99e735f96cf1d787524bea5a71537bbdc8bcbd85cbc180254cb865eeee68b57c

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_707b31ca08d9d0672fc349f5030a4a17_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
Size 1.4MB
Sample260714-eabkkadw7m
SHA256 99e735f96cf1d787524bea5a71537bbdc8bcbd85cbc180254cb865eeee68b57c
MD5 707b31ca08d9d0672fc349f5030a4a17
SHA1 98a5ecb8bec525e1d9c07b214d1a406dcb61baf0
SHA512 8e80746c244f447a91973729851c776f6e6bb89a14f3d39108acfe2b7c91db9882d2706021cb6e121443647bdb493d474bf7fcd1b2798b24c576a0261631091b
SSDEEP 24576:GDV0bKoMOW0n7Ubxk/uRvJqLGJLQ4a56duA/85RkV4l7/Z9iuWX9:GDWb34iwwGJra0uAUfkVy7/ZVi9
TLSH
T106658C2136D58036F2B32731587897249A7AFCB29A36854F73C8676D1F30A818E35B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4164	jucheck32.exe
5868	eventviewer.exe

Loads dropped DLL 10 IoCs

pid	Process
5868	eventviewer.exe
5868	eventviewer.exe
5868	eventviewer.exe
5868	eventviewer.exe
5868	eventviewer.exe
5868	eventviewer.exe
5868	eventviewer.exe
5868	eventviewer.exe
5868	eventviewer.exe
5868	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-07-14_707b31ca08d9d0672fc349f5030a4a17_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-07-14_707b31ca08d9d0672fc349f5030a4a17_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_707b31ca08d9d0672fc349f5030a4a17_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jucheck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5868	eventviewer.exe
5868	eventviewer.exe
3696	javaws.exe
3696	javaws.exe
2996	jp2launcher.exe
2996	jp2launcher.exe
5868	eventviewer.exe
5868	eventviewer.exe
5868	eventviewer.exe
5868	eventviewer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2996	jp2launcher.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 4164	3048	2026-07-14_707b31ca08d9d0672fc349f5030a4a17_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe	87
PID 3048 wrote to memory of 5868	3048	2026-07-14_707b31ca08d9d0672fc349f5030a4a17_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe	88
PID 4164 wrote to memory of 3696	4164	jucheck32.exe	89
PID 3696 wrote to memory of 2996	3696	javaws.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-14_707b31ca08d9d0672fc349f5030a4a17_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_707b31ca08d9d0672fc349f5030a4a17_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Users\Admin\AppData\Local\Temp\jucheck32.exe
  "jucheck32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Program Files\Java\jre-1.8\bin\javaws.exe
    "C:\Program Files\Java\jre-1.8\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdate
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3696
  - - C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
      "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamRrLmRpc2FibGVMYXN0VXNhZ2VUcmFja2luZz10cnVlAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGUALURqbmxweC52bWFyZ3M9TFVScVpHc3VaR2x6WVdKc1pVeGhjM1JWYzJGblpWUnlZV05yYVc1blBYUnlkV1VB -ma LVNTVkJhc2VsaW5lVXBkYXRlAC1ub3RXZWJKYXZh
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:2996
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 896B
SHA256 acb26658c28dfaba71092dd3941b5310e8daf915b0b3824b3a5aba86d749c63a
MD5 a9d1b13e68aa122dc544fe4de0d2eb75
SHA1 fef03b81aadf17a76183c154d319c9f4559a5ca4
SHA512 d281d79961083e73ef0e744f22ac92d1e57ee156795bca58429ab9bd588bd796d58219e5759d6945a4ba3b0ac797a75649be66a9f0a857fbf795e3a97ad79280
TLSH
T13B11E182782BB07069413031E9CF83F63BB1AB3D08A52179B1C059CEB871F3706A3C65
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-14_707b31ca08d9d0672fc349f5030a4a17_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-14_707b31ca08d9d0672fc349f5030a4a17_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
Size 1.4MB
SHA256 99e735f96cf1d787524bea5a71537bbdc8bcbd85cbc180254cb865eeee68b57c
MD5 707b31ca08d9d0672fc349f5030a4a17
SHA1 98a5ecb8bec525e1d9c07b214d1a406dcb61baf0
SHA512 8e80746c244f447a91973729851c776f6e6bb89a14f3d39108acfe2b7c91db9882d2706021cb6e121443647bdb493d474bf7fcd1b2798b24c576a0261631091b
SSDEEP 24576:GDV0bKoMOW0n7Ubxk/uRvJqLGJLQ4a56duA/85RkV4l7/Z9iuWX9:GDWb34iwwGJra0uAUfkVy7/ZVi9
TLSH
T106658C2136D58036F2B32731587897249A7AFCB29A36854F73C8676D1F30A818E35B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jucheck32.exe

