043a53c43aa6f1b9684150728c5b70a6a26b5f09755fa069c261ea37b95be2ab

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_2ad9dfdf9278acae867ab0baddadb5fe_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Size 1.2MB
Sample260814-repzzadj5w
SHA256 043a53c43aa6f1b9684150728c5b70a6a26b5f09755fa069c261ea37b95be2ab
MD5 2ad9dfdf9278acae867ab0baddadb5fe
SHA1 501056740e5ed9aeb27fc9dc68c9766cb904fedb
SHA512 094be6cd4a675bb0f5430b07bc57f42a1b484f049fb6caad79b0ce5a99128dc44b765e3157629eafe608124d536fed32ec051f9d91f32adf32f27f8202bb77be
SSDEEP 24576:uoMOW0n7Ubxk/uRvJqLGJLQ4a56duA/85RkV4l7/Z9iuWXj:r4iwwGJra0uAUfkVy7/ZVij
TLSH
T15D557C2136D58036F2B32731587893649A3AFCB2993A854F73CC666D5F30A818E35B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_2ad9dfdf9278acae867ab0baddadb5fe_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3336	javaws.exe
3336	javaws.exe
1080	jp2launcher.exe
1080	jp2launcher.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
6048	2026-08-14_2ad9dfdf9278acae867ab0baddadb5fe_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
6048	2026-08-14_2ad9dfdf9278acae867ab0baddadb5fe_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
6048	2026-08-14_2ad9dfdf9278acae867ab0baddadb5fe_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
6048	2026-08-14_2ad9dfdf9278acae867ab0baddadb5fe_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1080	jp2launcher.exe
6048	2026-08-14_2ad9dfdf9278acae867ab0baddadb5fe_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
6048	2026-08-14_2ad9dfdf9278acae867ab0baddadb5fe_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6048 wrote to memory of 3336	6048	2026-08-14_2ad9dfdf9278acae867ab0baddadb5fe_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe	89
PID 3336 wrote to memory of 1080	3336	javaws.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-14_2ad9dfdf9278acae867ab0baddadb5fe_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_2ad9dfdf9278acae867ab0baddadb5fe_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6048
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  "C:\Program Files\Java\jre-1.8\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdate
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3336
- - C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
    "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamRrLmRpc2FibGVMYXN0VXNhZ2VUcmFja2luZz10cnVlAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGUALURqbmxweC52bWFyZ3M9TFVScVpHc3VaR2x6WVdKc1pVeGhjM1JWYzJGblpWUnlZV05yYVc1blBYUnlkV1VB -ma LVNTVkJhc2VsaW5lVXBkYXRlAC1ub3RXZWJKYXZh
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 896B
SHA256 505a9c152e9d8e4a3cb5e0c0c92e25bf87c9dac9d62db81ebef2c3eee9c0ec87
MD5 396a7f0bcc76a20aee328c6fc9c1289e
SHA1 0fbf6c86a8d6727f4e2a4af529725c2fd5bd1938
SHA512 cab57fe973490500c1301bd2d2b02745c108c482572aca36ce0ff437c13295116f430ac178f51b26bff9b8c043a49f8e84b605a4e9cc51ae919bfbc537a38aee
TLSH
T1AD11E582792BA0702D413572E9CB43F73BB1A73D08A52275B2C058CEB8B1F3616A3C24
MD5 SHA1 SHA512 TLSH

Submit Download

securitypack.jar

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security\securitypack.jar
Size 12KB
SHA256 95bdc5e823125f0f7e690d54886967cca08bbcf37a08d35f1951766e2f7cf3c6
MD5 8415b8db3bff0dd29e7a9a4f8508b2ce
SHA1 594376869089a88425e154ffb16ee1acb4b603d0
SHA512 4f10458af6c1ce8b8c614c1ff10514b07e21fcf0a7075c053f07e5171a49703806af871c0b7097eaccdd6b0138030140744de4a1a1fbc00f7d5ac8b4e8fda567
SSDEEP 384:DG2pVRHeAbBw3PlsNjO7KC2NJy5bBsUKc:62pVNCWNCeC2byd2+
TLSH
T1E142C0412E74DD48EB33E2FA9163E09349EEE5DB299D42362E951E4417688880F634DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 3c4033924560eae392e051806cf7bde7d40ac3d9c6f6dca8936702d29144b266
MD5 ef0f3bb238462ddbad51fee793c217f6
SHA1 5d816e447c133ce4fecbf0ae890e7655173ba40e
SHA512 5e3efc388af9b2980c9c00bca4c513033ded72b7cbf353b189a3d74e6ee496378255972e87fbab1e5d86c92421c4bed3ffd46c7efeb6af6a570b9cfd68bc9603
SSDEEP 3072:kIN5YVdd7ZP3UGd7d7p43HlrXf900SZgqC6HaHWCMGW:GsDu
TLSH
T122F331C6852E44FB34138B87C67A6DB456A7225E579E491832CFC2DE6741803CE2F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1080-18-0x000001C7EB030000-0x000001C7EB2A0000-memory.dmp

Download

memory/1080-46-0x000001C7EABA0000-0x000001C7EABA1000-memory.dmp

Download

memory/1080-59-0x000001C7EABA0000-0x000001C7EABA1000-memory.dmp

Download

memory/1080-76-0x000001C7EABA0000-0x000001C7EABA1000-memory.dmp

Download

memory/1080-125-0x000001C7EABA0000-0x000001C7EABA1000-memory.dmp

Download

memory/1080-132-0x000001C7EABA0000-0x000001C7EABA1000-memory.dmp

Download

memory/1080-133-0x000001C7EB030000-0x000001C7EB2A0000-memory.dmp

Download