Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/04/2026, 04:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-22_f81f17f8aabb271cd8620e666feb28ca_elex_emotet_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-22_f81f17f8aabb271cd8620e666feb28ca_elex_emotet_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys.exe
Resource
win11-20260130-en
windows11-21h2-x64
7 signatures
150 seconds
General
- Target 2026-04-22_f81f17f8aabb271cd8620e666feb28ca_elex_emotet_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys.exe
- Size 1.3MB
- Sample260422-e5y94sg12q
- SHA256 6626048bedbf7fe8d034995d853f34483e88f5987d17a401788d0a45932082d5
- MD5 f81f17f8aabb271cd8620e666feb28ca
- SHA1 03c0b32dfaecfb92a4bf6d4517e1922dbd94bba4
- SHA512 f6838aaa239e4e6491913bedc3627e6ad38b02fdc44d45b9169eed250ddf1c4a9e83c199477d51e623af3b516e722d465f1775a82dbd74fb03e87bd8affef0b7
- SSDEEP 24576:GDVmpzoEj5DrfzXdaxgAOZGspkqLCVHpZktAIn1brR7ZHFGjbhDZlnfiuWX8:GDkpzoiNXdaxgAOZDp/Avkz1brR1HF6V
- TLSH T18955F11075D08EB0E1BF593048B59AB09ABBFC304E3147DB63947E6C3E74980AA36767
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 4956 googleupdatesetup32.exe 1596 eventviewer.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\syslog.exe 2026-04-22_f81f17f8aabb271cd8620e666feb28ca_elex_emotet_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys.exe File created C:\Windows\SysWOW64\eventviewer.exe 2026-04-22_f81f17f8aabb271cd8620e666feb28ca_elex_emotet_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_am.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_fr.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_ja.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_ro.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_th.dll googleupdatesetup32.exe File opened for modification C:\Program Files (x86)\GUM4958.tmp\GoogleUpdateSetup.exe googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\GoogleUpdate.exe googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\GoogleUpdateHelper.msi googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_bg.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_hr.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_sl.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\GoogleCrashHandler.exe googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_vi.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\GoogleUpdateOnDemand.exe googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\GoogleUpdateWebPlugin.exe googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_bn.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_ca.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_lt.dll googleupdatesetup32.exe File opened for modification C:\Program Files (x86)\GUT4959.tmp googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_de.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_el.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_et.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_lv.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_te.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_da.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_es.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_iw.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\psuser_64.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_ru.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_sv.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_uk.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\GoogleUpdateBroker.exe googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_ar.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_fi.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_hi.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_hu.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_ms.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_ta.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_ur.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_gu.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_ml.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdate.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_id.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_kn.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_sk.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\psmachine.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_cs.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_mr.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_nl.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_sw.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_tr.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_fil.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_no.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_pt-BR.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_sr.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\npGoogleUpdate3.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_en-GB.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_ko.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_pl.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_zh-TW.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\GoogleUpdateSetup.exe googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\GoogleUpdateComRegisterShell64.exe googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\GoogleCrashHandler64.exe googleupdatesetup32.exe File created C:\Program Files (x86)\GUM4958.tmp\goopdateres_fa.dll googleupdatesetup32.exe - Program crash 2 IoCs
pid pid_target Process procid_target 5392 5292 WerFault.exe 83 5984 1596 WerFault.exe 85 - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-22_f81f17f8aabb271cd8620e666feb28ca_elex_emotet_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eventviewer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language googleupdatesetup32.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1596 eventviewer.exe 1596 eventviewer.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5292 wrote to memory of 4956 5292 2026-04-22_f81f17f8aabb271cd8620e666feb28ca_elex_emotet_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys.exe 84 PID 5292 wrote to memory of 1596 5292 2026-04-22_f81f17f8aabb271cd8620e666feb28ca_elex_emotet_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-22_f81f17f8aabb271cd8620e666feb28ca_elex_emotet_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-22_f81f17f8aabb271cd8620e666feb28ca_elex_emotet_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Users\Admin\AppData\Local\Temp\googleupdatesetup32.exe"googleupdatesetup32.exe "2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4956
-
-
C:\Windows\SysWOW64\eventviewer.exe"C:\Windows\system32\eventviewer.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1596 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 13123⤵
- Program crash
PID:5984
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5292 -s 19202⤵
- Program crash
PID:5392
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5292 -ip 52921⤵PID:5400
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1596 -ip 15961⤵PID:1816
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
- Size 204KB
- SHA256 3ce210501d29076f0694e46ed24de4640afaca04dc59a7d71dedfe77403976f8
- MD5 387e430ec3eec9e7ababee4583c7f2d9
- SHA1 2cdf52c7a819af35cbb515489fd6ec24df2165c2
- SHA512 989b81018e165f048e185f950e3f19eff9ee235e25e13026c775b2f6282ce42c7407f66ce291c0ead6d8d77a49c374eff1c4aea549f8290e27a0fd5ca029db2d
- SSDEEP 3072:JcXdu1Kax5DpY2Ge0Va02m7imzjXZx1BZ4mOwt2:JcX4gaG2G66Gmt2
- TLSH T137241A686CB7F061BCA99E924DD99AAA63E7BDF51721074F0E70AF502C03A97DF53400
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
- Size 246B
- SHA256 faf1da8b76291858ff551e1220d109ba4b7aa1a3300e9e6ff0ce621ccc217685
- MD5 86839c520678c46bd3c5745a65d1f6fa
- SHA1 cec84c7534c2332cab71d040172f454a65883f46
- SHA512 2895a82a265c5b702fd4c619a127b86b5888776de5b47ebdefd1f2efdc489b38d46420a171bdf330437c78d7c1e0a1ad24dbe6ef52f59e5cadea691276b59af2
- TLSH T1ABD012381FD10539E565C37984328542BFB57433B9B3AF6D11A4548B6822D150E76E4D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\googleupdatesetup32.exe
- Size 1.1MB
- SHA256 f91e258ea71dcbfc82371b2ee3e20852e45bef0cb946223d1141a6ef1dfb793f
- MD5 53baee50f7a69bf3bc0fffe25341a923
- SHA1 0b7998f5517ed4e7c5aeea3a89d73b60d2a2d102
- SHA512 0eb28032849f775f604b7064a4f00f7d802c8c2fd5c7bc21b48298e6c3d316286963794b4c6c4981199c21f56b08d9aa466a470d40738d1b633b7feddc8e6241
- SSDEEP 24576:pEj5DrfzXdaxgAOZGspkqLCVHpZktAIn1brR7ZHFGjbhDZlnN:piNXdaxgAOZDp/Avkz1brR1HF69HN
- TLSH T120351210B5E480B0F5F26F3454F895E05ABEFC3149788A5F6384196C1FB46C1BA3AB6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\eventviewer.exe
- Size 88KB
- SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
- MD5 188a727732ea436cedbfa4f016e7bbdf
- SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
- SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
- SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
- TLSH T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
- MD5 SHA1 SHA512 SSDEEP TLSH