c4196664605b1bf1c8fa1095b87821d091ad13775b92bce59ea07150f76ee90b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_c0a6ed5ad36b486cf918119480145c75_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe
Size 2.0MB
Sample260511-ctnccsat2w
SHA256 c4196664605b1bf1c8fa1095b87821d091ad13775b92bce59ea07150f76ee90b
MD5 c0a6ed5ad36b486cf918119480145c75
SHA1 a6ccdd0207ece85387c23558a94cb9a4eed5ceac
SHA512 f86deda612bcc14df21c44c443548fd040af3e65e685e649977f3098c2245ed8dde004c5eb13deba34f2ca36d9beb48f70ddc9876bbe128a78173c87f6b14753
SSDEEP 49152:GDWbaWpY4xmvrpBiZ5s5ISOLvepwD41y/AIqNDTHJDYCaz4tVxtNFiT:GDWbtQBiZ5s5IDepwM1y/AIqNVw45JiT
TLSH
T1D3A58D1276D5D036F5B312319DB9922899B6BCA18A35849FB3DC271E4F706D18E32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1084	javasetup8u18132.exe
2504	eventviewer.exe
2036	javasetup8u18132.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-05-11_c0a6ed5ad36b486cf918119480145c75_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-05-11_c0a6ed5ad36b486cf918119480145c75_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3840	3464	WerFault.exe	85
1736	2504	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javasetup8u18132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_c0a6ed5ad36b486cf918119480145c75_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javasetup8u18132.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2504	eventviewer.exe
2504	eventviewer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2036	javasetup8u18132.exe
2036	javasetup8u18132.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 1084	3464	2026-05-11_c0a6ed5ad36b486cf918119480145c75_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe	86
PID 3464 wrote to memory of 2504	3464	2026-05-11_c0a6ed5ad36b486cf918119480145c75_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe	87
PID 1084 wrote to memory of 2036	1084	javasetup8u18132.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-05-11_c0a6ed5ad36b486cf918119480145c75_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_c0a6ed5ad36b486cf918119480145c75_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Users\Admin\AppData\Local\Temp\javasetup8u18132.exe
  "javasetup8u18132.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Users\Admin\AppData\Local\Temp\jds240645875.tmp\javasetup8u18132.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240645875.tmp\javasetup8u18132.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2036
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 1920
    3⤵
    - Program crash
    PID:1736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 1216
  2⤵
  - Program crash
  PID:3840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3464 -ip 3464
1⤵
PID:2272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2504 -ip 2504
1⤵
PID:4800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 734B
SHA256 2787067d45e7d1bfd4c464584bf72760dbe43cb8cb2d19a64b5045fba69679d1
MD5 417e1515abb2c4c688717634bf70377c
SHA1 b02330861433775b10e7ae74557911aa623c7fca
SHA512 e4105860e3acc34c85f95f58e5c4a2ca175161e01d5dbac5c6883b3ff165e4c66334618dad8dbda2470fe2438582a7b43c8020c686bdc364a05d7a1391d91e66
TLSH
T1890165E5F11C8404DDD749E0824DF64B5C6070687DF47C0A4143D06139587C5F25A578
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
Size 215KB
SHA256 717982247068f79ceff17d9a94d84a3d21f3dc85d337744b75d9fd34bbafad98
MD5 083ff74028c735d8d04662eed477cd0b
SHA1 a38c3f6ac6424f10b1b93b754637a7d63605761a
SHA512 9449c33297da721b424d967381944df1e658cdad8f1b8e3f810ed44ec13aa9896b4dd4c44f0b87cb5176f72a78177bfc9e489b7285030b25c2f07ce707aa435e
SSDEEP 3072:Lb5oiaFrgqmpK92MZ/PXV+gX8eP6t7EmMHpZJXU:LYFrQpcnQiHHJXU
TLSH
T101244C68AC77F161BCA98E924DE9EA9A63E7BDF51611030F4E70BF502C03A97DB57001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 f1f943c838edb4635f0720536544f367cbe5e66432f09621f139deef8a74210b
MD5 a1963e83f355452ee739b4152d2d32df
SHA1 bce41028ecb1b911366341b32b1e33db444f2e5e
SHA512 e2f515b96adca6d55092dd674a1fd2ed6de271b2697fe976d7386e02d832cf1c1c448e46ce2966b8667729889b4dff10bfa110d83ffc90297267fd8c241e2093
TLSH
T17DC0920CAF660326E24807BF856112426960A501E295AB5F04F626685AA6B122920EAA
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 603ac3e978a023a02055dfac010b4de9042d9e00257ef160c5826a0c3a1faef4
MD5 4c33297289ea669c897b3044bad7728e
SHA1 9daf8407e6a9e4b1da3892c1c2345c05b1626cbd
SHA512 fff0dc8008ed96bc9e77c8390283aff2589562f1ee19293a151d1c5b0142519a5f2d8c8c4556083cba9520c790c03bf13fa81e6b5beabc56a663fb8be9c60554
TLSH
T113D0223C0B300B3AF130C33AE8A982030E505413BAB14B0514B3070CACA2F260C90D08
MD5 SHA1 SHA512 TLSH

