5595c124ec7bf1c31191426f7bf245b6aa44cd63049b2e8463e9b5e1579d3f9a

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/10/2026, 16:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-21_996203c235f193e1ded3871cd2a3095d_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe
Size 2.0MB
Sample261022-tl5ecasses
SHA256 5595c124ec7bf1c31191426f7bf245b6aa44cd63049b2e8463e9b5e1579d3f9a
MD5 996203c235f193e1ded3871cd2a3095d
SHA1 5b3150195cf3428a3c3b5af64d1f3fb37266f375
SHA512 1bc3cb13d2f6f381dc7907950617f994e0389341a0352c3cc01f970af680233ba7fc92aaff64f0655f9f40266fea60a1531d5004bae3d9d93a1c7ad1330cc398
SSDEEP 49152:GDWbaWpY4xmvrpBiZ5s5ISOLvepwD41y/AIqNDTHJDYCaz4tVxtNFih:GDWbtQBiZ5s5IDepwM1y/AIqNVw45Jih
TLSH
T181A58D1276D5D036F5B312319DB9922899B6BCA18A35849FB3DC271E4F706D18E32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4552	javasetup8u18132.exe
4592	eventviewer.exe
4520	javasetup8u18132.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-10-21_996203c235f193e1ded3871cd2a3095d_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-10-21_996203c235f193e1ded3871cd2a3095d_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3780	4592	WerFault.exe	86
1808	4500	WerFault.exe	84

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-21_996203c235f193e1ded3871cd2a3095d_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-21_996203c235f193e1ded3871cd2a3095d_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	javasetup8u18132.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	javasetup8u18132.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javasetup8u18132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-21_996203c235f193e1ded3871cd2a3095d_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javasetup8u18132.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4592	eventviewer.exe
4592	eventviewer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4520	javasetup8u18132.exe
4520	javasetup8u18132.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 4552	4500	2026-10-21_996203c235f193e1ded3871cd2a3095d_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe	85
PID 4500 wrote to memory of 4592	4500	2026-10-21_996203c235f193e1ded3871cd2a3095d_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe	86
PID 4552 wrote to memory of 4520	4552	javasetup8u18132.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-10-21_996203c235f193e1ded3871cd2a3095d_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-21_996203c235f193e1ded3871cd2a3095d_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Users\Admin\AppData\Local\Temp\javasetup8u18132.exe
  "javasetup8u18132.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Users\Admin\AppData\Local\Temp\jds240724281.tmp\javasetup8u18132.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240724281.tmp\javasetup8u18132.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4520
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 1276
    3⤵
    - Program crash
    PID:3780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 1316
  2⤵
  - Program crash
  PID:1808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4592 -ip 4592
1⤵
PID:2460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4500 -ip 4500
1⤵
PID:3844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 184KB
SHA256 e2648aa3bb593ed1a5f1992fc0b194af0d4514af128bf9faab5ee55f371166e0
MD5 268fd0794491cfadbbd737e36b42b876
SHA1 2247d0d67bd84df88bc9e9c6407b16b157dc50d3
SHA512 f3e7e3c948d072d4973e20d29f33d2072b361955c808474fb9ede22356f1ce8e1a7403da505b0f600c805386a062bd7f5be952b82ca36dc6609c19f062dc7a6b
SSDEEP 3072:84G6hu77eAZfwGwysx+Ny12dvyqDPguXpzdNkPCcUf:B7pRXN2d6qDYuZ5OPjE
TLSH
T1F1042E282DBBB1619F0ACDE14C9AAE5613FD71DF21123F1B4EB56E901D43ABB8E17440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 814792d1c8fb4329597b93295396f33ff89da207d832d8ff715512f0aac8ad8c
MD5 d1e70847673a5e3727fc907cc3d4ac78
SHA1 4c134f3f8d68d85cf0c75c4a8a2c9b85b021e6ee
SHA512 b76287eb1ccd94a5ba2575c728a15b90d4d005990e4de2b712e00cf8288be1a0bb788e15f73e6989ddb4487cb9061c49792482e3f37981b096f822c24c2c2d64
TLSH
T1BEC022082E838A08F288033C028032028B808200E0808F8A0AF20A08A22BA0C3830C2A
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 70d7da030e9b39f2c579d1392b9289605447e0c33f3b2763550b89500e10f570
MD5 3f9dfafb50340cfe11fc71fa5e98685c
SHA1 7f88eaac969ced162c9181ebca080ba9331d575e
SHA512 dadd749fba68be5d6bc02c35e30ae6a0669a03363e464683aeaea7ec658035d901717bab770e9413f8eacaf659374394e81bb947a606bf54c038d5fb5182447b
TLSH
T159C08C1C1EA24A0AF6A8437C02C13A039B608101E2418F451AF12A08D99AB1A2838C2A
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 52df6d5f965a25d5f5b60ef1a72d44ffe3f700174effd6ce786bf874e54af003
MD5 626bba472d8cee7006cf7a35b3c3c377
SHA1 d37393fd1db52210be22e33850ba41cbb171b6d4
SHA512 70087c701b7f8199c829a7866e26c7b98ac501449e7068b6a3c937152c7de452ede94416832bdd6ca278b50d9b036aa062a8f9f954b8abe4def4d726081c7147
TLSH
T1A8D012759F990266F128BBBBE9504E902AE45603B6C19B4B1B701A48682EF8D1DA0C1B
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 9c37d95da8745837b94eb931fadd14408115872c8f14183f9507f64d8a607a72
MD5 825fba1135cb2a5d706e08677eaf7dba
SHA1 312be37631ce9494f71d0804d67acfdc8842a2b0
SHA512 df21b686e99f006a32175fa93b12b963ecf1a5a5971c6bb37fcb3153178fb317fc603e5ba4d09e7331e41c55cde83b44e74189689aaa45c64fd03ab26e9f3b4d
TLSH
T190C09B0C5F514215F188577912515181CA545621F5916B5515B6060C953AF062470D55
MD5 SHA1 SHA512 TLSH

