213f606ea790bb6832bfa0cedd142020dafa2828503233a1c8af54e4de18c756

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-11_779447dc4ed62f107bc8bda588e272b0_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
Size 1.4MB
Sample261113-lpghpas13r
SHA256 213f606ea790bb6832bfa0cedd142020dafa2828503233a1c8af54e4de18c756
MD5 779447dc4ed62f107bc8bda588e272b0
SHA1 e9be9a3004b1a8bad05e36e72d15d07bae3a9627
SHA512 1551dec117318ce0c94730537e83148677fb06d4ead8946b3d5bb93cb7224e1d5d2a754c763ea2ea7757d89518cc8dbe6a63976fb1d67ad162928cf42fdf08ab
SSDEEP 24576:GDV0bKoMOW0n7Ubxk/uRvJqLGJLQ4a56duA/85RkV4l7/Z9iuWXq:GDWb34iwwGJra0uAUfkVy7/ZViq
TLSH
T165658C2136D58036F2B32731587897249A7AFCB29A36854F73C8676D1F30A818E35B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2472	jucheck32.exe
3868	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-11-11_779447dc4ed62f107bc8bda588e272b0_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-11-11_779447dc4ed62f107bc8bda588e272b0_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1904	3868	WerFault.exe	91
1444	1720	WerFault.exe	88

