043a53c43aa6f1b9684150728c5b70a6a26b5f09755fa069c261ea37b95be2ab

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_2ad9dfdf9278acae867ab0baddadb5fe_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Size 1.2MB
Sample260814-repzzadj5w
SHA256 043a53c43aa6f1b9684150728c5b70a6a26b5f09755fa069c261ea37b95be2ab
MD5 2ad9dfdf9278acae867ab0baddadb5fe
SHA1 501056740e5ed9aeb27fc9dc68c9766cb904fedb
SHA512 094be6cd4a675bb0f5430b07bc57f42a1b484f049fb6caad79b0ce5a99128dc44b765e3157629eafe608124d536fed32ec051f9d91f32adf32f27f8202bb77be
SSDEEP 24576:uoMOW0n7Ubxk/uRvJqLGJLQ4a56duA/85RkV4l7/Z9iuWXj:r4iwwGJra0uAUfkVy7/ZVij
TLSH
T15D557C2136D58036F2B32731587893649A3AFCB2993A854F73CC666D5F30A818E35B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_2ad9dfdf9278acae867ab0baddadb5fe_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1460	javaws.exe
1460	javaws.exe
3708	jp2launcher.exe
3708	jp2launcher.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3708	jp2launcher.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 1460	820	2026-08-14_2ad9dfdf9278acae867ab0baddadb5fe_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe	85
PID 1460 wrote to memory of 3708	1460	javaws.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-14_2ad9dfdf9278acae867ab0baddadb5fe_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_2ad9dfdf9278acae867ab0baddadb5fe_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:820
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  "C:\Program Files\Java\jre-1.8\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdate
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
    "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamRrLmRpc2FibGVMYXN0VXNhZ2VUcmFja2luZz10cnVlAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGUALURqbmxweC52bWFyZ3M9TFVScVpHc3VaR2x6WVdKc1pVeGhjM1JWYzJGblpWUnlZV05yYVc1blBYUnlkV1VB -ma LVNTVkJhc2VsaW5lVXBkYXRlAC1ub3RXZWJKYXZh
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 896B
SHA256 5462bccac79a0171b368530c2a7d6b64440f77a4bd9235734940829a774a8a58
MD5 e74b00c0d5044c52c6cec56c4f62b888
SHA1 b11a8b6a318e7f885e3beb4015f5f076ddf76a05
SHA512 cfa8201e0614a913a3b105c1e3995a239787990baa1b40f1d91dab4e7ef24d57c2fbd47c3a9c439b0aca0c90b42dd03feb16b8e967857edcb30ac3eee009f76f
TLSH
T19311A582791BA0706D413172E9DB43F73BF6A77D09A52175B1C058CDB8B1F3656A3C24
MD5 SHA1 SHA512 TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 0611fb6965bb1627e8ed4f9745ebce1b96a0b240eb66eac2825e831fafa8e630
MD5 18d34b5d0eb44725875e5957085546df
SHA1 9552df98af2a46a76444c2a28a8b581d88aff894
SHA512 123d6e9bde8ce8a1668f23aeb028d605e043d2cac1d952a020782a3f78fc506e450b9be5c3cbd3c0ca22cf976cd7c3da59ff0bd52a64dec634d83ced98b16096
SSDEEP 3072:F4QdXO/WAkAEIsJ9d1h2nR/xzjB66otXTpKZfyPVNFY:L6Os
TLSH
T134F3124AC92E857A34134AD3C3BA5D648FA6060A535E095C31EFC2EEB545D038A1F8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3708-22-0x0000022557C80000-0x0000022557EF0000-memory.dmp

Download

memory/3708-46-0x0000022557C60000-0x0000022557C61000-memory.dmp

Download

memory/3708-59-0x0000022557C60000-0x0000022557C61000-memory.dmp

Download

memory/3708-77-0x0000022557C60000-0x0000022557C61000-memory.dmp

Download

memory/3708-82-0x0000022557C60000-0x0000022557C61000-memory.dmp

Download

memory/3708-106-0x0000022557C80000-0x0000022557EF0000-memory.dmp

Download

memory/3708-107-0x0000022557C60000-0x0000022557C61000-memory.dmp

Download

memory/3708-116-0x0000022557C60000-0x0000022557C61000-memory.dmp

Download

memory/3708-117-0x0000022557C80000-0x0000022557EF0000-memory.dmp

Download