Analysis
- max time kernel
149s - max time network
124s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
- submitted
11/05/2026, 12:09
General
- Target 2026-05-11_f77ffcabbbfdd98e8dc1235125831f0e_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
- Size 1.4MB
- Sample260511-pbr9tact7m
- SHA256 e7004ed0266ff09ba76feaf206cce929e22a1341b2dd7ce52e38e4566dd64df9
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Drops file in System32 directory 2 IoCs
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_f77ffcabbbfdd98e8dc1235125831f0e_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_f77ffcabbbfdd98e8dc1235125831f0e_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jucheck32.exe"jucheck32.exe "2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaws.exe"C:\Program Files\Java\jre-1.8\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdate3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe"C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamRrLmRpc2FibGVMYXN0VXNhZ2VUcmFja2luZz10cnVlAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGUALURqbmxweC52bWFyZ3M9TFVScVpHc3VaR2x6WVdKc1pVeGhjM1JWYzJGblpWUnlZV05yYVc1blBYUnlkV1VB -ma LVNTVkJhc2VsaW5lVXBkYXRlAC1ub3RXZWJKYXZh4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\SysWOW64\eventviewer.exe"C:\Windows\system32\eventviewer.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5228 -s 15523⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 17282⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5228 -ip 52281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1888 -ip 18881⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
103621DE9CD5414CC2538780B4B75751
57C8EDB95DF3F0AD4EE2DC2B8CFD4157
94C33D778ADC562180302FF1B77EFF1A
103621DE9CD5414CC2538780B4B75751
57C8EDB95DF3F0AD4EE2DC2B8CFD4157
94C33D778ADC562180302FF1B77EFF1A
deployment.properties
jucheck32.exe
jusched.log
eventviewer.exe
memory/1888-123-0x0000000002920000-0x00000000029A2000-memory.dmp
memory/4464-124-0x0000000003100000-0x0000000003182000-memory.dmp
memory/4464-398-0x0000000003D00000-0x0000000003D20000-memory.dmp
memory/5228-120-0x0000000002560000-0x00000000025E2000-memory.dmp
memory/5792-125-0x000002BA91A20000-0x000002BA91A28000-memory.dmp
memory/5792-128-0x000002BA91A40000-0x000002BA91A41000-memory.dmp
memory/5792-69-0x000002BA91A40000-0x000002BA91A41000-memory.dmp
memory/5792-95-0x000002BA91A40000-0x000002BA91A41000-memory.dmp
memory/5792-105-0x000002BA91A40000-0x000002BA91A41000-memory.dmp
memory/5792-54-0x000002BA91A40000-0x000002BA91A41000-memory.dmp
memory/5792-126-0x000002BAACEC0000-0x000002BAACECC000-memory.dmp
memory/5792-127-0x000002BAAD0D0000-0x000002BAAD0E2000-memory.dmp
memory/5792-409-0x000002BA91A40000-0x000002BA91A41000-memory.dmp
memory/5792-411-0x000002BAACEC0000-0x000002BAACECC000-memory.dmp