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-11_779447dc4ed62f107bc8bda588e272b0_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-11_779447dc4ed62f107bc8bda588e272b0_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jucheck32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jucheck32.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jucheck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-11_779447dc4ed62f107bc8bda588e272b0_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4668	javaws.exe
4668	javaws.exe
3868	eventviewer.exe
3868	eventviewer.exe
4704	jp2launcher.exe
4704	jp2launcher.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2472	jucheck32.exe
2472	jucheck32.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2472	jucheck32.exe
2472	jucheck32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2472	jucheck32.exe
2472	jucheck32.exe
4704	jp2launcher.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2472	1720	2026-11-11_779447dc4ed62f107bc8bda588e272b0_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe	89
PID 2472 wrote to memory of 4668	2472	jucheck32.exe	90
PID 1720 wrote to memory of 3868	1720	2026-11-11_779447dc4ed62f107bc8bda588e272b0_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe	91
PID 4668 wrote to memory of 4704	4668	javaws.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-11-11_779447dc4ed62f107bc8bda588e272b0_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-11_779447dc4ed62f107bc8bda588e272b0_amadey_elex_emotet_glassworm_hijackloader_icedid_luca-st.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Users\Admin\AppData\Local\Temp\jucheck32.exe
  "jucheck32.exe "
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Program Files\Java\jre-1.8\bin\javaws.exe
    "C:\Program Files\Java\jre-1.8\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdate
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4668
  - - C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
      "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamRrLmRpc2FibGVMYXN0VXNhZ2VUcmFja2luZz10cnVlAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGUALURqbmxweC52bWFyZ3M9TFVScVpHc3VaR2x6WVdKc1pVeGhjM1JWYzJGblpWUnlZV05yYVc1blBYUnlkV1VB -ma LVNTVkJhc2VsaW5lVXBkYXRlAC1ub3RXZWJKYXZh
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:4704
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 2056
    3⤵
    - Program crash
    PID:1904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 1496
  2⤵
  - Program crash
  PID:1444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1720 -ip 1720
1⤵
PID:2424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 3868 -ip 3868
1⤵
PID:5876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 836B
SHA256 10ce6a561968b29ac9d759ac8dbf69e4c2b2a775006fefbd7768f7515457a502
MD5 abba165d7e530bbd08c9428f8aec4273
SHA1 fd73fb2e8db7ca9a391b2925cef3399e75d43790
SHA512 60482859fe5a0fe5bd5a7046ecf59f9eb7273a75735b19b574f7ee7286a7ae4188135a88b98814428dff3beb00e8f149355035161f2a7918ae53dc7629c9868b
TLSH
T1C10186264D4B9D25E0E69CBC49A4CC1E0DF6B684D794F1594C4CA41C7008FCBDAAF0BB
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 242KB
SHA256 e4ad0df142dcd129ca360b7bddf6dc9c495ddf3d7e8683631a47109dd59f661e
MD5 92acd3c43249b189bbb923a4c6a6ac35
SHA1 971b24fdf3497b9db125c63d0ac636c12d0c4093
SHA512 01503f3ae5fd78d817d91d33f9d26ed2aa7a4fc3f08c9ac2b86dd06400114c845c883e0b2243e9939172572882d64da100137fff2156bbb583781e39bddd9cbf
SSDEEP 3072:ZsvAIblbXrmoTB0IhRBmfUHqhBAsKTU+Km2bHso4izSzr2t0rJ:1i7TB0UBmfCkBAJDKm2Mo4Yte
TLSH
T1B434DE589DF7F0565E8A9DE18C979E9647F8319B23427F1B4EA05FC01C17BBB8E62080
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 91b79e7eb875f3a0eecf676e8c38b189823f56078c808bce49bdc3de74693a54
MD5 dfa839bff27e8a69f21a3d7850ba73ac
SHA1 699e5f1eafc4787d5ceac4070ff49d2a267a86a8
SHA512 60e5d5123effa49e64ed4fc2faf3be3937ad32f3e658354b57d16aa83ee09598911facbed9d8318d670c2cf52a61f716c257aa51114d69e9a23e3897544889c6
TLSH
T1660144B1BBBE6B347B829D4683F9EA021CE4B7B68C5061C9E445C85E4C1C3A2A24418D
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 67abe70c55ec61e33af18214595fea651f86862ef1f269ac78ae5d43d4d192f1
MD5 87c0ccb11514b40afc332172ef7c56c6
SHA1 cca566f55416494336f244e9a1d1a997fe10a08b
SHA512 7022d200a05f8b545e260607654491a2b74d91b557ec1a85cb1854d60bbc412d68ed6baa95604a9f544517c25dc3a1cb88f747a18eb8a390be828780a71448c5
TLSH
T1DDC02BD0AFD30223F01407FE55A11A399FA07523E442CF0D0FF1045CD9A491125B0C05
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 55d1b4fb6da4fd4bc2d564543a2fa1880ad4dc81385b1e985559101b702bc701
MD5 55e5a2af5b4fe8186b58b6cc01935b72
SHA1 744e96eaa15d47d52055ccd25bfd2bbc29b85f61
SHA512 078d689d292e7dc7f26127527bce6dcf43676956d8f0f7aa65ab3a1c050e353a674249de205278cea49a472aae648b7eeac2d09f44473b04780ab8555172a6d3
TLSH
T11ED02218AF140332F1A5833A409825C04FE0940EF0BECF681BE6001EC83DE023E2080F
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 4fb98733d21315006d53e9e07ffae662aae87165b34c00e8a74f25cbf4acaea9
MD5 e5b6755e5bb5fbb4588e8980e376a3e8
SHA1 1b4f6cdb62fff38b116836163489e36739fc1982
SHA512 a7004568b973a2b9beee6594cebb9e2da2ca19d4e83ad1c84e0d93a8a37612ee06cc00f038d0d34930cac1f128c03e55d573853ac990a1015300768f578cfb8e
TLSH
T13EC02BA8CB420223F01C43FE5A910DA84BA06A23F1827F091EF20D2E8D38B1264F4C02
MD5 SHA1 SHA512 TLSH

Submit Download

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 896B
SHA256 7a361f0beaaabd7539a2150d4354176deae196bc5acb8534b8b63ab930c54a49
MD5 0f2947b9be979b5865d39994913dd99d
SHA1 f153f9f2e6fc3d8629cca2d5443260c9d2a342cb
SHA512 d3f1a06ca6b96c3035f5453e56f4d65deeffed98812e1a787a99651025f89d15a3962954971a4d838caf78d71f032d87d497501858320abba866c403e3a4b333
TLSH
T17111C645781BA0742D513471E9CF42F737B1977D08951171B1C054CEB865F3606A7C25
MD5 SHA1 SHA512 TLSH

Submit Download

securitypack.jar

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security\securitypack.jar
Size 14KB
SHA256 8afd591de4090b5a11aa91a624b99895e87e0769c25f3e3ed02f28c5ead5b661
MD5 f828a6a7fd89d0b0cfbf65470c3afddd
SHA1 92cbd8debd889363b14f0619f2640a5becfecc64
SHA512 f29f9ba05da60e0b0a64b024c4ce6bfa55d112ed2afa4abbd083655e335303e553158a659dd63f623ebc6390d72eabf00574e35eb3b4b69683bf9b1c5ed2b6e9
SSDEEP 384:/Cg/yCOi9he06A8BKXpM2kaC2NJb2LEPga9Au501luvuQ:WyhbIWLC2bb2qga9qsl
TLSH
T10462C0542FD9F1BAFD890ABF6B927481F9CF873B3318933A2A207C817948C548745549
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jucheck32.exe

