585e70c8e37f352e91efcff27d88137a69f7e5f64309d4f242e9a00a62c899c7

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 18:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-21_8684b8f4d93b07eca5f3f798ec8937ad_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe
Size 3.5MB
Sample261022-xk25datvas
SHA256 585e70c8e37f352e91efcff27d88137a69f7e5f64309d4f242e9a00a62c899c7
MD5 8684b8f4d93b07eca5f3f798ec8937ad
SHA1 0a411af1b1f5a3483e8c5282d309115534da4cc7
SHA512 e32863d2f882a97a0f56fef9ab441bc677f188af998f42ea941ea7698f70247d35194ef9f93b8af655d25f1d72f64b5a85fac81c6b2a57b2acb8dc16813bec86
SSDEEP 49152:xnWnlpWORpTLYrxuzOCg8BnUL3UDkB/ZnoHwoIln+2yj5FJPSSxMMF:xWnlVRaxAnUSHK1ONNMMF
TLSH
T1A2068D1237F18135F2F31A309E7A5BA566BAFD625F34C98B2358350C1F31A909A36727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4188	4152	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-21_8684b8f4d93b07eca5f3f798ec8937ad_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-21_8684b8f4d93b07eca5f3f798ec8937ad_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-21_8684b8f4d93b07eca5f3f798ec8937ad_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 360
  2⤵
  - Program crash
  PID:4188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4152 -ip 4152
1⤵
PID:4732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4152-0-0x0000000000400000-0x000000000078C000-memory.dmp

Download

memory/4152-1-0x0000000000400000-0x000000000078C000-memory.dmp

Download

memory/4152-2-0x0000000000400000-0x000000000078C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads