1e66c1f51f8d61ed042d121b659a72c393ec5137f5ee92607a1dbec36a0fb5ea

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_f814aa441cab23c23dbc5dbc49a77f61_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Size 1.2MB
Sample260630-vr61ssdw4w
SHA256 1e66c1f51f8d61ed042d121b659a72c393ec5137f5ee92607a1dbec36a0fb5ea
MD5 f814aa441cab23c23dbc5dbc49a77f61
SHA1 b21c1d78149a083403b5f63d0c2fef66c1b7536c
SHA512 ed4937c14dc3658b596dfff8267bcfd1e852b249038a87050bb6b861e4ebcee1c5dbf151df79a5b0da4eee0e851cb8517dbceb3b12649bf1152e66ab8cb9e0bb
SSDEEP 24576:uoMOW0n7Ubxk/uRvJqLGJLQ4a56duA/85RkV4l7/Z9iuWX3:r4iwwGJra0uAUfkVy7/ZVi3
TLSH
T10A557C2136D58036F2B32731587893649A3AFCB2993A854F73CC666D5F30A818E35B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_f814aa441cab23c23dbc5dbc49a77f61_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4232	javaws.exe
4232	javaws.exe
544	jp2launcher.exe
544	jp2launcher.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
544	jp2launcher.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5132 wrote to memory of 4232	5132	2026-06-30_f814aa441cab23c23dbc5dbc49a77f61_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe	88
PID 4232 wrote to memory of 544	4232	javaws.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-30_f814aa441cab23c23dbc5dbc49a77f61_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_f814aa441cab23c23dbc5dbc49a77f61_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5132
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  "C:\Program Files\Java\jre-1.8\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdate
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4232
- - C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
    "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamRrLmRpc2FibGVMYXN0VXNhZ2VUcmFja2luZz10cnVlAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGUALURqbmxweC52bWFyZ3M9TFVScVpHc3VaR2x6WVdKc1pVeGhjM1JWYzJGblpWUnlZV05yYVc1blBYUnlkV1VB -ma LVNTVkJhc2VsaW5lVXBkYXRlAC1ub3RXZWJKYXZh
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 896B
SHA256 b8da440e124a8d616a373940231bb1601f713c8c465493619d143a51cf14921f
MD5 d20f1170815479920ad52da3550a77ab
SHA1 a18c97b86744bd105e8818fee2228a4021ad58a1
SHA512 70f3fcd2c3cc5df68f87fb277368af722560dbb9f36d6ad897f9363db91694299cdc68e491e7e14fe9ba4975faf0705ef2b6b3ddb164fc896bcf858629d044d1
TLSH
T139110496782BA0746D413031EADF43F63BB19B3D08A62275B2C059CEB870F3606A3C25
MD5 SHA1 SHA512 TLSH

Submit Download

securitypack.jar

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security\securitypack.jar
Size 12KB
SHA256 b970a392e8808b00ad48c1a1d0a04622cc30a830439f08829683ad972e42db93
MD5 afe260f94b8e4ddba883e7a0eb0490b4
SHA1 6ba8882dc36bcfbcd9a29146e16044b9f00c01ef
SHA512 f237dc383b97f474b1925678cb23f931c0f93e978cba79479ac015c29e4dc3ea42c482888e3e2c66adfa8f5e71a1a4db04a971f206999151fa06d51816ee19da
SSDEEP 384:uNLbFqAZFbIgE4kqgnGdERQcC2NJQ5bBsBB:uRQY1IgEDnPtC2bQd27
TLSH
T1E442BF71BF31C9A6FD3858FE4639EF068A4FE30F08673E4A03502B4637573A45A6148A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 2b7ff0fb8488ba67708650eb91020b09f381efd4a648ded84bf4280d3e233aa6
MD5 3a1fb50cefce038c9e738799ea85df2b
SHA1 5db9f2c520bf8bdd81bf2e263b7d9488245daf46
SHA512 69f062a53685ac78b92861f55d2383293f944a00c6a0f899c7a9b42dbf1a9f764be6b8fbc347fab807e16df55af8b285e5dd2a298a9e7016c2bd509715b904df
SSDEEP 3072:ZQ+RBgCx3SA7goJJNt9ObF9fsKsnnBHTn8h2w/rihQb:LSmo
TLSH
T122F33396C92E52BA34134BD7C7795C640A6626CD43DF091C71CFA3CEA541B0B8E2E4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/544-18-0x0000021A03FE0000-0x0000021A04250000-memory.dmp

Download

memory/544-46-0x0000021A03B30000-0x0000021A03B31000-memory.dmp

Download

memory/544-59-0x0000021A03B30000-0x0000021A03B31000-memory.dmp

Download

memory/544-67-0x0000021A03B30000-0x0000021A03B31000-memory.dmp

Download

memory/544-84-0x0000021A03B30000-0x0000021A03B31000-memory.dmp

Download

memory/544-136-0x0000021A03B30000-0x0000021A03B31000-memory.dmp

Download

memory/544-137-0x0000021A03FE0000-0x0000021A04250000-memory.dmp

Download