c8fe7d5f0ac5190de6d2503a085aba3072f04f9cadce3bd3e0493ed483c5b068

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-25_9197e788f98ce40ba29aceb4d3c0eb36_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe
Size 2.0MB
Sample261026-ypk74aws2r
SHA256 c8fe7d5f0ac5190de6d2503a085aba3072f04f9cadce3bd3e0493ed483c5b068
MD5 9197e788f98ce40ba29aceb4d3c0eb36
SHA1 3b277c925beecc6c99900648fb002da68e9179a4
SHA512 61f2e262e578428bb43b78ddc45d1d0e6feb65764f62086769549af6dcbaf3d0ae463e73b4b0ccb9af5f8b5d1e45ed5863ead0f624b3e9636eb1d19140684c50
SSDEEP 49152:GDWbaWpY4xmvrpBiZ5s5ISOLvepwD41y/AIqNDTHJDYCaz4tVxtNFio:GDWbtQBiZ5s5IDepwM1y/AIqNVw45Jio
TLSH
T1A0A58D1276D5D036F5B312319DB9922899B6BCA18A35849FB3DC271E4F706D18E32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2588	javasetup8u18132.exe
4788	eventviewer.exe
2660	javasetup8u18132.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-10-25_9197e788f98ce40ba29aceb4d3c0eb36_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-10-25_9197e788f98ce40ba29aceb4d3c0eb36_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2896	4788	WerFault.exe	89
256	5516	WerFault.exe	86

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-25_9197e788f98ce40ba29aceb4d3c0eb36_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	javasetup8u18132.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	javasetup8u18132.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-25_9197e788f98ce40ba29aceb4d3c0eb36_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javasetup8u18132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-25_9197e788f98ce40ba29aceb4d3c0eb36_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javasetup8u18132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4788	eventviewer.exe
4788	eventviewer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2660	javasetup8u18132.exe
2660	javasetup8u18132.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5516 wrote to memory of 2588	5516	2026-10-25_9197e788f98ce40ba29aceb4d3c0eb36_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe	88
PID 5516 wrote to memory of 4788	5516	2026-10-25_9197e788f98ce40ba29aceb4d3c0eb36_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe	89
PID 2588 wrote to memory of 2660	2588	javasetup8u18132.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-25_9197e788f98ce40ba29aceb4d3c0eb36_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-25_9197e788f98ce40ba29aceb4d3c0eb36_elex_emotet_glassworm_icedid_kwampirs_nymaim_remcos_rhadamanthys_stealc_tofsee.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5516
- C:\Users\Admin\AppData\Local\Temp\javasetup8u18132.exe
  "javasetup8u18132.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Users\Admin\AppData\Local\Temp\jds240799812.tmp\javasetup8u18132.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240799812.tmp\javasetup8u18132.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2660
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 1612
    3⤵
    - Program crash
    PID:2896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5516 -s 1484
  2⤵
  - Program crash
  PID:256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5516 -ip 5516
1⤵
PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4788 -ip 4788
1⤵
PID:5956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 193KB
SHA256 51907e9cdab6aef6490ed13ff27aad145efd9c5fe03782136e11e6e082b41f4f
MD5 d00261569d9c4cf79ba033c4916ea70f
SHA1 6e8257ef2d1856bf7408553a73bccffff7473b43
SHA512 a4e8ef2b953c4c1643e98c38ad575d1e250023c49d06212733d2f151ab8a91e069c6b30a06632e2cad6fe8d12f9ea6cb9d5d6060b69d88c0b59f770be9f4f78d
SSDEEP 3072:shnmUnAZMwGwQWxDrcZ0BAhnhJiZQ30DsMl1m+Jv:sZGxi0BinhkZBA0131
TLSH
T168140C286DBBB1619E0ACDE14CDAAE5612FD719F21027F1B4EF46ED01D43ABB8E17440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 31ba26dd9f289d03cfeac15012f50fbe7d791184aa4981d9f78ea996b62d0730
MD5 4ce255e14b38655a37b2f4067b9a6642
SHA1 10bd6bd171bbb526271367125fc7b2f1d0fe6fe3
SHA512 758ac7f0b9bcf673c5eff31bcb90a34822eb9687622abb75cf5b60b137056ec740d669cb6d4bf5b356fee103cb9cf7f065b5241860e75c549c86a2b862b6095c
TLSH
T19BC08C1C1AA21A0AF6A8837C02C239139B209101E2418F151AF22A08CAA6F162878C2A
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 b7c38c033283fbb65625c57fe8506f43664256084c9c405c12ab18c452ba1bc8
MD5 e179291384afb68d1eaa4fe01e729c0e
SHA1 bd33d70810672e894bc42d550843b415a2336b3f
SHA512 fd0fc3897c30383fa20f54e7ecfabad125b2c5541175e05b60ca469f5b7083ee6a14df18325c84319b3df828405d518ee0662917ae7e370bc4511607603f7e49
TLSH
T1D5D012181F530377F159073B08A167927AD56115E6D2A70A1F6D264CAA2CF700E55D0D
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 76d4d44eedc5425aaa6d0b1d098227af6808047512baa31c55d948f4ab5b41a5
MD5 7cf52cb742977effa2aee6969dc30c6a
SHA1 d277b559fdbe5e367aef44085edde54bc80f2196
SHA512 796cafe29a778e18f96f3165d6d691f5e67c3243557456dc286b6f1fe989fd090f183b6148f4195cb3faea21b23069565c85603522a77d038e411a1454b134cc
TLSH
T136C08C1C06610A0AF6A883B812C239838B218510F3819F112AB52B08DE24F122874C29
MD5 SHA1 SHA512 TLSH

