Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
17/04/2026, 05:04
General
- Target 2026-04-17_d8999107e0ff2a5f152210400f1f049a_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
- Size 1.4MB
- Sample260417-fp8paaay8x
- SHA256 b5d9561251a0d957699c1880adf6d14e15e7414bf591dbdb90f0a91608b2c4e3
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 6 IoCs
- Drops file in System32 directory 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-17_d8999107e0ff2a5f152210400f1f049a_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-17_d8999107e0ff2a5f152210400f1f049a_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jucheck32.exe"jucheck32.exe "2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaws.exe"C:\Program Files\Java\jre-1.8\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdate3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe"C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamRrLmRpc2FibGVMYXN0VXNhZ2VUcmFja2luZz10cnVlAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGUALURqbmxweC52bWFyZ3M9TFVScVpHc3VaR2x6WVdKc1pVeGhjM1JWYzJGblpWUnlZV05yYVc1blBYUnlkV1VB -ma LVNTVkJhc2VsaW5lVXBkYXRlAC1ub3RXZWJKYXZh4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\SysWOW64\eventviewer.exe"C:\Windows\system32\eventviewer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
103621DE9CD5414CC2538780B4B75751
57C8EDB95DF3F0AD4EE2DC2B8CFD4157
8B3C0310C2EA810C48E449EA75059E8A
103621DE9CD5414CC2538780B4B75751
57C8EDB95DF3F0AD4EE2DC2B8CFD4157
8B3C0310C2EA810C48E449EA75059E8A
deployment.properties
securitypack.jar
2026-04-17_d8999107e0ff2a5f152210400f1f049a_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
jar_cache8550423927536954763.tmp
jucheck32.exe
jusched.log
tmp205F.tmp
eventviewer.exe
syslog.exe
memory/1492-114-0x0000000002500000-0x0000000002582000-memory.dmp
memory/1492-227-0x0000000002500000-0x0000000002582000-memory.dmp
memory/2120-261-0x00000000022F0000-0x00000000023D2000-memory.dmp
memory/2120-116-0x00000000029F0000-0x0000000002A72000-memory.dmp
memory/2504-90-0x0000023120310000-0x0000023120311000-memory.dmp
memory/2504-78-0x0000023120310000-0x0000023120311000-memory.dmp
memory/2504-67-0x0000023120310000-0x0000023120311000-memory.dmp
memory/2504-54-0x0000023120310000-0x0000023120311000-memory.dmp
memory/2504-166-0x0000023120310000-0x0000023120311000-memory.dmp
memory/2504-165-0x0000023120310000-0x0000023120311000-memory.dmp
memory/2504-162-0x0000023120310000-0x0000023120311000-memory.dmp
memory/2504-138-0x0000023120310000-0x0000023120311000-memory.dmp
memory/2504-124-0x0000023120310000-0x0000023120311000-memory.dmp
memory/2504-117-0x000002313D240000-0x000002313D252000-memory.dmp
memory/3644-186-0x0000000002ED0000-0x0000000002F52000-memory.dmp
memory/3644-115-0x0000000002ED0000-0x0000000002F52000-memory.dmp