cabb8b348a1770ee3cc407501e621cf742ac3408d9346ce4214a9ffd74dd6ef9

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 17:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-07_040c6276b8c49d0131ed9642375fede7_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
Size 1.4MB
Sample261107-vx7vaadv8w
SHA256 cabb8b348a1770ee3cc407501e621cf742ac3408d9346ce4214a9ffd74dd6ef9
MD5 040c6276b8c49d0131ed9642375fede7
SHA1 68b275129d29a618d640c63a44fa3d1431227ead
SHA512 1660ecbefd768d9798b9d2d0bda23f12bb0f0c8f2b476f2aa7bbe78ba37454883fec3df85f9a9e61b06909f151f07199236bdfb28654f15d1aab627762c0706e
SSDEEP 24576:GDV0bKoMOW0n7Ubxk/uRvJqLGJLQ4a56duA/85RkV4l7/Z9iuWX4:GDWb34iwwGJra0uAUfkVy7/ZVi4
TLSH
T133658C2136D58036F2B32731587897249A7AFCB29A36854F73C8676D1F30A818E35B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2980	jucheck32.exe
4832	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-11-07_040c6276b8c49d0131ed9642375fede7_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-11-07_040c6276b8c49d0131ed9642375fede7_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2136	4832	WerFault.exe	90
5836	2680	WerFault.exe	88

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jucheck32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jucheck32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-07_040c6276b8c49d0131ed9642375fede7_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-07_040c6276b8c49d0131ed9642375fede7_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jucheck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-07_040c6276b8c49d0131ed9642375fede7_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4832	eventviewer.exe
4832	eventviewer.exe
4604	javaws.exe
4604	javaws.exe
4644	jp2launcher.exe
4644	jp2launcher.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2980	jucheck32.exe
2980	jucheck32.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2980	jucheck32.exe
2980	jucheck32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2980	jucheck32.exe
2980	jucheck32.exe
4644	jp2launcher.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2980	2680	2026-11-07_040c6276b8c49d0131ed9642375fede7_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe	89
PID 2680 wrote to memory of 4832	2680	2026-11-07_040c6276b8c49d0131ed9642375fede7_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe	90
PID 2980 wrote to memory of 4604	2980	jucheck32.exe	91
PID 4604 wrote to memory of 4644	4604	javaws.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-11-07_040c6276b8c49d0131ed9642375fede7_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-07_040c6276b8c49d0131ed9642375fede7_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Users\Admin\AppData\Local\Temp\jucheck32.exe
  "jucheck32.exe "
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Program Files\Java\jre-1.8\bin\javaws.exe
    "C:\Program Files\Java\jre-1.8\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdate
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4604
  - - C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
      "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamRrLmRpc2FibGVMYXN0VXNhZ2VUcmFja2luZz10cnVlAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGUALURqbmxweC52bWFyZ3M9TFVScVpHc3VaR2x6WVdKc1pVeGhjM1JWYzJGblpWUnlZV05yYVc1blBYUnlkV1VB -ma LVNTVkJhc2VsaW5lVXBkYXRlAC1ub3RXZWJKYXZh
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:4644
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4832
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 2124
    3⤵
    - Program crash
    PID:2136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 1472
  2⤵
  - Program crash
  PID:5836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4832 -ip 4832
1⤵
PID:2696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2680 -ip 2680
1⤵
PID:2492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 244KB
SHA256 eafd3047b7e628989998c6b2f40cca5bf10274e05ee23a55a8de55b8405f1b0b
MD5 53f0429960522aa4c69d52d2e3b00968
SHA1 fd5ab942678e46cd5a4cc063afe1a3fbfcd0e962
SHA512 7d368ee9bbcfcb61a86d3c084f42ccf4377f2af172dca7ee9e6704f07f101f67ecd683bd9ef93744286e8cd5eaede6c6255b77ebe6ae80c314b997460c4babf9
SSDEEP 3072:VxyPs+4Q8lbXrmvUC7hxCmITBQrAsK5XLpenbgsTpi85QmEjDB:DPcUCnCmITqrAJppeblTpJC1
TLSH
T1A634DD589DB7F0565E8A9DE18CD79E9647FC31DB22427F1B4AA05FC00C17BBB8E66080
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 9299ff969a9f89992c0bc4e26ca9f6c85913d460a428f2c27dd9fe677589eed2
MD5 826497f4a26f870325d62f0d35a97db3
SHA1 559238ea05934049f2117d747638deafeb1fbb53
SHA512 b8b1746101b3b5ce6388af1166a5d3e22dfec8e58620b63a59cf5993293322031d163a3b157d603d2cca1780acbfb4c87f72d206f28965fd8b3cadc83331fb71
TLSH
T16BC02B085FC20600F188073C01C0310197804140D0408F0605F10A0891579043424CAA
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 75b358592a2bfccf0844b5e5eb619a260f5865233057513b7818944bf0c48efa
MD5 61ee0fe1a64d260eab3a2d0135bbe43c
SHA1 5081bdac1e195d5901b50cf02944e7438d70fc27
SHA512 f0f9792989f77fa2f5b40892be728aac6b52a3f9996e018ed44de41c3193d9779975e0a3237ede6ae76552c4fb4e98ac16c51ed656a0ee4ef56971704f8925c3
TLSH
T148D0230C1F9301F6F148C67650E10D5357C0931AB095671D2FD1110D141CE501C13D4D
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 dfb246fc7c8ed1b43d79967fcc9c4ca009d27d5a98caabbaa7c3c0e38e6e454e
MD5 bc708e7d032d97f436d6c74c00a8a300
SHA1 35e5e54f623f83bfe6dd47ddb2661f9a71c11cf4
SHA512 22c68896f6ddd8eba123b49cd334dbd38a80cef51f8c2ab44e59bbfb8ab6843024468525eaedd516358a570bb731f70e2c89369e2db37f3d564b80f6129b0aa4
TLSH
T1A4C08C1C0BA14606F6A883B842C229878A608211F3819F0627B13A08CD24F222878CA9
MD5 SHA1 SHA512 TLSH