Path C:\Users\Admin\AppData\Local\Temp\jucheck32.exe
Size 1.2MB
SHA256 1889ff3c62ca9675cd1e364f44f92b1142d4d004f143f602ac2eaa3db237cd26
MD5 006622c7269d5b9466813dce3b940726
SHA1 12ca640590d35526082d4ccb0465b10e38c72c3d
SHA512 55f256b2468a74f0a1ef93c46e56ba9470f2197982b085505000069ce9835382a767f304de1c84ea349b66eb60f177d87ad90eb914bfa8585a76ee6b0e60812b
SSDEEP 24576:uoMOW0n7Ubxk/uRvJqLGJLQ4a56duA/85RkV4l7/Zj:r4iwwGJra0uAUfkVy7/Zj
TLSH
T197457B2176D58036F2B32731687C92645A3AFCB2993A854F73CC666D1F30A818E35B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 165KB
SHA256 cabd8e9b84692e71365cd16ca43a1e8f7fe1079fa803a6e06118aa55edd7418e
MD5 f7f27f3a498f24fb31539bef1b1468d8
SHA1 07de7583f5e3d5aa55a02640748703932a2cb4af
SHA512 edd59573b9f99bb848f4add21314cc12c6cec48c8c5d1a16d4cc4351ecd7f83b771f004a69ff33ff5d1559c48820d817f994205789563f2ad58cd769fcbdb558
SSDEEP 3072:IOGZ1sLUm/rRQRcF6w5TSpwG+x/MM6d1SM/TWdsAGs7:qA9F
TLSH
T138F34297893D48FA34530BF7C7AA5CA48566670B435E0A1831CF82DEB445D0786BE8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 12KB
SHA256 9d99370d76f1b73fd4f6917b4c3c8d7d16994c60aa5d3411508a543edc95e06f
MD5 cd4c4f43e5e58e6b47094def83fe3850
SHA1 9426c9e08f6932290f6d6383c56858d1ef4f1c91
SHA512 495085613cd32563d3202db35be87d8f237d97fb365e4af5cd8dafb510632277bbf476c708a5f97cb73a4dd6c0c791e27ba96b5fa3e54b34d657a3bbcafa11cc
SSDEEP 192:j0QmVe+k2IUPnOlV4o73QbyRON1A06OmtzIYCD6Mk1g+dJHICxbN1thfTizw36j:j0QmVez2PnxhbyO+OmtzIYu6MklE
TLSH
T10142D67B5821842225F1519F7BBF7208E026F20B9541DCD1BE8C43051F927ABE572E5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 209KB
SHA256 646ee784a112a1080705b6e294d67e4668c792d47e16b241c7947f571cde1b58
MD5 3cb6aa38df4e665e189abd6f0663cca1
SHA1 4d6f1e9a39019985056ce4380f610ede2a1da271
SHA512 3e9d674736cde14d7c0fa5836cec15119afef2e5dba4b9d5a1cee778f23aa874851f0ba98fff76d25ee8d0db7676559ece0e1f65f88d5873d0140e69a312c53b
SSDEEP 1536:J2PHyOTCasJY2as2tv0RUGWhFOQpbHtp+wcQkM4cWSprWPnOEDkLZBtMascbfXNv:J4SOTa67XpWC6AZBtRbfBAwMW
TLSH
T17F24287153F009BA60C343A8BBA576697D66D14BF553D0ECF3AE42102F83D668837A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4704-310-0x0000011B63D50000-0x0000011B63D51000-memory.dmp

Download

memory/4704-349-0x0000011B63D50000-0x0000011B63D51000-memory.dmp

Download

memory/4704-367-0x0000011B63D50000-0x0000011B63D51000-memory.dmp

Download

memory/4704-430-0x0000011B63D50000-0x0000011B63D51000-memory.dmp

Download

memory/4704-431-0x0000011B63D50000-0x0000011B63D51000-memory.dmp

Download