31f6146bac3c15782a61475a402aba46cafed8b98b76ff1a855c7800d330b785

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 22:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_6d50d90c22c729777e10e0604163b162_amadey_elex_glassworm_poet-rat_smoke-loader.exe
Size 7.8MB
Sample260929-2s588axbrf
SHA256 31f6146bac3c15782a61475a402aba46cafed8b98b76ff1a855c7800d330b785
MD5 6d50d90c22c729777e10e0604163b162
SHA1 d857afefb37197728326b088e95e35db4233072f
SHA512 e5ee52b7c85f7422a81338285099ea02d576f509fed294dd7b98ffd018c20dc8d02ea0dd887041945bf3906ec5d4c8ea5a88300f3c2ae2de2b38e78aca41bcfa
SSDEEP 98304:emhd1Uryef6JVXMVXfiB4R8V7wQqZUha5jtSyZIUb:el/6rDB4R82QbaZtli
TLSH
T185869D01EBF89E1EC5BF0375A8B211158BF5F8D5DB53DB9E6900B0AD7E923406A42363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
1656	7B41.tmp

Executes dropped EXE 1 IoCs

pid	Process
1656	7B41.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_6d50d90c22c729777e10e0604163b162_amadey_elex_glassworm_poet-rat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7B41.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 1656	2952	2026-09-29_6d50d90c22c729777e10e0604163b162_amadey_elex_glassworm_poet-rat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-29_6d50d90c22c729777e10e0604163b162_amadey_elex_glassworm_poet-rat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_6d50d90c22c729777e10e0604163b162_amadey_elex_glassworm_poet-rat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Users\Admin\AppData\Local\Temp\7B41.tmp
  "C:\Users\Admin\AppData\Local\Temp\7B41.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-09-29_6d50d90c22c729777e10e0604163b162_amadey_elex_glassworm_poet-rat_smoke-loader.exe 538C4AD5E1124F16BF7CF13B5D6994C6FFEA2C6565869F4798DCD35C2FC13F8B7856436FF801B724E6B68D6F71B9BA15F08440F012A021359E0EF6E927E896AA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7B41.tmp

Path C:\Users\Admin\AppData\Local\Temp\7B41.tmp
Size 7.8MB
SHA256 a0b7d40f1692b84a1c76a9250747664ca600b1f133eaf2f0631fb986b6c55f3e
MD5 0ec43584f8191c032769c08146ddd2b5
SHA1 f4e2a3e73d6e960813fb79dc1176220675051ebc
SHA512 6102d6b99bd0851d70d9ed86bd6d15dd997e8b079fbe426f8f5ace7b58f99c08f7028e2b23554a3520dd071d5b2c97d55533a1910b427bb83656dadcd05d8671
SSDEEP 98304:emhd1UryeT2XqGmwLihnV7wQqZUha5jtSyZIUb:elzBwip2QbaZtli
TLSH
T175869D01EBF8DE1EC5BF0375A8B2111587F5F8D5DB53DB9E6900B0AD7A92340AA42363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1656-6-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/2952-0-0x0000000000400000-0x0000000000849000-memory.dmp