Submit Download

javasetup8u18132.exe

Path C:\Users\Admin\AppData\Local\Temp\javasetup8u18132.exe
Size 1.8MB
SHA256 a8fb1a1473831ac6feb092afd2cbdded2d6a881d3576158fabd89090050b52f8
MD5 544e07d620d3108b9b6aa3384d02dea5
SHA1 9897596f3c4ec39e38ef7f1081783db7693ae0b2
SHA512 3663b9c056447c4491635b5bdcbc6e1a2b67a432b41bab6f479da5c787c48f1067cecafdfb6d9763f9b17b553aa953ae87068ba7f0c1c93facf34db7ac53a64c
SSDEEP 49152:+WpY4xmvrpBiZ5s5ISOLvepwD41y/AIqNDTHJDYCaz4tVxtNz:JQBiZ5s5IDepwM1y/AIqNVw45H
TLSH
T14D958D1276D5D036F5B312319DB992289976BCA28A39849FB3DD131E4F706D18E32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javasetup8u18132.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240645875.tmp\javasetup8u18132.exe
Size 1.6MB
SHA256 394ad6212e4866cc8e6d1834df8f70538dddf09d23dfa65ea204b22c012b541a
MD5 109cbe148f827137c3ba62261f01b29b
SHA1 2cc02b09da46d9e5d0ac1b306a0bbcc12bfe4c12
SHA512 a2dfa03dd290540bcfeda6cfd7d6ed891700742b4323d8c8dbfc4c822386ef1ddfff5cf71b2e5d7be9ec72fb6fc2145ff6ffc440823187d6956d5aa2794c5799
SSDEEP 49152:VxmvrpBiZ5s5ISOLvepwD41y/AIqNDTHJDYCaz4tVxtNJ:VQBiZ5s5IDepwM1y/AIqNVw45F
TLSH
T179758D1277E59135F5B313319D7992285576B8A28A3984EFB3DD021E8F70AD18E32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 172KB
SHA256 198cd273d3cf3b76744463527d2d1dd756b33ea84447a36688bc1df7c7909e00
MD5 9b997548649c1ffba6768930e6eb0b29
SHA1 a0b10d1dcf14ca155895cfaba80e617872dec24c
SHA512 53f637da2e75ce253d8967504a7517deef46c5080b6d0d26673c813d10209ac3802b17f2295676fc5c8bf52aa37aaf7b08c1a3caf212c3ec9a63bc4754dfa6db
SSDEEP 3072:MaC/vQnYyLjAEarFXX5QdR1z8oSttXy/ONQC+p7doXM:n3zx
TLSH
T199041157D93E41BF20234AC783BA7DA46556660F53DE4E1C32CF82CE6445903CA6E8EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 176KB
SHA256 3752f2e8fa3bf3271762cae430aeb0fbc517217aa63fe90a06c022929033e4ac
MD5 f14772287efd054abb8e284f32328f03
SHA1 0c4ba52bcfc375819b3fc3db912f3bfd347d80f4
SHA512 8d2e750ddfebbb152dfab1bdd537420fb32de9a16a31a30338514d0a1f3a50a83933417e0095c5e990f59d1883f2697d30550b4471bc3574360ef4fcb0e8f37e
SSDEEP 3072:MaC/vQnYyLjAEarFXX5QdR1z8oSttXy/ONQC+p7doXN:n3zs
TLSH
T1C1042357D93E41BF20234AC783BA7DA46556660E53DE4E1C32CF82CE6445903CA6E8FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 107KB
SHA256 8fc315d9ef2b51c1101925e122f8dfe3522eaca5449773e8762c1b82d04b3f22
MD5 e40f9a48b58c7d5d391a5789bbce0d70
SHA1 b27ab6abacf114054043ea959cad3164bca0df02
SHA512 ae0b0f5c162b12c16ba5b0ba9a696f26948cdaa4f4013fe00bda57fcdced3ae16036fdbfe8ac5ef5d39363e04a939dc05d81a3cfbb7f0ace4ca3327b56d0450e
SSDEEP 1536:ZJqwy75UhaasJD0gLFOQpbHtphwSHPPnOED4LZFasOtN9WlQH:SDwiXpxvMZ+tH
TLSH
T1E2B32A7163F00ABA60C343A47B647A597E55D18BE113C1ECB3BE12516F83DB28C37A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download