ea357b855a21f3ab19960fbc00febd1501e8197962efa9d96766b701683d71ba

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 03:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_c23f7251039960503e73fac9b5fc7eeb_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
Size 1.4MB
Sample261002-d83w2asamd
SHA256 ea357b855a21f3ab19960fbc00febd1501e8197962efa9d96766b701683d71ba
MD5 c23f7251039960503e73fac9b5fc7eeb
SHA1 6ba5c41c77617f58ebff2ad2eb1ec282d5b8157b
SHA512 8a57d1c12f44e1ad54d3c04a7477a4bda179000c212e560c738a57e838b1569812424ef902bf35bfe74baf80b8a100a85456a12096dc122a844733861f5f423e
SSDEEP 24576:GDV0bKoMOW0n7Ubxk/uRvJqLGJLQ4a56duA/85RkV4l7/Z9iuWXZ:GDWb34iwwGJra0uAUfkVy7/ZViZ
TLSH
T1EC658C2136D58036F2B32731587897249A7AFCB29A36854F73C8676D1F30A818E35B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1376	jucheck32.exe
4968	eventviewer.exe

Loads dropped DLL 6 IoCs

pid	Process
4968	eventviewer.exe
4968	eventviewer.exe
4968	eventviewer.exe
4968	eventviewer.exe
4968	eventviewer.exe
4968	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-10-01_c23f7251039960503e73fac9b5fc7eeb_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-10-01_c23f7251039960503e73fac9b5fc7eeb_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-01_c23f7251039960503e73fac9b5fc7eeb_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-01_c23f7251039960503e73fac9b5fc7eeb_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jucheck32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jucheck32.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_c23f7251039960503e73fac9b5fc7eeb_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jucheck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4968	eventviewer.exe
4968	eventviewer.exe
2060	javaws.exe
2060	javaws.exe
3824	jp2launcher.exe
3824	jp2launcher.exe
4968	eventviewer.exe
4968	eventviewer.exe
4968	eventviewer.exe
4968	eventviewer.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1376	jucheck32.exe
1376	jucheck32.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1376	jucheck32.exe
1376	jucheck32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1376	jucheck32.exe
1376	jucheck32.exe
3824	jp2launcher.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3776 wrote to memory of 1376	3776	2026-10-01_c23f7251039960503e73fac9b5fc7eeb_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe	87
PID 3776 wrote to memory of 4968	3776	2026-10-01_c23f7251039960503e73fac9b5fc7eeb_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe	88
PID 1376 wrote to memory of 2060	1376	jucheck32.exe	89
PID 2060 wrote to memory of 3824	2060	javaws.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-01_c23f7251039960503e73fac9b5fc7eeb_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_c23f7251039960503e73fac9b5fc7eeb_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Users\Admin\AppData\Local\Temp\jucheck32.exe
  "jucheck32.exe "
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Program Files\Java\jre-1.8\bin\javaws.exe
    "C:\Program Files\Java\jre-1.8\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdate
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2060
  - - C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
      "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamRrLmRpc2FibGVMYXN0VXNhZ2VUcmFja2luZz10cnVlAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGUALURqbmxweC52bWFyZ3M9TFVScVpHc3VaR2x6WVdKc1pVeGhjM1JWYzJGblpWUnlZV05yYVc1blBYUnlkV1VB -ma LVNTVkJhc2VsaW5lVXBkYXRlAC1ub3RXZWJKYXZh
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:3824
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 896B
SHA256 c286b74dd0af2f0bcdf96e797ed88c432da62ad12c15a0bed9de51a41c3751a5
MD5 1e7b427ad67f3baf25de9a111f7e144e
SHA1 a8469e3d35f796915157671db09d75ee0c4a5dda
SHA512 c53fff35dd3dba14d1a76b798b0ef0408f310a05408b2e7b7a128a36fba56d16d6d305565c79e75053f15315ac24a6aa02212256f1e1fb4e4cda9d18cc96c6df
TLSH
T1FE11E592B81BA0702D413172E9CF43F63BB59B7D08E52275B1C058CDB864F3746A3C24
MD5 SHA1 SHA512 TLSH

