97eb1a06f43d1f93455a4bc389d3c765cafce142b021c245eaa9d8b0ccde4c7c

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 08:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_84ae6ace70a56dbbc848eb38fe53f688_amadey_elex_glassworm_smoke-loader.exe
Size 4.5MB
Sample260825-krbjsayhlc
SHA256 97eb1a06f43d1f93455a4bc389d3c765cafce142b021c245eaa9d8b0ccde4c7c
MD5 84ae6ace70a56dbbc848eb38fe53f688
SHA1 bb1b4d406847b76d2e07c91f6d5036bf675587b4
SHA512 ba7891228ea0b9c547834323310d56231a6d5d32f94e237deb88bc928bb6452697a6fd57dd334dcc7eb60c05e68e0e118167a99905e9174957d095e69f6114f4
SSDEEP 98304:umSWOiIyU/Jcif+c0qe4A3IVLUjH5oxFbx:uX1HGc+b4VUjZEd
TLSH
T15A26DF53EB818AE8F28D08766B584251D72EF621AB4F2351395C120DCF8738B8F65E7D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5080	599F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_84ae6ace70a56dbbc848eb38fe53f688_amadey_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	599F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5404 wrote to memory of 5080	5404	2026-08-24_84ae6ace70a56dbbc848eb38fe53f688_amadey_elex_glassworm_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-24_84ae6ace70a56dbbc848eb38fe53f688_amadey_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_84ae6ace70a56dbbc848eb38fe53f688_amadey_elex_glassworm_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5404
- C:\Users\Admin\AppData\Local\Temp\599F.tmp
  "C:\Users\Admin\AppData\Local\Temp\599F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-24_84ae6ace70a56dbbc848eb38fe53f688_amadey_elex_glassworm_smoke-loader.exe BD6039ED43A11C3A7EC5086669C58800C8035B9055582771E38CA9CB789FBB67A01BF8E536C42FAC4304950F87CC28D6416CFE0710C71FD03F385A107B0C476E
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

599F.tmp

Path C:\Users\Admin\AppData\Local\Temp\599F.tmp
Size 4.5MB
SHA256 acdffac0faa8105f9de8a55551f6ba284f15fc358328e45682e0ca6f24f7f0b0
MD5 1dff82f7ac0a2d90822792fb68ddf0db
SHA1 797e9c20ceee17fe7ff5b1ac9edd6857c2b38bc2
SHA512 e8d2baec76266785a5b539da11bf92b9b7ec68b59c864fdef918dd30cb0ec452bc8509a64c891efea2659de483140ea53fcb3234a9f6247ec33437e029ec71e9
SSDEEP 98304:umSWOiIyUeUwTmkv1mu/G27vzcVLUjH5oxFbx:uXiTm41muN3cVUjZEd
TLSH
T17526DF53EB918AE8E28D08766F544251DB2EF621AB4F2351385C420DCF8738B8F65E7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download