tmp

Executes dropped EXE 1 IoCs

pid	Process
5860	DF2B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_7868f70a9a16a0cd75055489d5fba769_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DF2B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 5860	4836	2026-08-13_7868f70a9a16a0cd75055489d5fba769_amadey_elex_glassworm_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-13_7868f70a9a16a0cd75055489d5fba769_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_7868f70a9a16a0cd75055489d5fba769_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Users\Admin\AppData\Local\Temp\DF2B.tmp
  "C:\Users\Admin\AppData\Local\Temp\DF2B.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-13_7868f70a9a16a0cd75055489d5fba769_amadey_elex_glassworm_smoke-loader.exe 61F0B13D083C27341CF1E07679034C8E4B0524CA76ABE036F2A5AC333BEB332B48D945B86B4CF7FFE86B771AA7FF9F2543C37CAFEB494A4A52519E042F66F3A4
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DF2B.tmp

Path C:\Users\Admin\AppData\Local\Temp\DF2B.tmp
Size 2.2MB
SHA256 9967730c5903b264c42a50d07b292685a5f62197503b4a8bf3d1b2783e006016
MD5 71770c6cd04c8d0e9e7f9bd20c1f2a61
SHA1 39978139610f7b9568334e0c4191629f995ed476
SHA512 28874d096a65ee2598cf4e56e3fb6d2d46404c07fb30228398b73e16687dc3ee189455dd60112b9bdec991e4daf8719482829b4d1c47b7392745bd70cc63e38e
SSDEEP 49152:hoa1taC070UdZX0lSEFCbqgfZdR8xvOJFIw4i:hoa1taC0HZX0lSEFC2gfr
TLSH
T182B50102F61070F3C51A5BB06555D7D79221ECB77B44A9C729C813AE2DCBBC8AB8BB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download