Submit Download

securitypack.jar

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security\securitypack.jar
Size 12KB
SHA256 e94ed703c880dc054137c8de6a731bc8a9f06302b59f2ebe4de3436e582ad464
MD5 0e287ef1530ad82a789e6f511fe69b9d
SHA1 1ba51bf0716dd402f6536f11d49008a8fadb7ad3
SHA512 9fb21d01922c214254f52eb933efa6589f9d2a54772ec777b0eed84f968edcfdf1025c81e64a542f6390dc11554f568bf0f156b1e54b8d57dc33d20a51c80d5d
SSDEEP 384:EoZ7VvSQIFCrCwZ6io/GUTySCkervC2NJM5bBsUq:zTaQmaCviFUThervC2bMd2B
TLSH
T16542C07A1A75ED07CD377A336610F90B9A6DD28A1748520753CA0B798ED1BE003919CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jucheck32.exe

Path C:\Users\Admin\AppData\Local\Temp\jucheck32.exe
Size 1.2MB
SHA256 1889ff3c62ca9675cd1e364f44f92b1142d4d004f143f602ac2eaa3db237cd26
MD5 006622c7269d5b9466813dce3b940726
SHA1 12ca640590d35526082d4ccb0465b10e38c72c3d
SHA512 55f256b2468a74f0a1ef93c46e56ba9470f2197982b085505000069ce9835382a767f304de1c84ea349b66eb60f177d87ad90eb914bfa8585a76ee6b0e60812b
SSDEEP 24576:uoMOW0n7Ubxk/uRvJqLGJLQ4a56duA/85RkV4l7/Zj:r4iwwGJra0uAUfkVy7/Zj
TLSH
T197457B2176D58036F2B32731687C92645A3AFCB2993A854F73CC666D1F30A818E35B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 165KB
SHA256 60156597bdb3671a83ff01bdedc5214153f3447ada215cb3a7a31d4a8dd73301
MD5 d0cf708e4465f63ba4e8bdf86462129b
SHA1 3674607189800b397669ea627bc7fe149d06679e
SHA512 cd5415cd4c0f1b4e824ebaf9c81c1feb0dc006d0e9c0058d8880f5c3b3b36dbad6ca37158ecb505233ff3e095a68b8ace297b06f67a7a98ffee4f4a045432936
SSDEEP 3072:p4hROL9TRjKtE9kleI5DGPOcLjJuuk6iAViZxHPkzat1:LIkq
TLSH
T13FF3328BC86E45BA31634BE7C37D6C644662271D435E0A1C31EF82DEA045F03D66E8EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

syslog.exe

Path C:\Windows\SysWOW64\syslog.exe
Size 148KB
SHA256 43639033d9ff5b9b9a90321c1d516460bc520a94414ab9af8a9debb2ed570cf9
MD5 1460f5c64c838744288e1288df25b66b
SHA1 4cd089167f14713ec57ae2106926cbbe48fbc8ca
SHA512 5001d859bee4af3317ca88ba9de89d98c4a74bbc1b3a314b4941e6f1e49e0722f9c8bc6d1f61a494a872c0584f52ac844c8d784c70f211e5d4869e7052279828
SSDEEP 3072:Gl5DVnMvbOU6VAYD6eS91So1ja69RnCUjX5XIYlMQB:GjuDOhVL4RnCaXIYlJ
TLSH
T125E39E2172D0C4B6E1BB41328C759E749BB6FC784EB2860F23A47B0D1D726914D2AB67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3824-295-0x00000220F52E0000-0x00000220F52E1000-memory.dmp

Download

memory/3824-347-0x00000220F52E0000-0x00000220F52E1000-memory.dmp

Download

memory/3824-376-0x00000220F52E0000-0x00000220F52E1000-memory.dmp

Download

memory/3824-336-0x00000220F52E0000-0x00000220F52E1000-memory.dmp

Download

memory/3824-400-0x00000220F52E0000-0x00000220F52E1000-memory.dmp

Download

memory/3824-319-0x00000220F52E0000-0x00000220F52E1000-memory.dmp

Download

memory/4968-452-0x0000000005A70000-0x0000000005B9A000-memory.dmp

Download