e7004ed0266ff09ba76feaf206cce929e22a1341b2dd7ce52e38e4566dd64df9

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_f77ffcabbbfdd98e8dc1235125831f0e_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
Size 1.4MB
Sample260511-pbr9tact7m
SHA256 e7004ed0266ff09ba76feaf206cce929e22a1341b2dd7ce52e38e4566dd64df9
MD5 f77ffcabbbfdd98e8dc1235125831f0e
SHA1 45a44be310c1b6b3fe8698ef1611a379999e7250
SHA512 42a57476865c24d47273b53ca7d4807d4b70535d47b2481df6f105df695fa2b16786e8cb9ab8736db7cc3c90b22240b833cc88562354d35f226da935bba0a0f9
SSDEEP 24576:GDV0bKoMOW0n7Ubxk/uRvJqLGJLQ4a56duA/85RkV4l7/Z9iuWXu:GDWb34iwwGJra0uAUfkVy7/ZViu
TLSH
T139658C2136D58036F2B32731587897249A7AFCB29A36854F73C8676D1F30A818E35B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2480	jucheck32.exe
720	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-05-11_f77ffcabbbfdd98e8dc1235125831f0e_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-05-11_f77ffcabbbfdd98e8dc1235125831f0e_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2564	720	WerFault.exe	86
4060	4264	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_f77ffcabbbfdd98e8dc1235125831f0e_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jucheck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
720	eventviewer.exe
720	eventviewer.exe
3868	javaws.exe
3868	javaws.exe
856	jp2launcher.exe
856	jp2launcher.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2480	jucheck32.exe
2480	jucheck32.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2480	jucheck32.exe
2480	jucheck32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
856	jp2launcher.exe
2480	jucheck32.exe
2480	jucheck32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 2480	4264	2026-05-11_f77ffcabbbfdd98e8dc1235125831f0e_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe	85
PID 4264 wrote to memory of 720	4264	2026-05-11_f77ffcabbbfdd98e8dc1235125831f0e_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe	86
PID 2480 wrote to memory of 3868	2480	jucheck32.exe	87
PID 3868 wrote to memory of 856	3868	javaws.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-05-11_f77ffcabbbfdd98e8dc1235125831f0e_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_f77ffcabbbfdd98e8dc1235125831f0e_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Users\Admin\AppData\Local\Temp\jucheck32.exe
  "jucheck32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Program Files\Java\jre-1.8\bin\javaws.exe
    "C:\Program Files\Java\jre-1.8\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdate
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3868
  - - C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
      "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamRrLmRpc2FibGVMYXN0VXNhZ2VUcmFja2luZz10cnVlAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGUALURqbmxweC52bWFyZ3M9TFVScVpHc3VaR2x6WVdKc1pVeGhjM1JWYzJGblpWUnlZV05yYVc1blBYUnlkV1VB -ma LVNTVkJhc2VsaW5lVXBkYXRlAC1ub3RXZWJKYXZh
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:856
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 720 -s 1428
    3⤵
    - Program crash
    PID:2564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 1592
  2⤵
  - Program crash
  PID:4060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 720 -ip 720
1⤵
PID:4724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4264 -ip 4264
1⤵
PID:4436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
Size 215KB
SHA256 d0b43819dc360c9d203df40608b3af3cfa1771a3037826c7f7c9569d9cb779b4
MD5 3b235f5fa8c5fd03e9fbaea04ba9bf09
SHA1 ab7800ab3e45f0f01c12178167d1ea88f7482770
SHA512 b5520fcf7d5bc5bff8e97a7192cf2f046c6e426eab047978e0220f5888b61edbc21c9b687ef3e42241af61157e1866504c72b0184d0509226be4456b4dca30b7
SSDEEP 3072:Ob5IiaFrgqmpKi9MZ/PXV+gX8eP6t0EmMHa16ok:O0FrQpCnfiHC6ok
TLSH
T1D3244C68AC77F161BDA98E924DE9EA9A63E7BDF51611030F4E70BF502C03A97CB57001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 992d4683bad7451e4a09f94d1fcda2521fff89eaea0fac0beb51667967aecf06
MD5 06f1a88af2b7b579c89b636885d83ee5
SHA1 589b7d2af9249e1d6ffef0a6cc9e38feaad8387b
SHA512 d1d33fffe062fb4371a8ed604fe259ea38fefa39f4e0d1ce51aa431964e1d905039de20d6529314efdaaf96abe50d5769e5a57121a4f3eb6457d26fdda93a79d
TLSH
T195E05E112BE80214F5770B3CA97365459977B76B6A51CBDD0275008D1C21F61C933729
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 4c611a4f890cc10d9f321d25e29ba3ac59a72e17f5094a3e8d602ed7e395dd17
MD5 7cb85eafbeec2ef7b01ab974931bc88a
SHA1 c8502c02d12173e695417c2b9c46d8b82502f4b5
SHA512 54e976550f27ebda85c2dcc8de94b84de468da59f5db700ac1996201a803f8874339cef252d0600ef430d5745f61e9124322d40052e4267f64941ca6611c39ec
TLSH
T101D022141FD20239F026C332E5650242CA066923B8B25B4C16F2120C5C31B112CB2C1C
MD5 SHA1 SHA512 TLSH

