e3868f7e7d1d0a27e922556b0c53207548969a003196b379bc3cf5015214b7a2

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 07:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_3c8c6efd9f1b4e481f44c515476f8ecc_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
Size 1.4MB
Sample260804-jgrbtafd45
SHA256 e3868f7e7d1d0a27e922556b0c53207548969a003196b379bc3cf5015214b7a2
MD5 3c8c6efd9f1b4e481f44c515476f8ecc
SHA1 79fb5f3222fe52844833cbe52ebba505447d5621
SHA512 898539b8510a5000c8dacaa9e3d2ff83cb3d99292f8d93d2e97b90e6b9bb24846a8dae49cf6c711a8ffa24c5cb013cef1841a659dd330819847b723f374ebaf8
SSDEEP 24576:GDV0bKoMOW0n7Ubxk/uRvJqLGJLQ4a56duA/85RkV4l7/Z9iuWXQ:GDWb34iwwGJra0uAUfkVy7/ZViQ
TLSH
T1B4658C2136D58036F2B32731587897249A7AFCB29A36854F73C8676D1F30A818E35B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2060	jucheck32.exe
4952	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-08-04_3c8c6efd9f1b4e481f44c515476f8ecc_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-08-04_3c8c6efd9f1b4e481f44c515476f8ecc_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2100	4952	WerFault.exe	88
3272	3764	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_3c8c6efd9f1b4e481f44c515476f8ecc_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jucheck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4952	eventviewer.exe
4952	eventviewer.exe
3292	javaws.exe
3292	javaws.exe
2712	jp2launcher.exe
2712	jp2launcher.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2060	jucheck32.exe
2060	jucheck32.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2060	jucheck32.exe
2060	jucheck32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2712	jp2launcher.exe
2060	jucheck32.exe
2060	jucheck32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3764 wrote to memory of 2060	3764	2026-08-04_3c8c6efd9f1b4e481f44c515476f8ecc_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe	87
PID 3764 wrote to memory of 4952	3764	2026-08-04_3c8c6efd9f1b4e481f44c515476f8ecc_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe	88
PID 2060 wrote to memory of 3292	2060	jucheck32.exe	89
PID 3292 wrote to memory of 2712	3292	javaws.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-04_3c8c6efd9f1b4e481f44c515476f8ecc_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_3c8c6efd9f1b4e481f44c515476f8ecc_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Users\Admin\AppData\Local\Temp\jucheck32.exe
  "jucheck32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Program Files\Java\jre-1.8\bin\javaws.exe
    "C:\Program Files\Java\jre-1.8\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdate
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3292
  - - C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
      "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamRrLmRpc2FibGVMYXN0VXNhZ2VUcmFja2luZz10cnVlAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGUALURqbmxweC52bWFyZ3M9TFVScVpHc3VaR2x6WVdKc1pVeGhjM1JWYzJGblpWUnlZV05yYVc1blBYUnlkV1VB -ma LVNTVkJhc2VsaW5lVXBkYXRlAC1ub3RXZWJKYXZh
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:2712
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 1320
    3⤵
    - Program crash
    PID:2100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 1316
  2⤵
  - Program crash
  PID:3272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4952 -ip 4952
1⤵
PID:2628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3764 -ip 3764
1⤵
PID:2576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 896B
SHA256 7ff560618c3f27d94ebdfb617721f81bcc3cbabd860a9949fbaa733577e6ef35
MD5 027b91de4e5b592aac409ce590fa834e
SHA1 30c9b1d5282ce9b71bf9f0a43c139b46aed268a5
SHA512 c641764e4859c32d35388c9b989243a3f7532403cbf86adbf2d7b780e0a9e21aa3078d9b3ad724e0e0bc6e0da77aa4ca8a909964bd54cb514db60eac0f6f9467
TLSH
T12A11E192782BA0703D413132EACB43F63BB29B3D19A56175B2C059CEB870F3606A3C24
MD5 SHA1 SHA512 TLSH

