57a2069b14563635dbac3059c552b151ffd4bc2e2f05a54ac522b01d70dad16d

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/05/2026, 12:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-25_29568b3222558bbaa7c5014451b3237f_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Size 1.2MB
Sample260525-n8ffvaez2m
SHA256 57a2069b14563635dbac3059c552b151ffd4bc2e2f05a54ac522b01d70dad16d
MD5 29568b3222558bbaa7c5014451b3237f
SHA1 8e131ae411e43326e008bb68850aaf8d7d20de3b
SHA512 525812a9644f1aaa60d327d1218612865db7ca2fa51151942cd4034a75eff0b907dc69e374120e7bed594e3baf653bd6c7d28152b4a9cb72e5d6625fa286db1b
SSDEEP 24576:uoMOW0n7Ubxk/uRvJqLGJLQ4a56duA/85RkV4l7/Z9iuWXN:r4iwwGJra0uAUfkVy7/ZViN
TLSH
T117557C2136D58036F2B32731587893649A3AFCB2993A854F73CC666D5F30A818E35B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-25_29568b3222558bbaa7c5014451b3237f_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2396	javaws.exe
2396	javaws.exe
5072	jp2launcher.exe
5072	jp2launcher.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5072	jp2launcher.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 2396	1456	2026-05-25_29568b3222558bbaa7c5014451b3237f_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe	87
PID 2396 wrote to memory of 5072	2396	javaws.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-05-25_29568b3222558bbaa7c5014451b3237f_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-25_29568b3222558bbaa7c5014451b3237f_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  "C:\Program Files\Java\jre-1.8\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdate
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
    "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamRrLmRpc2FibGVMYXN0VXNhZ2VUcmFja2luZz10cnVlAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGUALURqbmxweC52bWFyZ3M9TFVScVpHc3VaR2x6WVdKc1pVeGhjM1JWYzJGblpWUnlZV05yYVc1blBYUnlkV1VB -ma LVNTVkJhc2VsaW5lVXBkYXRlAC1ub3RXZWJKYXZh
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:5072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 896B
SHA256 e4cabf7a185e8f4a6fe5f28ad2f92263bf33c4f43bfaf4e2b438145944686704
MD5 dbfb520311187bf6d4cd04134a5e2b1e
SHA1 78e99e1d2a1a257d65c2029688bed0d513798cd9
SHA512 92e04edb21b2b9423a6c9080603ff45eddd90f9d7b5c3c5da49c86ebe74b40967e64d0aeb441a25d238c7dac1d70e92606965bfd5f1ef5face876020c83ca03d
TLSH
T1B411C286692BA07029413532E9DF42F63BB6AB7D09E52175B1C058CEB865F3706A3C64
MD5 SHA1 SHA512 TLSH

Submit Download

securitypack.jar

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security\securitypack.jar
Size 12KB
SHA256 b970a392e8808b00ad48c1a1d0a04622cc30a830439f08829683ad972e42db93
MD5 afe260f94b8e4ddba883e7a0eb0490b4
SHA1 6ba8882dc36bcfbcd9a29146e16044b9f00c01ef
SHA512 f237dc383b97f474b1925678cb23f931c0f93e978cba79479ac015c29e4dc3ea42c482888e3e2c66adfa8f5e71a1a4db04a971f206999151fa06d51816ee19da
SSDEEP 384:uNLbFqAZFbIgE4kqgnGdERQcC2NJQ5bBsBB:uRQY1IgEDnPtC2bQd27
TLSH
T1E442BF71BF31C9A6FD3858FE4639EF068A4FE30F08673E4A03502B4637573A45A6148A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 102d0872137c3ae9643d9ba6fc7b1dbbdf12c3cb5434a25c924553e51a36b5fb
MD5 cead7f9a33bf847c1350b2b788398355
SHA1 4777620698c405376fe7bf56d31e3cf105391cfb
SHA512 3dab7a07dd9ae035839076b0967d3ffac36c8b187b5356106d9426c53e723141c7c92dde9d3f48b576f66fd0be590c05010210e41f5c1b318ea5024ca7368a8a
SSDEEP 3072:xk+dizBLty6lUGDVzv5stFVbsjx22cSMD0At+FP6DObj:kuG6k
TLSH
T10CF3314A862D88FA34235FC3C3AD5E658E920A09535E0A5C35DFC6DE7485D03892E9FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5072-22-0x0000020580000000-0x0000020580270000-memory.dmp

Download

memory/5072-46-0x00000205FC870000-0x00000205FC871000-memory.dmp

Download

memory/5072-59-0x00000205FC870000-0x00000205FC871000-memory.dmp

Download

memory/5072-80-0x00000205FC870000-0x00000205FC871000-memory.dmp

Download

memory/5072-89-0x00000205FC870000-0x00000205FC871000-memory.dmp

Download

memory/5072-132-0x00000205FC870000-0x00000205FC871000-memory.dmp

Download

memory/5072-133-0x0000020580000000-0x0000020580270000-memory.dmp

Download