99e735f96cf1d787524bea5a71537bbdc8bcbd85cbc180254cb865eeee68b57c

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/07/2026, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_707b31ca08d9d0672fc349f5030a4a17_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
Size 1.4MB
Sample260714-eabkkadw7m
SHA256 99e735f96cf1d787524bea5a71537bbdc8bcbd85cbc180254cb865eeee68b57c
MD5 707b31ca08d9d0672fc349f5030a4a17
SHA1 98a5ecb8bec525e1d9c07b214d1a406dcb61baf0
SHA512 8e80746c244f447a91973729851c776f6e6bb89a14f3d39108acfe2b7c91db9882d2706021cb6e121443647bdb493d474bf7fcd1b2798b24c576a0261631091b
SSDEEP 24576:GDV0bKoMOW0n7Ubxk/uRvJqLGJLQ4a56duA/85RkV4l7/Z9iuWX9:GDWb34iwwGJra0uAUfkVy7/ZVi9
TLSH
T106658C2136D58036F2B32731587897249A7AFCB29A36854F73C8676D1F30A818E35B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4904	jucheck32.exe
4896	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-07-14_707b31ca08d9d0672fc349f5030a4a17_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-07-14_707b31ca08d9d0672fc349f5030a4a17_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2144	4896	WerFault.exe	87
5048	1112	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_707b31ca08d9d0672fc349f5030a4a17_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jucheck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4896	eventviewer.exe
4896	eventviewer.exe
2560	javaws.exe
2560	javaws.exe
464	jp2launcher.exe
464	jp2launcher.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4904	jucheck32.exe
4904	jucheck32.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4904	jucheck32.exe
4904	jucheck32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4904	jucheck32.exe
4904	jucheck32.exe
464	jp2launcher.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 4904	1112	2026-07-14_707b31ca08d9d0672fc349f5030a4a17_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe	86
PID 1112 wrote to memory of 4896	1112	2026-07-14_707b31ca08d9d0672fc349f5030a4a17_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe	87
PID 4904 wrote to memory of 2560	4904	jucheck32.exe	88
PID 2560 wrote to memory of 464	2560	javaws.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-14_707b31ca08d9d0672fc349f5030a4a17_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_707b31ca08d9d0672fc349f5030a4a17_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Users\Admin\AppData\Local\Temp\jucheck32.exe
  "jucheck32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Program Files\Java\jre-1.8\bin\javaws.exe
    "C:\Program Files\Java\jre-1.8\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdate
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2560
  - - C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
      "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamRrLmRpc2FibGVMYXN0VXNhZ2VUcmFja2luZz10cnVlAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGUALURqbmxweC52bWFyZ3M9TFVScVpHc3VaR2x6WVdKc1pVeGhjM1JWYzJGblpWUnlZV05yYVc1blBYUnlkV1VB -ma LVNTVkJhc2VsaW5lVXBkYXRlAC1ub3RXZWJKYXZh
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:464
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 1328
    3⤵
    - Program crash
    PID:2144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 1848
  2⤵
  - Program crash
  PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4896 -ip 4896
1⤵
PID:2400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1112 -ip 1112
1⤵
PID:2252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0BD7EA52E65FB076EBB4C048B48576EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0BD7EA52E65FB076EBB4C048B48576EA
Size 87KB
SHA256 310f61ca7209e55c370ffd5295c29abf583f29268e278d2bec1d381044017365
MD5 6698854f7c52cf57c6b4d0a108b58c23
SHA1 bdff9b4883d47e40e3fad1d04eb78ab3b548bcbf
SHA512 69545e69573e02bad809af5665a8f686fcb426cce15a9e98802ba96eb45ba3b5fa23ba697d28724e5e1db192f5e5111fed9546fa13d65da554e9a9c6c4c2ca9e
SSDEEP 1536:LFdFPljlEiL3X8seKx4aa5cg8zddE+f9iMbDNp4XISVeQXXme+cHXX:LFj/j4am8dZf9iMUYSVeQHNXX
TLSH
T13693FAA8AF77F560AD478F6A4EEED69612E512D51D01432F0E307EB06F13AA7FA57000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

