f9b230e225937b762add6292ed2e31b58b3c349164727ec7f1efcc050e0c474d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_fe7fc4abd66102c774ffb397752f3ce9_elex_emotet_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe
Size 689KB
Sample260511-pe2yesht61
SHA256 f9b230e225937b762add6292ed2e31b58b3c349164727ec7f1efcc050e0c474d
MD5 fe7fc4abd66102c774ffb397752f3ce9
SHA1 52fd5fcb74e037c535be4daf0f51953853baf0fc
SHA512 79d569fdf7abb5205fd222b66856fbbe5a5d68831dedac46abc5f47e8cf80b4a4d17a307adc5e4ef49010dba36282ae08cc5c0b02f1bdcdfbc945cad60d78dc9
SSDEEP 12288:GaoVmp+wZ4Y4oyIJsMPrP5p6bYboEdNDiuWXI:GDVmpt8gVPrP5s+oEHiuWXI
TLSH
T12EE4380273E88635F2F71B319EB596614A7BBC619D35C38F23946E0D2D70A80DA35B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4452	setup32.exe
4804	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-05-11_fe7fc4abd66102c774ffb397752f3ce9_elex_emotet_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-05-11_fe7fc4abd66102c774ffb397752f3ce9_elex_emotet_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5752	4804	WerFault.exe	86
5416	4756	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_fe7fc4abd66102c774ffb397752f3ce9_elex_emotet_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4804	eventviewer.exe
4804	eventviewer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4452	setup32.exe
4452	setup32.exe
4452	setup32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 4452	4756	2026-05-11_fe7fc4abd66102c774ffb397752f3ce9_elex_emotet_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe	85
PID 4756 wrote to memory of 4804	4756	2026-05-11_fe7fc4abd66102c774ffb397752f3ce9_elex_emotet_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-05-11_fe7fc4abd66102c774ffb397752f3ce9_elex_emotet_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_fe7fc4abd66102c774ffb397752f3ce9_elex_emotet_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Users\Admin\AppData\Local\Temp\setup32.exe
  "setup32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4452
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 1428
    3⤵
    - Program crash
    PID:5752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 1636
  2⤵
  - Program crash
  PID:5416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4804 -ip 4804
1⤵
PID:5632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4756 -ip 4756
1⤵
PID:740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 734B
SHA256 2787067d45e7d1bfd4c464584bf72760dbe43cb8cb2d19a64b5045fba69679d1
MD5 417e1515abb2c4c688717634bf70377c
SHA1 b02330861433775b10e7ae74557911aa623c7fca
SHA512 e4105860e3acc34c85f95f58e5c4a2ca175161e01d5dbac5c6883b3ff165e4c66334618dad8dbda2470fe2438582a7b43c8020c686bdc364a05d7a1391d91e66
TLSH
T1890165E5F11C8404DDD749E0824DF64B5C6070687DF47C0A4143D06139587C5F25A578
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
Size 215KB
SHA256 ab036f3cfd34bf4c90e0423291e54b5ca2ccb3781c1e6d05222d33eed05f7084
MD5 783c6bcb155c93ef55770aba90b0999b
SHA1 928c8f7b9f9caaad6bc2f0582af72196f9406e61
SHA512 a4e42ff095f21b5c4b3a66df913ee88bda727c5bdbdaf30a9fc53922f818edf4d0f39d44f33c399a4a3b0bab25f3cfa9c6e8eb832687a0fd72c5580a45e74377
SSDEEP 3072:Gb5IiaFrgqmpKi9MZ/PXV+gX8eP6t0cmMHa16om:G0FrQpCnf6HC6om
TLSH
T1A4244C68AC77F161BDA98E924DE9EA9A63E7BDF51611030F4E70BF502C03A97CB57001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 61be0b6bc709fb633eb00d56c58cfdbfe3d6bf35d0831119d55833fa1244fcdc
MD5 e1cb88f3adf71d1880d5297412d8d4ef
SHA1 3c69708fa53dab356b2ba35e6b1aee703919d845
SHA512 31a7e7a32481ac0f02c8db46e71d25022bdae24c2f66bd1fcd81d1869606156dd79da6c3ef0ff527278863f4ee43d690acaac03f705d2f0203de1419edd4ce06
TLSH
T16BC08C080E9A0225E04403BA012089021A109414F28BEF0E0BB12A680966F211820CAF
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 815e49dea22ec1cd19429a3a05e68e5cb19b985e47d79868131f921276dfc324
MD5 2863fcb03c31383fe30d2d18d7c06694
SHA1 3c7eef1f8ed9453e4fa423da4116d9d9ac60065c
SHA512 470280421f0bc3b8746edcd0a832c9a39a63f8e5b16c4c3dc11e4d5ac02213874abb8a19bd29901f42cf74cb02f02cf1764a1c929d99f9c6e1bfb7f2bd87f247
TLSH
T143D022282FD90234F326C736DAB44883CA114413BA68470B1223427E6831E020C12E0D
MD5 SHA1 SHA512 TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 107KB
SHA256 8fc315d9ef2b51c1101925e122f8dfe3522eaca5449773e8762c1b82d04b3f22
MD5 e40f9a48b58c7d5d391a5789bbce0d70
SHA1 b27ab6abacf114054043ea959cad3164bca0df02
SHA512 ae0b0f5c162b12c16ba5b0ba9a696f26948cdaa4f4013fe00bda57fcdced3ae16036fdbfe8ac5ef5d39363e04a939dc05d81a3cfbb7f0ace4ca3327b56d0450e
SSDEEP 1536:ZJqwy75UhaasJD0gLFOQpbHtphwSHPPnOED4LZFasOtN9WlQH:SDwiXpxvMZ+tH
TLSH
T1E2B32A7163F00ABA60C343A47B647A597E55D18BE113C1ECB3BE12516F83DB28C37A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup32.exe

Path C:\Users\Admin\AppData\Local\Temp\setup32.exe
Size 452KB
SHA256 608c5265075bacf05353a4d816fe815ec1ba2e95bb88313d5cf38655274841be
MD5 276c1b7f46b8488344e85387c9ce6e80
SHA1 2901f43aa439f48baf786018696546e580ba9880
SHA512 5e02be9cfd27c3de2e17618958c5b82b38ef402ca59c260a1c93e2b0ac30871be29f43b3f160c8adb9c56061f5138db33a07e172c7c445c62fe0cd78f5fd1c8f
SSDEEP 6144:voyZmTAsfJFakxaLjcMkc0Cax1P8Gp6bYA0w601+dNT9/0626ASkVOAFK:voyIJsMPrP5p6bYboEdNJ
TLSH
T1AAA4190277E89135F2F31B31AEB592615A7ABC719D35D20F23D41A0D0DB0A90EA79B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4452-9-0x0000000000920000-0x00000000009DF000-memory.dmp

Download

memory/4804-18-0x0000000000540000-0x00000000005FF000-memory.dmp

Download