Submit Download

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 896B
SHA256 84fcec2497ea2c1b6e123fb53b35ffe5aa40f00467350c0c737e96dcd8abe20a
MD5 a8d0e0fe7914755778e21f3b96f6f7ab
SHA1 0561917183d675a5944d98e6293f5d90ed895919
SHA512 1c3073d9736f5ceb78ddbb51cac47299116a057c8fa919e4e7e3e77265baa0a9e069512c44bdf2f85f12112daa5cb0e0a5939c52e256f5cfa2b6d69c77c44d16
TLSH
T18311E592782BA0B039413572E9CF42FB3BB2977D08A52175B2C458CEB865F3712A3C24
MD5 SHA1 SHA512 TLSH

Submit Download

securitypack.jar

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security\securitypack.jar
Size 14KB
SHA256 8afd591de4090b5a11aa91a624b99895e87e0769c25f3e3ed02f28c5ead5b661
MD5 f828a6a7fd89d0b0cfbf65470c3afddd
SHA1 92cbd8debd889363b14f0619f2640a5becfecc64
SHA512 f29f9ba05da60e0b0a64b024c4ce6bfa55d112ed2afa4abbd083655e335303e553158a659dd63f623ebc6390d72eabf00574e35eb3b4b69683bf9b1c5ed2b6e9
SSDEEP 384:/Cg/yCOi9he06A8BKXpM2kaC2NJb2LEPga9Au501luvuQ:WyhbIWLC2bb2qga9qsl
TLSH
T10462C0542FD9F1BAFD890ABF6B927481F9CF873B3318933A2A207C817948C548745549
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jucheck32.exe

Path C:\Users\Admin\AppData\Local\Temp\jucheck32.exe
Size 1.2MB
SHA256 1889ff3c62ca9675cd1e364f44f92b1142d4d004f143f602ac2eaa3db237cd26
MD5 006622c7269d5b9466813dce3b940726
SHA1 12ca640590d35526082d4ccb0465b10e38c72c3d
SHA512 55f256b2468a74f0a1ef93c46e56ba9470f2197982b085505000069ce9835382a767f304de1c84ea349b66eb60f177d87ad90eb914bfa8585a76ee6b0e60812b
SSDEEP 24576:uoMOW0n7Ubxk/uRvJqLGJLQ4a56duA/85RkV4l7/Zj:r4iwwGJra0uAUfkVy7/Zj
TLSH
T197457B2176D58036F2B32731687C92645A3AFCB2993A854F73CC666D1F30A818E35B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 165KB
SHA256 1a21bd25a4410b15d9a8b7c125490ccf616de4f7b51c7516aed950751570cae5
MD5 785edb547fd64b94bc60e5f1ecbb2be6
SHA1 faa20c84688460cdfea4eea743b9d49b14d3f4c8
SHA512 880448ecc391c1cdcb617363c5e13a67bdc31956ee5017ca20118b72778d45e3ccf49f2af34c3eb8389bb0eb76d964c0fc7ea95036344113d38e3db9da2d614b
SSDEEP 3072:IOGZ1sLUm/rRQRcF6w5TSpwG+x/MM6d1SM/TWdsAGsg:qA9+
TLSH
T137F33297893D48FA34530BF7C7AA5CA48566670B435E0A1831CF82DEB445D0786BE8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 28KB
SHA256 3c76064f1d722b5dd6592d04a7ea6cff1e8b208af3a756a68058c3926b944ef7
MD5 e3abab8a8ccf89b2e8c920d3c810cc26
SHA1 a6cb4e6cc4e9f5d285c9f60710cab486092d08e5
SHA512 9304365da3db425225dc384097c10e54c4d585411e74758c58dce8ab3120eb5fa5c25615d5163f0c4219c7245390d59ec4741e6c5379c816f531ba0d8642dc60
SSDEEP 768:YqQmVAz2PnxtyOdIzIYu6MpV4a8IUT7qH0/A2a8IUT7n:S2PHyOTCasJY2asX
TLSH
T16BD22C7B8724087555E3034A6FBF7584B855A08BF102D4F4BAAF66052F83EB68473E5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4644-328-0x0000027159780000-0x0000027159781000-memory.dmp

Download

memory/4644-357-0x0000027159780000-0x0000027159781000-memory.dmp

Download

memory/4644-306-0x0000027159780000-0x0000027159781000-memory.dmp

Download

memory/4644-374-0x0000027159780000-0x0000027159781000-memory.dmp

Download

memory/4644-401-0x0000027159780000-0x0000027159781000-memory.dmp

Download

memory/4644-428-0x0000027159780000-0x0000027159781000-memory.dmp

Download

memory/4644-429-0x0000027159780000-0x0000027159781000-memory.dmp

Download