Submit Download

javasetup8u18132.exe

Path C:\Users\Admin\AppData\Local\Temp\javasetup8u18132.exe
Size 1.8MB
SHA256 a8fb1a1473831ac6feb092afd2cbdded2d6a881d3576158fabd89090050b52f8
MD5 544e07d620d3108b9b6aa3384d02dea5
SHA1 9897596f3c4ec39e38ef7f1081783db7693ae0b2
SHA512 3663b9c056447c4491635b5bdcbc6e1a2b67a432b41bab6f479da5c787c48f1067cecafdfb6d9763f9b17b553aa953ae87068ba7f0c1c93facf34db7ac53a64c
SSDEEP 49152:+WpY4xmvrpBiZ5s5ISOLvepwD41y/AIqNDTHJDYCaz4tVxtNz:JQBiZ5s5IDepwM1y/AIqNVw45H
TLSH
T14D958D1276D5D036F5B312319DB992289976BCA28A39849FB3DD131E4F706D18E32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javasetup8u18132.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240724281.tmp\javasetup8u18132.exe
Size 1.6MB
SHA256 394ad6212e4866cc8e6d1834df8f70538dddf09d23dfa65ea204b22c012b541a
MD5 109cbe148f827137c3ba62261f01b29b
SHA1 2cc02b09da46d9e5d0ac1b306a0bbcc12bfe4c12
SHA512 a2dfa03dd290540bcfeda6cfd7d6ed891700742b4323d8c8dbfc4c822386ef1ddfff5cf71b2e5d7be9ec72fb6fc2145ff6ffc440823187d6956d5aa2794c5799
SSDEEP 49152:VxmvrpBiZ5s5ISOLvepwD41y/AIqNDTHJDYCaz4tVxtNJ:VQBiZ5s5IDepwM1y/AIqNVw45F
TLSH
T179758D1277E59135F5B313319D7992285576B8A28A3984EFB3DD021E8F70AD18E32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 163KB
SHA256 2e894a3c2f3758141598d4313285ec0ba55e41db5a74185e17d63a62bf6e5683
MD5 6f9ac1725c8fd13ab034a2363ecf61bf
SHA1 8cd0af3ea3579dac57f508f69e7ec21ec60635e7
SHA512 f57de8957fb8537aab47af95dbde193b7452ad728eee50a3bafef92736abfb343648369242bf17a69e46a2d815c6d51badc9e9e18cd47ea334894240907c3525
SSDEEP 3072:zrXswyhNcDEi0iKok1hxpViXtP9sT1aak7TAVk+qz6mf6x:lBTq
TLSH
T1ECF375C7896D44FB34130BE7C3A96C5416632A2D536E4A1D31EF96CEE444E03C66E8EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 165KB
SHA256 81e3285758f2cd1a1e2b3bfcac3b47d9f80708d9275f0e23ab7152dd5ce2fb36
MD5 9549c863cb3e628e0c3692ab56ea297e
SHA1 4234765f7d9fdbecdd29a29678e4e2205d4f39cf
SHA512 3ee78b791fb16e6b0316a019943cec80ccdcbc3932ad0b7c61ff4a6a2c19bffab5f8324123e5793a116e67410a133d09aee04e9dff71ee8e84e7a1254ea5121a
SSDEEP 3072:zrXswyhNcDEi0iKok1hxpViXtP9sT1aak7TAVk+qz6mf6x:lBTI
TLSH
T19BF375C7896D44FA34130BE7C3A97C5456632A2D536E4A1C31EF96CEE444E03C5AE8EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 12KB
SHA256 6d93dd0efa540720a384317776ddf43b0725c165b9f4bbe86d9c9cbce7377934
MD5 43a59cfd1ea018876f5f1a53138065e5
SHA1 48a6e2cc7aba810b3e37c267452c0d1523d89679
SHA512 c000c12330250d478fb205c19e1bb22e3f0e8c560ab8257daf61a1b3fae0c977534157044b0e1478a4b9f979e3a92393729a952027b952ed79d4d01ae51b2547
SSDEEP 192:t4QmVi+k2IU4OlV4o73QbyRON1A06OmtzIYCD6Mk1g+dJHICxbN1thfTizw36Hs:t4QmViz24xhbyO+OmtzIYu6MklJ
TLSH
T15A42C57B5826842226F1515F7BBFB208E026F2079541DCD1BE8C43051F927ABE572F9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 206KB
SHA256 110a0f4b63d6a4268c3097822b8988e6c8c837ef772d3121bf1b27ef3a61b9bb
MD5 a11fb0dc39f60fb39e522e9c2d1ebf78
SHA1 d4cb611e05ea8bbb52dc787ae9da1b724523bd53
SHA512 8ff864c476b27de8e0d0d6b511b45199218e109ba0fadb1a8f03080359fa7af5548f03cbce9e375565dcea21dde95fcb20da6627a1ccb1685a252f4f3b40b9a0
SSDEEP 1536:/24HyOTCasJY2asmyv/RUUyhFOQpbHtp+wcQkM4cWSprqPnOEDkLZBtMascblXNv:/1SOTE6RXpWCmAZBtRb1BAwMW
TLSH
T19124287153F009BA60C343A8BBA576697D66D14BF513D0ECF3AE42112F83D66C827A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download