8c3605dcbf0dfdbbca07f12000f00234d99453fe077961e8605ef645c9913b21

Analysis

max time kernel
149s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 05:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_10ea19abcc1cd6ccec80f6d2caec4c00_amadey_elex_glassworm_smoke-loader.exe
Size 2.2MB
Sample260813-ga3edsha66
SHA256 8c3605dcbf0dfdbbca07f12000f00234d99453fe077961e8605ef645c9913b21
MD5 10ea19abcc1cd6ccec80f6d2caec4c00
SHA1 6640ec455aed1c39feff685ba5ca376ce0d02683
SHA512 4eaa5079b47a3921ef40e117193d64c7f5796407c47c84a856d1e480c18d68e692fcbc7af6376af5534097f7d1e9fbf4f2da15ad838b51676f226e2d5c123cf0
SSDEEP 49152:hoa1taC070Ui+AkBX3K1omW+OjIe4/HuHnR8xvOJFIw4i:hoa1taC0Y+jdKuZrn+K
TLSH
T1CCB50101F20070F3C15A27B0B955D7D7A660AC7B7B04ACC76988535E28DBFC8AB9BB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
764	69C1.tmp

Executes dropped EXE 1 IoCs

pid	Process
764	69C1.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_10ea19abcc1cd6ccec80f6d2caec4c00_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	69C1.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 764	4772	2026-08-13_10ea19abcc1cd6ccec80f6d2caec4c00_amadey_elex_glassworm_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-13_10ea19abcc1cd6ccec80f6d2caec4c00_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_10ea19abcc1cd6ccec80f6d2caec4c00_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Users\Admin\AppData\Local\Temp\69C1.tmp
  "C:\Users\Admin\AppData\Local\Temp\69C1.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-13_10ea19abcc1cd6ccec80f6d2caec4c00_amadey_elex_glassworm_smoke-loader.exe D795F262D1B652B0FC1FEBA6E95C405B87AD98CD981F769152A86EE69C610127399DD178460A736340C4B6B87298C3A646350E02D25091F864F9B77770687CAF
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

69C1.tmp

Path C:\Users\Admin\AppData\Local\Temp\69C1.tmp
Size 2.2MB
SHA256 8395f4779f99e0d8ad416373091731ef4283c59adc7e3ce0a764dbff88c0c521
MD5 29dd3c57a251e5e096c5b0d0eed2e891
SHA1 421991f2e49abcbb5fc3f95cf6ac4f681fba162c
SHA512 2549845716b7ec1b9a6b621e2a0a4b372adb42c7ebe12216fb6d938e6b404b2e860aa0466aa199b0c33d94e25a02d5410aaa1dfb45e128fb5ae28774db4a1664
SSDEEP 49152:hoa1taC070UoGkknEQCx6QXvjSlDrQzbMrkHaI47+Va+8QR8xvOJFIw4i:hoa1taC0zjnbCx6QXvjsDwMrkHaTXtY
TLSH
T1D9B50101F21470F3C11A6BB06545E7D79660FC7B7B05ADC72988536E28DBBC8AB8BB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download