Analysis
- max time kernel
149s - max time network
137s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
16/04/2026, 10:32
General
- Target 2026-04-16_60603f24fb73819a438179be2ce7c940_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
- Size 1.4MB
- Sample260416-mk7praf15x
- SHA256 ad7ac4809c954b0d11ff00390fe215c3af7349f975de34a50920703b5118b57b
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 10 IoCs
- Drops file in System32 directory 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_60603f24fb73819a438179be2ce7c940_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_60603f24fb73819a438179be2ce7c940_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jucheck32.exe"jucheck32.exe "2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaws.exe"C:\Program Files\Java\jre-1.8\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdate3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe"C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamRrLmRpc2FibGVMYXN0VXNhZ2VUcmFja2luZz10cnVlAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGUALURqbmxweC52bWFyZ3M9TFVScVpHc3VaR2x6WVdKc1pVeGhjM1JWYzJGblpWUnlZV05yYVc1blBYUnlkV1VB -ma LVNTVkJhc2VsaW5lVXBkYXRlAC1ub3RXZWJKYXZh4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\SysWOW64\eventviewer.exe"C:\Windows\system32\eventviewer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
57C8EDB95DF3F0AD4EE2DC2B8CFD4157
8B3C0310C2EA810C48E449EA75059E8A
57C8EDB95DF3F0AD4EE2DC2B8CFD4157
8B3C0310C2EA810C48E449EA75059E8A
deployment.properties
securitypack.jar
2026-04-16_60603f24fb73819a438179be2ce7c940_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
jucheck32.exe
jusched.log
tmpE395.tmp
eventviewer.exe
syslog.exe
memory/2096-421-0x0000000003AE0000-0x0000000003B00000-memory.dmp
memory/2096-420-0x0000000003AB0000-0x0000000003AD2000-memory.dmp
memory/2096-147-0x0000000000A90000-0x0000000000ADA000-memory.dmp
memory/2096-419-0x0000000000A90000-0x0000000000ADA000-memory.dmp
memory/3332-501-0x0000000005D60000-0x0000000005E8A000-memory.dmp
memory/3332-537-0x0000000002290000-0x00000000022DA000-memory.dmp
memory/3332-148-0x0000000002290000-0x00000000022DA000-memory.dmp
memory/3620-21-0x00000215592F0000-0x000002155939E000-memory.dmp
memory/3988-146-0x00000000021F0000-0x000000000223A000-memory.dmp
memory/5040-144-0x00000166BBDD0000-0x00000166BBDDC000-memory.dmp
memory/5040-145-0x00000166BBFE0000-0x00000166BBFF2000-memory.dmp
memory/5040-143-0x00000166A0820000-0x00000166A08CE000-memory.dmp
memory/5040-142-0x00000166A0950000-0x00000166A0951000-memory.dmp
memory/5040-99-0x00000166A0950000-0x00000166A0951000-memory.dmp
memory/5040-69-0x00000166A0950000-0x00000166A0951000-memory.dmp