05aa05cc67f4ac6b3094d8aed0fee7afa33a07846b152f5502838685c4b18fef

Analysis

max time kernel
149s
max time network
138s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 01:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-01_3e978c57deaf00e707ee5a89417bd53a_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
Size 1.4MB
Sample260601-by7q5aa121
SHA256 05aa05cc67f4ac6b3094d8aed0fee7afa33a07846b152f5502838685c4b18fef
MD5 3e978c57deaf00e707ee5a89417bd53a
SHA1 17071d198a043691887b339f29e95ed0c0193b0e
SHA512 64f12dd1c2bcde0afc77fd9c94db19c06605b31d968fbcb150e360296a0956b3499fa3783b603b2aa89a14dc70321c24be42ad31358718cf95ab6f5f4128d0f5
SSDEEP 24576:GDV0bKoMOW0n7Ubxk/uRvJqLGJLQ4a56duA/85RkV4l7/Z9iuWXs:GDWb34iwwGJra0uAUfkVy7/ZVis
TLSH
T1D7658C2136D58036F2B32731587897249A7AFCB29A36854F73C8676D1F30A818E35B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2924	jucheck32.exe
2368	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-06-01_3e978c57deaf00e707ee5a89417bd53a_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-06-01_3e978c57deaf00e707ee5a89417bd53a_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4812	2368	WerFault.exe	82
3224	1964	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-01_3e978c57deaf00e707ee5a89417bd53a_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jucheck32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2368	eventviewer.exe
2368	eventviewer.exe
536	javaws.exe
536	javaws.exe
1832	jp2launcher.exe
1832	jp2launcher.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2924	jucheck32.exe
2924	jucheck32.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2924	jucheck32.exe
2924	jucheck32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1832	jp2launcher.exe
2924	jucheck32.exe
2924	jucheck32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2924	1964	2026-06-01_3e978c57deaf00e707ee5a89417bd53a_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe	81
PID 1964 wrote to memory of 2368	1964	2026-06-01_3e978c57deaf00e707ee5a89417bd53a_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe	82
PID 2924 wrote to memory of 536	2924	jucheck32.exe	83
PID 536 wrote to memory of 1832	536	javaws.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-06-01_3e978c57deaf00e707ee5a89417bd53a_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_3e978c57deaf00e707ee5a89417bd53a_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\jucheck32.exe
  "jucheck32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Program Files\Java\jre-1.8\bin\javaws.exe
    "C:\Program Files\Java\jre-1.8\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdate
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:536
  - - C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
      "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamRrLmRpc2FibGVMYXN0VXNhZ2VUcmFja2luZz10cnVlAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGUALURqbmxweC52bWFyZ3M9TFVScVpHc3VaR2x6WVdKc1pVeGhjM1JWYzJGblpWUnlZV05yYVc1blBYUnlkV1VB -ma LVNTVkJhc2VsaW5lVXBkYXRlAC1ub3RXZWJKYXZh
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:1832
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 1556
    3⤵
    - Program crash
    PID:4812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 1448
  2⤵
  - Program crash
  PID:3224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2368 -ip 2368
1⤵
PID:1036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 1964 -ip 1964
1⤵
PID:240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
Size 217KB
SHA256 bbebb0eaedabdd16500d806875250b077f9e3545965fc11ea0d6649930b32219
MD5 b2fe68114ef54fe3435a6f6d2c1ade0d
SHA1 dfbf05d8ccc2320b151f4f10428fd2726b5b00ac
SHA512 5f7f933b21112ae9b2363c201189de314b5820628bf23d741b478da2ba22ac6a1021e326f47fc76828b2ce192fd63fa169881bde414afc2620136abceb331a86
SSDEEP 3072:AOej6XG6D1vv0X8ReUdfxz3zd1/Lto9eIgOe8R09:Af6lX0Ov1ti5gOT8
TLSH
T18724192C6C77F561BDA98E524DEDEA9663E7BDF61221030F1E346E502C03A9BCB1B405
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 fcbdc847366bfb3b358ae6707370756ca85fe6505f9b14262e73f579de2949e4
MD5 6836b2e16aba6ef894bc6ceb385fec62
SHA1 35f3a8eb318f7c86bd5237f24a409a596d08c220
SHA512 dc558e6bc6c30e18ecee8d6187ced8299d0a7c1cf88df3789dbd778c879d571ea4ea998ccb6927a3d7e429b35c0f8e45becac85eb3724faaa0db3da5ffbea01d
TLSH
T146D0220C4BD50326F210C23404314E04BAB4B102B0A1DB0E10F5650E6D32F23283090D
MD5 SHA1 SHA512 TLSH

