735925bed40bc1e899652fe33d4e67717b18211f4177661318a4ce742ae71b67

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 23:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_27510ecd8f940e37c106a52a8af774f5_amadey_chir_elex_glassworm_rhadamanthys_smoke-loader_stop.exe
Size 141KB
Sample260816-3rewbazbpd
SHA256 735925bed40bc1e899652fe33d4e67717b18211f4177661318a4ce742ae71b67
MD5 27510ecd8f940e37c106a52a8af774f5
SHA1 aca2ee0b2c4f613916dcb940936cf148bc55c663
SHA512 959eee9966fb8e930ab93c651eeca67ab04050d92bad9db27955df21d0947b07d2513a8a595bc2d81984a9226a9e30ab231049148cf9ae3b1f8c413c72063973
SSDEEP 3072:aQEqFLILekflQrZQ1I+qmQ3oanPZqulpVlM70jpmEXVIhj4ouaAWMIOcPiv79QHf:0qFLIqkfmII+04oAUraC3chVRnRgIeZ8
TLSH
T105E3A60572F8406DF4F38A7058B187A2C97BBD31AE32D25D1AC406BE5E31D91DA22B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2044	4820	WerFault.exe	87
2232	4820	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_27510ecd8f940e37c106a52a8af774f5_amadey_chir_elex_glassworm_rhadamanthys_smoke-loader_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-16_27510ecd8f940e37c106a52a8af774f5_amadey_chir_elex_glassworm_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_27510ecd8f940e37c106a52a8af774f5_amadey_chir_elex_glassworm_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 432
  2⤵
  - Program crash
  PID:2044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 452
  2⤵
  - Program crash
  PID:2232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4820 -ip 4820
1⤵
PID:2512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4820 -ip 4820
1⤵
PID:6140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4820-0-0x0000000000400000-0x0000000000427000-memory.dmp

Download

memory/4820-1-0x0000000000400000-0x0000000000427000-memory.dmp