8c3605dcbf0dfdbbca07f12000f00234d99453fe077961e8605ef645c9913b21

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 05:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_10ea19abcc1cd6ccec80f6d2caec4c00_amadey_elex_glassworm_smoke-loader.exe
Size 2.2MB
Sample260813-ga3edsha66
SHA256 8c3605dcbf0dfdbbca07f12000f00234d99453fe077961e8605ef645c9913b21
MD5 10ea19abcc1cd6ccec80f6d2caec4c00
SHA1 6640ec455aed1c39feff685ba5ca376ce0d02683
SHA512 4eaa5079b47a3921ef40e117193d64c7f5796407c47c84a856d1e480c18d68e692fcbc7af6376af5534097f7d1e9fbf4f2da15ad838b51676f226e2d5c123cf0
SSDEEP 49152:hoa1taC070Ui+AkBX3K1omW+OjIe4/HuHnR8xvOJFIw4i:hoa1taC0Y+jdKuZrn+K
TLSH
T1CCB50101F20070F3C15A27B0B955D7D7A660AC7B7B04ACC76988535E28DBFC8AB9BB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2604	9188.tmp

Executes dropped EXE 1 IoCs

pid	Process
2604	9188.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_10ea19abcc1cd6ccec80f6d2caec4c00_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9188.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 2604	4972	2026-08-13_10ea19abcc1cd6ccec80f6d2caec4c00_amadey_elex_glassworm_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-13_10ea19abcc1cd6ccec80f6d2caec4c00_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_10ea19abcc1cd6ccec80f6d2caec4c00_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Users\Admin\AppData\Local\Temp\9188.tmp
  "C:\Users\Admin\AppData\Local\Temp\9188.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-13_10ea19abcc1cd6ccec80f6d2caec4c00_amadey_elex_glassworm_smoke-loader.exe 98D2F80241F9245E7D360ABDBAB17DB777CA5B766F18374EB7060CF5374A9B85CA2910329DEB266657BC296DD18951923C0794A281C7EA150E99C83B274B739D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9188.tmp

Path C:\Users\Admin\AppData\Local\Temp\9188.tmp
Size 2.2MB
SHA256 275188d62713e8a1b77dab342c1878cfa57069ebe896c2437718ff80c833d569
MD5 92fe909bec885fb44418b3c725cdaccb
SHA1 54871886cefbe618004c2bf2c95febf5b1bf4f6f
SHA512 0d9452ae824b33744bcd1d33ad2e4d64b1d8f855eb5622bd81a273169317c699f1202ac0f18a1c0e2c5907ce15bc58bd34aac6fc6fe2047938e5fa963726073f
SSDEEP 49152:hoa1taC070Un6+PzsfbIRNOVxMxzolkpR8xvOJFIw4i:hoa1taC0p6+Ls5MxQa
TLSH
T144B50202F21070F3C11A5BB0B45597D79661AC777B05ADC329C8675E2CDBEC8AB8AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download