Submit Download

70d925ce-16386308

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14\70d925ce-16386308
Size 2KB
SHA256 7072c52f510b36070efbe8b2a995d1d1d3b4f8ac9d62b931488394904b6f4223
MD5 58f9df98ea3534592b2686de6c577f7c
SHA1 ad4914a92aa2d8c8b6fec0e92c2526c8f055233a
SHA512 1d74179989ea9ca7c24ac23826fdd6eb6413e6c51e6368aea310481d29b26502cb8e646cdf2dd4f64b95dc9d362625c8b27a6ff8f5ca8a59b787b07ad3e597db
TLSH
T17941242D1E8C35A370592E74E9D6BD878CE290625BC0948EC5284E425562FCE8FDE4F2
MD5 SHA1 SHA512 TLSH

Submit Download

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 896B
SHA256 92e1eea77792d1b782000718be9a52569bc7fab6ddbebfecb38c6a05b32a8cb7
MD5 44008530cca20e266f4b0be5963ee978
SHA1 0dec129db38e58c9723d1200031699fe6da5ff5d
SHA512 eeaed3da462af33737d3c8c58664ff1bd2865a9265de3aa51cb864dc8b687a6ded41b2b3408c89210a4d8aea4d97c04706b4b3095a3e826b1c2d7be980a41ce2
TLSH
T18D11E182792BA07029423531EACF43F73BB1A73D08A56175B2C058CEB861F3616A3C24
MD5 SHA1 SHA512 TLSH

Submit Download

securitypack.jar

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security\securitypack.jar
Size 12KB
SHA256 b970a392e8808b00ad48c1a1d0a04622cc30a830439f08829683ad972e42db93
MD5 afe260f94b8e4ddba883e7a0eb0490b4
SHA1 6ba8882dc36bcfbcd9a29146e16044b9f00c01ef
SHA512 f237dc383b97f474b1925678cb23f931c0f93e978cba79479ac015c29e4dc3ea42c482888e3e2c66adfa8f5e71a1a4db04a971f206999151fa06d51816ee19da
SSDEEP 384:uNLbFqAZFbIgE4kqgnGdERQcC2NJQ5bBsBB:uRQY1IgEDnPtC2bQd27
TLSH
T1E442BF71BF31C9A6FD3858FE4639EF068A4FE30F08673E4A03502B4637573A45A6148A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jucheck32.exe

Path C:\Users\Admin\AppData\Local\Temp\jucheck32.exe
Size 1.2MB
SHA256 1889ff3c62ca9675cd1e364f44f92b1142d4d004f143f602ac2eaa3db237cd26
MD5 006622c7269d5b9466813dce3b940726
SHA1 12ca640590d35526082d4ccb0465b10e38c72c3d
SHA512 55f256b2468a74f0a1ef93c46e56ba9470f2197982b085505000069ce9835382a767f304de1c84ea349b66eb60f177d87ad90eb914bfa8585a76ee6b0e60812b
SSDEEP 24576:uoMOW0n7Ubxk/uRvJqLGJLQ4a56duA/85RkV4l7/Zj:r4iwwGJra0uAUfkVy7/Zj
TLSH
T197457B2176D58036F2B32731687C92645A3AFCB2993A854F73CC666D1F30A818E35B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 02ece41dfcfeccad0019c417a4b6b660bb5c482e60ef3ad6e228397760a626cb
MD5 43d766a233876e1966b339234ad3e223
SHA1 e27abb510887a78911edc5d97a85eeabdc520a8d
SHA512 66f75970a50542eb7f90c8c1aa689fa02f12bac0bc821c18064c2decc9e36b722f6a4cd7442726b91ad72a715518d681a33999e89bba2a3f1f25d0ce86b9b1be
SSDEEP 3072:joxRObljhZlDIe3FzL5QNFl/0AGppnJQbc08W63GQyP:doHx
TLSH
T1EDF32186D52E85BB35634AD7C7695D64CDA3050943AE0A2C32DFC2DFB845D03892E8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1832-68-0x000002214B580000-0x000002214B581000-memory.dmp

Download

memory/1832-411-0x000002214B580000-0x000002214B581000-memory.dmp

Download

memory/1832-414-0x000002214B580000-0x000002214B581000-memory.dmp

Download

memory/1832-388-0x000002214B580000-0x000002214B581000-memory.dmp

Download

memory/1832-375-0x000002214B580000-0x000002214B581000-memory.dmp

Download

memory/1832-99-0x000002214B580000-0x000002214B581000-memory.dmp

Download