Submit Download

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 896B
SHA256 b5cdd99eb46102aa6d16e58c51a5ffa37ccef6d4af33bf1a4d8772de8bbf5301
MD5 e1f89054160824dda328049a7d1590cf
SHA1 c62b6e0d46fef34ee84fc1f3020708d4a41285d0
SHA512 2dafa337763b13b3764db83accc05a4bc990637b592278e16f22b79f6ad55f724672887c6f3973626d39378aaf98eb6f61c5c242dcc7057b8332316892106a2c
TLSH
T1A611E582792BA47069413172E9CF43F73BB2A73D18E52275B2C058CEB870F3606A3C24
MD5 SHA1 SHA512 TLSH

Submit Download

securitypack.jar

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security\securitypack.jar
Size 12KB
SHA256 b970a392e8808b00ad48c1a1d0a04622cc30a830439f08829683ad972e42db93
MD5 afe260f94b8e4ddba883e7a0eb0490b4
SHA1 6ba8882dc36bcfbcd9a29146e16044b9f00c01ef
SHA512 f237dc383b97f474b1925678cb23f931c0f93e978cba79479ac015c29e4dc3ea42c482888e3e2c66adfa8f5e71a1a4db04a971f206999151fa06d51816ee19da
SSDEEP 384:uNLbFqAZFbIgE4kqgnGdERQcC2NJQ5bBsBB:uRQY1IgEDnPtC2bQd27
TLSH
T1E442BF71BF31C9A6FD3858FE4639EF068A4FE30F08673E4A03502B4637573A45A6148A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jucheck32.exe

Path C:\Users\Admin\AppData\Local\Temp\jucheck32.exe
Size 1.2MB
SHA256 1889ff3c62ca9675cd1e364f44f92b1142d4d004f143f602ac2eaa3db237cd26
MD5 006622c7269d5b9466813dce3b940726
SHA1 12ca640590d35526082d4ccb0465b10e38c72c3d
SHA512 55f256b2468a74f0a1ef93c46e56ba9470f2197982b085505000069ce9835382a767f304de1c84ea349b66eb60f177d87ad90eb914bfa8585a76ee6b0e60812b
SSDEEP 24576:uoMOW0n7Ubxk/uRvJqLGJLQ4a56duA/85RkV4l7/Zj:r4iwwGJra0uAUfkVy7/Zj
TLSH
T197457B2176D58036F2B32731687C92645A3AFCB2993A854F73CC666D1F30A818E35B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 165KB
SHA256 bb20fdca0dda41b677236a6ef5f91c5a5ee9ddc4973da4d64a0c05df23961616
MD5 822003950da347743703c15dfc3bc072
SHA1 22a42d95130aa9188201cd20a087eb04ab8aaba3
SHA512 86c7c731637d9b2adcc6e01d213308e015ee99b28a493086a80be60692727cd3bd6e5dea79a0f7bfe5e1ed1c12d9a14c2d57894789044a565b9c854660d47a2c
SSDEEP 3072:k4l5S/dXVCFdIOXlbD5Id9VfsES11jWtWXeK1Cl227a:UGPT
TLSH
T1BFF30D96C93E51FF34278BD387BE79686562150B53DE091832CF82CEA445903D62E8FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/856-142-0x000001B4E7980000-0x000001B4E7981000-memory.dmp

Download

memory/856-143-0x000001B4E6040000-0x000001B4E616A000-memory.dmp

Download

memory/856-55-0x000001B4E7980000-0x000001B4E7981000-memory.dmp

Download

memory/856-144-0x000001B482E60000-0x000001B482E6C000-memory.dmp

Download

memory/856-79-0x000001B4E7980000-0x000001B4E7981000-memory.dmp

Download

memory/856-68-0x000001B4E7980000-0x000001B4E7981000-memory.dmp

Download

memory/2480-415-0x00000000040E0000-0x00000000040FF000-memory.dmp

Download

memory/3868-21-0x00000206675F0000-0x000002066771A000-memory.dmp

Download

memory/4264-414-0x00000000033A0000-0x00000000033BF000-memory.dmp

Download