57a2069b14563635dbac3059c552b151ffd4bc2e2f05a54ac522b01d70dad16d

Analysis

max time kernel
149s
max time network
124s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/05/2026, 12:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-25_29568b3222558bbaa7c5014451b3237f_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Size 1.2MB
Sample260525-n8ffvaez2m
SHA256 57a2069b14563635dbac3059c552b151ffd4bc2e2f05a54ac522b01d70dad16d
MD5 29568b3222558bbaa7c5014451b3237f
SHA1 8e131ae411e43326e008bb68850aaf8d7d20de3b
SHA512 525812a9644f1aaa60d327d1218612865db7ca2fa51151942cd4034a75eff0b907dc69e374120e7bed594e3baf653bd6c7d28152b4a9cb72e5d6625fa286db1b
SSDEEP 24576:uoMOW0n7Ubxk/uRvJqLGJLQ4a56duA/85RkV4l7/Z9iuWXN:r4iwwGJra0uAUfkVy7/ZViN
TLSH
T117557C2136D58036F2B32731587893649A3AFCB2993A854F73CC666D5F30A818E35B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-25_29568b3222558bbaa7c5014451b3237f_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2568	javaws.exe
2568	javaws.exe
4884	jp2launcher.exe
4884	jp2launcher.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2112	2026-05-25_29568b3222558bbaa7c5014451b3237f_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
2112	2026-05-25_29568b3222558bbaa7c5014451b3237f_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2112	2026-05-25_29568b3222558bbaa7c5014451b3237f_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
2112	2026-05-25_29568b3222558bbaa7c5014451b3237f_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4884	jp2launcher.exe
2112	2026-05-25_29568b3222558bbaa7c5014451b3237f_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
2112	2026-05-25_29568b3222558bbaa7c5014451b3237f_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2568	2112	2026-05-25_29568b3222558bbaa7c5014451b3237f_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe	80
PID 2568 wrote to memory of 4884	2568	javaws.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-05-25_29568b3222558bbaa7c5014451b3237f_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-25_29568b3222558bbaa7c5014451b3237f_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  "C:\Program Files\Java\jre-1.8\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdate
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
    "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamRrLmRpc2FibGVMYXN0VXNhZ2VUcmFja2luZz10cnVlAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGUALURqbmxweC52bWFyZ3M9TFVScVpHc3VaR2x6WVdKc1pVeGhjM1JWYzJGblpWUnlZV05yYVc1blBYUnlkV1VB -ma LVNTVkJhc2VsaW5lVXBkYXRlAC1ub3RXZWJKYXZh
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 896B
SHA256 d4f0df25c40192011c2032b333dbad2fb38cc6340506d649cb934d3ba3233aba
MD5 f2485390de38265476d17b40b5c4c006
SHA1 d6f96b46350f4a08412dea35100f1278f0c26d0c
SHA512 3932a25999bb6a3de12eaf024affce6931f8e7140d8873154a6207a3d99e8b8056023e608bcf0d6ace8c6c3f15ea4ab872eb02ea60c2a2778290eeb93febb1b7
TLSH
T1B411CE86692BA07069413132E9DF42F73BB6AB3D09E52175B2C058CEB864F3706A3C64
MD5 SHA1 SHA512 TLSH

Submit Download

securitypack.jar

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security\securitypack.jar
Size 12KB
SHA256 b970a392e8808b00ad48c1a1d0a04622cc30a830439f08829683ad972e42db93
MD5 afe260f94b8e4ddba883e7a0eb0490b4
SHA1 6ba8882dc36bcfbcd9a29146e16044b9f00c01ef
SHA512 f237dc383b97f474b1925678cb23f931c0f93e978cba79479ac015c29e4dc3ea42c482888e3e2c66adfa8f5e71a1a4db04a971f206999151fa06d51816ee19da
SSDEEP 384:uNLbFqAZFbIgE4kqgnGdERQcC2NJQ5bBsBB:uRQY1IgEDnPtC2bQd27
TLSH
T1E442BF71BF31C9A6FD3858FE4639EF068A4FE30F08673E4A03502B4637573A45A6148A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 75ce7b8927897b5250a2a53c059ae879c19a16820b2c4c5739b3d6f4e3d426bc
MD5 e029dd3fa97eb31f49e25fd171a17c14
SHA1 d8cd8bc27855557966e713d49495b7eeaf1f87b0
SHA512 3e3f1cd163d12ec10fac94df543e2cfc78553cf406bb3b03a1b6da39104e64a5dc93b4ac1c6491f0622ff8a3df1f913c4c9eee5531c0e41e90be56a2131a3218
SSDEEP 3072:qI+Jp47wuFUy40pJ51dK75DB6DdmmIHvLJbrKwRG3QK:Mgbn
TLSH
T112F34246853E85BB34634BD7CB6A5C648EA2092A435E191C31DF82DFB641C03D66F8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4884-18-0x0000015C1CFA0000-0x0000015C1D210000-memory.dmp

Download

memory/4884-46-0x0000015C1CB30000-0x0000015C1CB31000-memory.dmp

Download

memory/4884-59-0x0000015C1CB30000-0x0000015C1CB31000-memory.dmp

Download

memory/4884-229-0x0000015C1CB30000-0x0000015C1CB31000-memory.dmp

Download

memory/4884-385-0x0000015C1CB30000-0x0000015C1CB31000-memory.dmp

Download

memory/4884-387-0x0000015C1CFA0000-0x0000015C1D210000-memory.dmp

Download