Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
16/04/2026, 10:32
General
- Target 2026-04-16_60603f24fb73819a438179be2ce7c940_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
- Size 1.4MB
- Sample260416-mk7praf15x
- SHA256 ad7ac4809c954b0d11ff00390fe215c3af7349f975de34a50920703b5118b57b
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 8 IoCs
- Drops file in System32 directory 2 IoCs
- Drops file in Program Files directory 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_60603f24fb73819a438179be2ce7c940_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_60603f24fb73819a438179be2ce7c940_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jucheck32.exe"jucheck32.exe "2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaws.exe"C:\Program Files\Java\jre-1.8\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdate3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe"C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamRrLmRpc2FibGVMYXN0VXNhZ2VUcmFja2luZz10cnVlAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGUALURqbmxweC52bWFyZ3M9TFVScVpHc3VaR2x6WVdKc1pVeGhjM1JWYzJGblpWUnlZV05yYVc1blBYUnlkV1VB -ma LVNTVkJhc2VsaW5lVXBkYXRlAC1ub3RXZWJKYXZh4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\SysWOW64\eventviewer.exe"C:\Windows\system32\eventviewer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
103621DE9CD5414CC2538780B4B75751
8B3C0310C2EA810C48E449EA75059E8A
103621DE9CD5414CC2538780B4B75751
8B3C0310C2EA810C48E449EA75059E8A
deployment.properties
securitypack.jar
jucheck32.exe
jusched.log
tmp96C.tmp
eventviewer.exe
syslog.exe
memory/1984-89-0x000001FADE810000-0x000001FADE811000-memory.dmp
memory/1984-55-0x000001FADE810000-0x000001FADE811000-memory.dmp
memory/1984-147-0x000001FAF9070000-0x000001FAF907C000-memory.dmp
memory/1984-146-0x000001FAF9060000-0x000001FAF9068000-memory.dmp
memory/1984-145-0x000001FADE6F0000-0x000001FADE78E000-memory.dmp
memory/1984-144-0x000001FADE810000-0x000001FADE811000-memory.dmp
memory/1984-98-0x000001FADE810000-0x000001FADE811000-memory.dmp
memory/1984-68-0x000001FADE810000-0x000001FADE811000-memory.dmp
memory/2212-21-0x0000023286C10000-0x0000023286CAE000-memory.dmp
memory/3824-219-0x0000000003210000-0x0000000003257000-memory.dmp
memory/3824-159-0x0000000003210000-0x0000000003257000-memory.dmp
memory/3916-158-0x0000000001410000-0x0000000001457000-memory.dmp
memory/3916-148-0x0000000001410000-0x0000000001457000-memory.dmp
memory/4408-171-0x00000000031F0000-0x0000000003237000-memory.dmp
memory/4408-1108-0x0000000005E70000-0x000000000790E000-memory.dmp