Analysis
- max time kernel
149s - max time network
133s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
17/04/2026, 01:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-17_5770e198fe6eef649634de02cf4c9e8e_elex_emotet_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-17_5770e198fe6eef649634de02cf4c9e8e_elex_emotet_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys.exe
Resource
win11-20260130-en
windows11-21h2-x64
7 signatures
150 seconds
General
- Target 2026-04-17_5770e198fe6eef649634de02cf4c9e8e_elex_emotet_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys.exe
- Size 1.3MB
- Sample260417-b2mkcsdv4p
- SHA256 e334f4fad62fc7793359bea1aca8e7292697e4d539ace383da800ca44f1dd523
- MD5 5770e198fe6eef649634de02cf4c9e8e
- SHA1 79db59524516d1a08b5921dde76b9be631cb242a
- SHA512 fcf7865420dc4b15002ee467c6e13ea18f55c19e17f44fba755acc8bf21a12f52cf1babb37764e960f3d889277effcf2a4b1ce807db34b302abaa4aafc8ed3e2
- SSDEEP 24576:GDVmpzoEj5DrfzXdaxgAOZGspkqLCVHpZktAIn1brR7ZHFGjbhDZlnfiuWX3:GDkpzoiNXdaxgAOZDp/Avkz1brR1HF6O
- TLSH T14F55F11075D08EB0E1BF593048B59AB49ABBFC304E3147DB63947E6C3E74980AA36767
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 5148 googleupdatesetup32.exe 988 eventviewer.exe - Loads dropped DLL 10 IoCs
pid Process 988 eventviewer.exe 988 eventviewer.exe 988 eventviewer.exe 988 eventviewer.exe 988 eventviewer.exe 988 eventviewer.exe 988 eventviewer.exe 988 eventviewer.exe 988 eventviewer.exe 988 eventviewer.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\syslog.exe 2026-04-17_5770e198fe6eef649634de02cf4c9e8e_elex_emotet_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys.exe File created C:\Windows\SysWOW64\eventviewer.exe 2026-04-17_5770e198fe6eef649634de02cf4c9e8e_elex_emotet_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\GUM460D.tmp\GoogleUpdate.exe googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\GoogleUpdateHelper.msi googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\psuser_64.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_de.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_fr.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_ro.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_ta.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_ur.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\psuser.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_ca.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_iw.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_pl.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_pt-PT.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_zh-CN.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_el.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_en-GB.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_is.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_ko.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_sk.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_vi.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_zh-TW.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_cs.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_fi.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_fil.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_ja.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\GoogleUpdateComRegisterShell64.exe googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_am.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_sw.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_pt-BR.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\psmachine.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\GoogleUpdateCore.exe googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_bn.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_gu.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_hi.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_hu.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdate.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\npGoogleUpdate3.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\GoogleUpdateBroker.exe googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\GoogleCrashHandler64.exe googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_it.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_hr.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_id.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_lt.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_te.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_tr.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_nl.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_ru.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_es.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_fa.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_ml.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_sv.dll googleupdatesetup32.exe File opened for modification C:\Program Files (x86)\GUM460D.tmp\GoogleUpdateSetup.exe googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\GoogleUpdateWebPlugin.exe googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_ar.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_sl.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\GoogleCrashHandler.exe googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\psmachine_64.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_bg.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_es-419.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_kn.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_lv.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_uk.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_en.