Path C:\Users\Admin\AppData\Local\Temp\jucheck32.exe
Size 1.2MB
SHA256 1889ff3c62ca9675cd1e364f44f92b1142d4d004f143f602ac2eaa3db237cd26
MD5 006622c7269d5b9466813dce3b940726
SHA1 12ca640590d35526082d4ccb0465b10e38c72c3d
SHA512 55f256b2468a74f0a1ef93c46e56ba9470f2197982b085505000069ce9835382a767f304de1c84ea349b66eb60f177d87ad90eb914bfa8585a76ee6b0e60812b
SSDEEP 24576:uoMOW0n7Ubxk/uRvJqLGJLQ4a56duA/85RkV4l7/Zj:r4iwwGJra0uAUfkVy7/Zj
TLSH
T197457B2176D58036F2B32731687C92645A3AFCB2993A854F73CC666D1F30A818E35B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jucheck32.exe

Path C:\Users\Admin\AppData\Local\Temp\jucheck32.exe
Size 236KB
SHA256 8af78ea3a8055b964ac4ee6f6be6281795bbd87b5c9d0705f18c9b937522c8bd
MD5 4f0fa53bfafbe63fafee4cda74a00b67
SHA1 375bd18945d077431f56b6a5bd526d57f29a3f60
SHA512 9e0bd043f3ff41f1b4460bea5cc810a1d039488af76f513c6b5c6f9afcea2dbcbf966fbfd5a46a029f5e36371be9ebb3a5a5ecb273865ce3e39e9310f908379b
SSDEEP 3072:Gl5DVnMvbOU6VAYD6eS91So1ja69RnCUjX5XIYlMQbiYV0OZNjrc1F+QUQoRlnzn:GjuDOhVL4RnCaXIYlDiuW1FXEl
TLSH
T12C34AF2276D084B2E2A940328C759F39D7B7FC785F71864F6364BF1C2D32690892AB57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 165KB
SHA256 b60c85ad1531ffd0b8701f7a66043248bb078a86aad253fa635901642a50496b
MD5 344e6452e9b04b2bb7446ad4946c9d4f
SHA1 9d9217e4223050ab66b9958b6a13d7312c7648e1
SHA512 fba5827f8390300d298313d4782ebf84f256bf5604e2a1b1143fbc593596e05d29a05bcefdbd868e88b8baca05d6988ed62a8ecf65c06a0326bc6fe80009d076
SSDEEP 3072:bcMNjGN4qHNfkjGFIyJMNN1TNFT00aTt7duGHi6RNOs1:gW8n
TLSH
T185F35187866D44BA20134B97CB7A585C9B630A09479E0A3C71DFC2FE6545E03DB2E4FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp4D31.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp4D31.tmp
Size 152KB
SHA256 ddf4b5ab3491bb76333a03d97cb478fe7c1c2cb05f20e3b33d361c14a56a2050
MD5 f58985ef7e229dc39a3f39f72be34a2e
SHA1 7cb15b35b1e2a75de791f025df438461c1697599
SHA512 e4144ea0e9a406dcdb893d67f3f79ec64a86e7f1553ff288adea48948ade05f080c50884f36f0785aaec19ca6764d794e576196ea03082c653f384cc05c6a6df
SSDEEP 3072:ul5DVnMvbOU6VAYD6eS91So1jaAM9RnCUjX5XIYbMQp:ujuDOhVLAyRnCaXIYbR
TLSH
T1A6E3AE2172C1C4B6E1BA41328D758F745BBAFC795EB2460F63A43B0C1D726910D2ABB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

syslog.exe

Path C:\Windows\SysWOW64\syslog.exe
Size 148KB
SHA256 43639033d9ff5b9b9a90321c1d516460bc520a94414ab9af8a9debb2ed570cf9
MD5 1460f5c64c838744288e1288df25b66b
SHA1 4cd089167f14713ec57ae2106926cbbe48fbc8ca
SHA512 5001d859bee4af3317ca88ba9de89d98c4a74bbc1b3a314b4941e6f1e49e0722f9c8bc6d1f61a494a872c0584f52ac844c8d784c70f211e5d4869e7052279828
SSDEEP 3072:Gl5DVnMvbOU6VAYD6eS91So1ja69RnCUjX5XIYlMQB:GjuDOhVL4RnCaXIYlJ
TLSH
T125E39E2172D0C4B6E1BB41328C759E749BB6FC784EB2860F23A47B0D1D726914D2AB67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2996-81-0x000001E28C460000-0x000001E28C461000-memory.dmp

Download

memory/2996-107-0x000001E28C460000-0x000001E28C461000-memory.dmp

Download

memory/2996-106-0x000001E28C460000-0x000001E28C461000-memory.dmp

Download

memory/2996-70-0x000001E28C460000-0x000001E28C461000-memory.dmp

Download

memory/2996-57-0x000001E28C460000-0x000001E28C461000-memory.dmp

Download

memory/2996-56-0x000001E28C460000-0x000001E28C461000-memory.dmp

Download