0BD7EA52E65FB076EBB4C048B48576EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0BD7EA52E65FB076EBB4C048B48576EA
Size 246B
SHA256 efabc367ee7de933df2882637b6905affb0d60b8e4c326622dd4205eab06702d
MD5 bb05cae3f6fc678d3e0d9b48ebdd161c
SHA1 e71daaefb66a410ceb45b44ec80976e7a4a3ba44
SHA512 af76757e260d07e28b4ffc47ab90edf312d67318966fa9d91dc75cb878f3ce563072471d4b7e84d9550f4ec0abfb71bb47db7a1001511f375f6d2837f7fcb2db
TLSH
T15ED0221863A00347F0A6437BC4C04A83EE558400B84117472FA32F2D883EF032C32D0C
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 68d189df9717bbe0726901b3daa2bffead481c70b98d9b13c8eaf6fc076639ce
MD5 025dbb0c53c3c5b87baed916773d16de
SHA1 26de86a9a5edde704f6576e553bf1c4bd34e200b
SHA512 d1f28ca0702204293cf53cf1cd346bc54d9b046a949d3ef6bb1f3b660327f7c6cda6d2f9c0405e3ea3f0647e8971e79350b8cac48fa0761976e1d1d7b11c5302
TLSH
T177C08C2C6AA28A06F6B8437C42C13D039B208601E2418F051AF13A08CD96B162838C2A
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 b785858982de7ba22eef2d5f7b08c438caf07c8760882be3836a9a321bbbb8d7
MD5 ea0e160d932430c8ef19eff9bc59c4ee
SHA1 532078f54be6cade21c0d7bd18efe2f04dd6fc27
SHA512 0a51ad79f39cc7b8e1bc1fc747d29286685696beb55a180a0e9f08e40a52567a0e3a1d156786df534c0f3b96bb0aa1c8799fd05580253050dd5b963d06bd783a
TLSH
T12CC08C1C4761460BF2B883B802C23D838A208110F3819F1126B13A08DE34F122838C29
MD5 SHA1 SHA512 TLSH

Submit Download

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 896B
SHA256 8ec6a538a81d028bf4299c8bfe1a6d263f49a1dea865e2c9ed4884f7903174d9
MD5 da73251a10e7fa8f3484f768a53ef1e0
SHA1 f4c2ea6f7ec2ecfb8439ce773d0723c58eeff90b
SHA512 36c450ff5300ac9e787fc3b20b0cd3bd0ca6d187bdf3b1301d167beacaa6152f5a578e3f1210d1c85151ea74f8de49992b51ff70563676d343b2178d4f76d89d
TLSH
T18511E182782BA07029413431E9CF43F63BF1AB3D08A52279B1C059CEB8B1F3606A3C65
MD5 SHA1 SHA512 TLSH

Submit Download

securitypack.jar

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security\securitypack.jar
Size 12KB
SHA256 b970a392e8808b00ad48c1a1d0a04622cc30a830439f08829683ad972e42db93
MD5 afe260f94b8e4ddba883e7a0eb0490b4
SHA1 6ba8882dc36bcfbcd9a29146e16044b9f00c01ef
SHA512 f237dc383b97f474b1925678cb23f931c0f93e978cba79479ac015c29e4dc3ea42c482888e3e2c66adfa8f5e71a1a4db04a971f206999151fa06d51816ee19da
SSDEEP 384:uNLbFqAZFbIgE4kqgnGdERQcC2NJQ5bBsBB:uRQY1IgEDnPtC2bQd27
TLSH
T1E442BF71BF31C9A6FD3858FE4639EF068A4FE30F08673E4A03502B4637573A45A6148A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jucheck32.exe

Path C:\Users\Admin\AppData\Local\Temp\jucheck32.exe
Size 1.2MB
SHA256 1889ff3c62ca9675cd1e364f44f92b1142d4d004f143f602ac2eaa3db237cd26
MD5 006622c7269d5b9466813dce3b940726
SHA1 12ca640590d35526082d4ccb0465b10e38c72c3d
SHA512 55f256b2468a74f0a1ef93c46e56ba9470f2197982b085505000069ce9835382a767f304de1c84ea349b66eb60f177d87ad90eb914bfa8585a76ee6b0e60812b
SSDEEP 24576:uoMOW0n7Ubxk/uRvJqLGJLQ4a56duA/85RkV4l7/Zj:r4iwwGJra0uAUfkVy7/Zj
TLSH
T197457B2176D58036F2B32731687C92645A3AFCB2993A854F73CC666D1F30A818E35B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 5a8fa4c4ffbf8376695e970f2960db82177b4f05781954b780bc70ff62be5f1b
MD5 fdd25fdb7e4e5a24c49b7c555bc56683
SHA1 78c2431cc1dffdb82f0e43c8b885fead5c0a66cb
SHA512 9265fc47ed59855fc7b74041e0b37214bd7b9fe8f8375b2435566bf0a0b0d8843f96ea43302d18bb74b7a8b19a285a3e04bbdcdcd8d1b99f414d9f77fac0b6ef
SSDEEP 3072:9KU3dWDOESN9n8p5VDzYDuIaifSnxC61dNyUy61dwBtUyu8Uy8Ic9hZBV6P9HFy2:1N9n8prfYDuIaifSnxC61dNyUy61dwBh
TLSH
T1D1F3404ADA2E84BE20534BD7D36D9C658EA2160A535E1A1831DF83CB7481D03CA6F5FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/464-394-0x000002148F1C0000-0x000002148F1C1000-memory.dmp

Download

memory/464-343-0x000002148F1C0000-0x000002148F1C1000-memory.dmp

Download

memory/464-337-0x000002148F1C0000-0x000002148F1C1000-memory.dmp

Download

memory/464-313-0x000002148F1C0000-0x000002148F1C1000-memory.dmp

Download

memory/464-293-0x000002148F1C0000-0x000002148F1C1000-memory.dmp

Download