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM460D.tmp\goopdateres_mr.dll googleupdatesetup32.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language googleupdatesetup32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-17_5770e198fe6eef649634de02cf4c9e8e_elex_emotet_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eventviewer.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 988 eventviewer.exe 988 eventviewer.exe 988 eventviewer.exe 988 eventviewer.exe 988 eventviewer.exe 988 eventviewer.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4320 wrote to memory of 5148 4320 2026-04-17_5770e198fe6eef649634de02cf4c9e8e_elex_emotet_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys.exe 79 PID 4320 wrote to memory of 988 4320 2026-04-17_5770e198fe6eef649634de02cf4c9e8e_elex_emotet_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-17_5770e198fe6eef649634de02cf4c9e8e_elex_emotet_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-17_5770e198fe6eef649634de02cf4c9e8e_elex_emotet_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\googleupdatesetup32.exe"googleupdatesetup32.exe "2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5148
-
-
C:\Windows\SysWOW64\eventviewer.exe"C:\Windows\system32\eventviewer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:988
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B3C0310C2EA810C48E449EA75059E8A
- Size 493B
- SHA256 41bf1a0ac518d6992a61adb4a88dba4f69af360dcd3f252ed10ba92d214be2b5
- MD5 d1c2ba3858158bf130071448aff874c3
- SHA1 60231ea1987748872884fa4beaaf3966fa3987a3
- SHA512 774027d45f6c0e7ba1aad00103a6fde4208943c390d95dedade2c1e65dacf36760a905432e0d5f1446f294dd7cee4dada549c86d410c95f60d297255e77b4633
- TLSH T1BBF0C961A79C390327F03D1663C2D41FDD70528005807E4C22E0419468457F0A980ACB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B3C0310C2EA810C48E449EA75059E8A
- Size 248B
- SHA256 9ad9d973777ac932b1a73ee956857fc5afb07349b53297c0e408a8c1ea6152f1
- MD5 2721c3c9c19408bdeced5dfe4230e864
- SHA1 ae27592149c31ad56ffdd054847b06b8cdc11f20
- SHA512 c5feb4ef8a391423894e3b2a97c501b6c37d6632b4a99cea44acef472de27c30802e15a756ef6727a57176ff1cfe3c053d2981fc2c0104db2e326aaf4d4d4513
- TLSH T1B7D0221D23A22216F07C8332D8914E0BAB70600274E18B06013A030DBC56E132C23C0C
- MD5 SHA1 SHA512 TLSH
2026-04-17_5770e198fe6eef649634de02cf4c9e8e_elex_emotet_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys.exe
- Path C:\Users\Admin\AppData\Local\Temp\2026-04-17_5770e198fe6eef649634de02cf4c9e8e_elex_emotet_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys.exe
- Size 1.3MB
- SHA256 e334f4fad62fc7793359bea1aca8e7292697e4d539ace383da800ca44f1dd523
- MD5 5770e198fe6eef649634de02cf4c9e8e
- SHA1 79db59524516d1a08b5921dde76b9be631cb242a
- SHA512 fcf7865420dc4b15002ee467c6e13ea18f55c19e17f44fba755acc8bf21a12f52cf1babb37764e960f3d889277effcf2a4b1ce807db34b302abaa4aafc8ed3e2
- SSDEEP 24576:GDVmpzoEj5DrfzXdaxgAOZGspkqLCVHpZktAIn1brR7ZHFGjbhDZlnfiuWX3:GDkpzoiNXdaxgAOZDp/Avkz1brR1HF6O
- TLSH T14F55F11075D08EB0E1BF593048B59AB49ABBFC304E3147DB63947E6C3E74980AA36767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\googleupdatesetup32.exe
- Size 236KB
- SHA256 db1f5334d6df662aab0a0bab559457c87c6ec7b0a29071b12bc7908bb15f30a0
- MD5 55b9293fa96bf81b1789555f1457e214
- SHA1 64cb9291909544d3c51d7b2117a256f73fda1de1
- SHA512 7a3c9af47e01043e6eeb86b072d87e0c54b415fdbe861e7e806e335af6e8df3e6aa3256de01677a11da4ad81cd890ca9fe1690000bfd5cd2a09ba753691f62d1
- SSDEEP 3072:Gl5DVnMvbOU6VAYD6eS91So1ja6H5nj+CB5XIYnQbiYV0OZNjrc1F+QUQoRlI0zz:GjuDOhVLS5nj+CPXIYAiuW1FXEGC
- TLSH T1B4347B1236D08FB5E1AF40314DA25B7987BBFC305E2197CB67A0BE5D3D319808A2A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\googleupdatesetup32.exe
- Size 1.1MB
- SHA256 f91e258ea71dcbfc82371b2ee3e20852e45bef0cb946223d1141a6ef1dfb793f
- MD5 53baee50f7a69bf3bc0fffe25341a923
- SHA1 0b7998f5517ed4e7c5aeea3a89d73b60d2a2d102
- SHA512 0eb28032849f775f604b7064a4f00f7d802c8c2fd5c7bc21b48298e6c3d316286963794b4c6c4981199c21f56b08d9aa466a470d40738d1b633b7feddc8e6241
- SSDEEP 24576:pEj5DrfzXdaxgAOZGspkqLCVHpZktAIn1brR7ZHFGjbhDZlnN:piNXdaxgAOZDp/Avkz1brR1HF69HN
- TLSH T120351210B5E480B0F5F26F3454F895E05ABEFC3149788A5F6384196C1FB46C1BA3AB6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp307C.tmp
- Size 152KB
- SHA256 c8b8db63ea0d66c3212318e02ed65315212a565821b41e648b62125ce491a54b
- MD5 dd5645a32ccec6b1fd23a936699bc3d4
- SHA1 6007f779d59b92781fd44d97196ca742004f3cd7
- SHA512 22b48bb29f63a4b3aa2e44a2b88919e35a5ebf8a5e6c92d22f25f55e3bb08bc27420d2b33af15fc165989f2281d37c824b23cc574fc432c6aff05622af3157fd
- SSDEEP 3072:ul5DVnMvbOU6VAYD6eS91So1jaAMH5nj+CB5XIYNQp:ujuDOhVLAo5nj+CPXIYw
- TLSH T146E3481136D1CFB5E1AF44318DA25AA44BBBFC319D7297CB53903E0D3E359418A2A7A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\eventviewer.exe
- Size 88KB
- SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
- MD5 188a727732ea436cedbfa4f016e7bbdf
- SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
- SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
- SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
- TLSH T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\syslog.exe
- Size 148KB
- SHA256 0276c20790d9fa6b0607b29f632c72e8bb4a07e9495c9858730f8a0930f9237d
- MD5 c77a7e16f85637827514b13d5b586f76
- SHA1 05775016364462afafccc226268373de15956815
- SHA512 2d4732d8e49e8a7cec26d870973f331d8cdbc404349af37f730cd402a8e07123535e90e5d71484f86343d9662397b7488635ac159bc1611641222a08b1bed7a2
- SSDEEP 3072:Gl5DVnMvbOU6VAYD6eS91So1ja6H5nj+CB5XIYnQB:GjuDOhVLS5nj+CPXIYy
- TLSH T1B7E3481232D0CFB9E1AF45318DA29AB546B7FC319D3297CB63907E0D3E359418A26763
- MD5 SHA1 SHA512 SSDEEP TLSH