2c785a6285d2469655d11cabd3120cfd4476bb32fc692409c732f202447c07d3

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_25d3f8fc0edd04f7706554b0e8af8ae3_amadey_elex_glassworm_smoke-loader.exe
Size 4.5MB
Sample260816-sfe2ts1and
SHA256 2c785a6285d2469655d11cabd3120cfd4476bb32fc692409c732f202447c07d3
MD5 25d3f8fc0edd04f7706554b0e8af8ae3
SHA1 8dafefb4074cc0a07eced4787a662a8053c40048
SHA512 09e342052557d5a81db7f21996fc24931b1e573b9121432ae02610ebfeb29bb87c425d4c3785941ce20bbabdb514b2108034ccd00ec7b88c72bd200742965087
SSDEEP 98304:umSWOiIyUJVrGUwHS4IJbVLUjH5oxFbx:uXhtwHIJbVUjZEd
TLSH
T14D26DF53EB818AD8F28D09766B584250DB2EF625A74F2351396C020DCF8738B8F65E7D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5476	84B7.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_25d3f8fc0edd04f7706554b0e8af8ae3_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	84B7.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 5476	1900	2026-08-16_25d3f8fc0edd04f7706554b0e8af8ae3_amadey_elex_glassworm_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-16_25d3f8fc0edd04f7706554b0e8af8ae3_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_25d3f8fc0edd04f7706554b0e8af8ae3_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Users\Admin\AppData\Local\Temp\84B7.tmp
  "C:\Users\Admin\AppData\Local\Temp\84B7.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-16_25d3f8fc0edd04f7706554b0e8af8ae3_amadey_elex_glassworm_smoke-loader.exe 496886C135D1BA6E35B769177C5BE45B5D8A9BBBE11A27221424FB832EFC3E3AFD85E12AE7FE17753359E9F3F1DCF1954A315C0C01519B915702FA2777976787
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

84B7.tmp

Path C:\Users\Admin\AppData\Local\Temp\84B7.tmp
Size 4.5MB
SHA256 4745639b1d0b2d5c0875cafbd68e0aab4ebb566a7e2cc628417a7acf789cd4d3
MD5 825500f388569d1aaf69b6cda8345342
SHA1 b8cefebc1902ce5bd1938022fc495f88c9ff62c8
SHA512 ae5dc0afc9bc01c4b13c0a687a9f2fb986e6bc404689d6c4798f8de2e83aee2e698cc0cb366e3b7e12abff5d7e4ac8154b884439938818cb410cf052b9196c84
SSDEEP 49152:ivm22OdWOXqrbIyUJVTKsOGpB+itDbKvuWDLfRMWW+T+wLVT5kUvgJSgHT6ojkxR:umSWOiIyU3XB+EvKXWedVLUjH5oxFbx
TLSH
T15D26DF93EB918AE8F28D04766B544250DB2EF621AB4F2351795C020DCF8738B8F65E7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download