Submit Download

securitypack.jar

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security\securitypack.jar
Size 12KB
SHA256 95bdc5e823125f0f7e690d54886967cca08bbcf37a08d35f1951766e2f7cf3c6
MD5 8415b8db3bff0dd29e7a9a4f8508b2ce
SHA1 594376869089a88425e154ffb16ee1acb4b603d0
SHA512 4f10458af6c1ce8b8c614c1ff10514b07e21fcf0a7075c053f07e5171a49703806af871c0b7097eaccdd6b0138030140744de4a1a1fbc00f7d5ac8b4e8fda567
SSDEEP 384:DG2pVRHeAbBw3PlsNjO7KC2NJy5bBsUKc:62pVNCWNCeC2byd2+
TLSH
T1E142C0412E74DD48EB33E2FA9163E09349EEE5DB299D42362E951E4417688880F634DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jucheck32.exe

Path C:\Users\Admin\AppData\Local\Temp\jucheck32.exe
Size 1.2MB
SHA256 1889ff3c62ca9675cd1e364f44f92b1142d4d004f143f602ac2eaa3db237cd26
MD5 006622c7269d5b9466813dce3b940726
SHA1 12ca640590d35526082d4ccb0465b10e38c72c3d
SHA512 55f256b2468a74f0a1ef93c46e56ba9470f2197982b085505000069ce9835382a767f304de1c84ea349b66eb60f177d87ad90eb914bfa8585a76ee6b0e60812b
SSDEEP 24576:uoMOW0n7Ubxk/uRvJqLGJLQ4a56duA/85RkV4l7/Zj:r4iwwGJra0uAUfkVy7/Zj
TLSH
T197457B2176D58036F2B32731687C92645A3AFCB2993A854F73CC666D1F30A818E35B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 165KB
SHA256 afc335935dc99f9406fa1bb4b69fc9268a4e4f4ba8bb07fffbab8176b9a99e6d
MD5 f80caf64c798d76349240e44358d1db8
SHA1 e74e7ce5476b9aa82cc9a559a86576ab039527be
SHA512 fb363945bc301472a17213124cbc3c73f606ee36d7f7fc98967a62429ee7dca30647efeaffee7d5339067479c3b9c676b412b5e89152f5d4478a57769e74d82c
SSDEEP 3072:wMzRUJRRjsJ1oqflfj5kFpN3MCcrrNF0VIOgW8+fjFa:HsfM
TLSH
T10BF33186993E44BB38634BD3D36A6D64D592050F839E0A1C31CFC2EEB456D03D95E8EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 174KB
SHA256 9441edffdd1c6c53e7c186f09858b53a7ff131be991979ed8d774ababb0fca82
MD5 fd9e2fbf4f81897c777960460f4bfcf3
SHA1 20c21372217b2adea8e9ddac64b3e8e22e596c37
SHA512 9052eb441028b0aeb35436c54bd45c4dbf54a64c82609fd770be24b064667bd75e2a9b3de597d4fd171452478040471c09221bdbc4eeb9a396836548fe14530d
SSDEEP 1536:VJAyOPkasJBN8EBLFOQpbHtphwSHPPnOED4LZFasjG6P1vFkN9WlQIW:vOPKXpxvMZS6PpFkIW
TLSH
T14F04C63223F008B784D706D46E396D2D6DE8DE47E11288D8F75E4BA12F868B5DE335A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2712-54-0x0000021A15E10000-0x0000021A15E11000-memory.dmp

Download

memory/2712-70-0x0000021A15E10000-0x0000021A15E11000-memory.dmp

Download

memory/2712-88-0x0000021A15E10000-0x0000021A15E11000-memory.dmp

Download

memory/2712-93-0x0000021A15E10000-0x0000021A15E11000-memory.dmp

Download

memory/2712-130-0x0000021A15E10000-0x0000021A15E11000-memory.dmp

Download

memory/2712-145-0x0000021A15E10000-0x0000021A15E11000-memory.dmp

Download