Submit Download

javasetup8u18132.exe

Path C:\Users\Admin\AppData\Local\Temp\javasetup8u18132.exe
Size 1.8MB
SHA256 a8fb1a1473831ac6feb092afd2cbdded2d6a881d3576158fabd89090050b52f8
MD5 544e07d620d3108b9b6aa3384d02dea5
SHA1 9897596f3c4ec39e38ef7f1081783db7693ae0b2
SHA512 3663b9c056447c4491635b5bdcbc6e1a2b67a432b41bab6f479da5c787c48f1067cecafdfb6d9763f9b17b553aa953ae87068ba7f0c1c93facf34db7ac53a64c
SSDEEP 49152:+WpY4xmvrpBiZ5s5ISOLvepwD41y/AIqNDTHJDYCaz4tVxtNz:JQBiZ5s5IDepwM1y/AIqNVw45H
TLSH
T14D958D1276D5D036F5B312319DB992289976BCA28A39849FB3DD131E4F706D18E32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javasetup8u18132.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240799812.tmp\javasetup8u18132.exe
Size 1.6MB
SHA256 394ad6212e4866cc8e6d1834df8f70538dddf09d23dfa65ea204b22c012b541a
MD5 109cbe148f827137c3ba62261f01b29b
SHA1 2cc02b09da46d9e5d0ac1b306a0bbcc12bfe4c12
SHA512 a2dfa03dd290540bcfeda6cfd7d6ed891700742b4323d8c8dbfc4c822386ef1ddfff5cf71b2e5d7be9ec72fb6fc2145ff6ffc440823187d6956d5aa2794c5799
SSDEEP 49152:VxmvrpBiZ5s5ISOLvepwD41y/AIqNDTHJDYCaz4tVxtNJ:VQBiZ5s5IDepwM1y/AIqNVw45F
TLSH
T179758D1277E59135F5B313319D7992285576B8A28A3984EFB3DD021E8F70AD18E32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 f5de97cb94824bfa86db5a35c61b877390863aaf319c7b97b2d574710ceb1192
MD5 97dd243fe37a36b674fce19bfd214c0c
SHA1 a524543c1d72c6ceb15cb5c33fd4a37025cb055b
SHA512 ddcedfdbff78e3d94da0ebc93bd4d2d118d8849601d14d8f4699e4809934be88f8e08c85857361e69cecd018721188fffa6831010c742efd3065cecf3ab66533
SSDEEP 3072:YyDJ0BPPt3zWQAJdB9RqPrBXUMmpp7dyO0+keVWh3MtY:1X2z
TLSH
T120F37487C66E44BB30530BA7C37A9C585666171D935E4F1C61EF82CEE081E03C6AE5EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 984673b536b224c6bb21a130cbd454fab38711e8c61816cd56681cfe8f2ca586
MD5 48ddd736a28834198948dbf5affd27b0
SHA1 27d99ffd314f29cb59a148785c0dad2a80e3f73d
SHA512 d2ab67fdd78aa0dc0fd078cf309e095705ca74a82773ff38f8bc98953639751df05e882a840cc36eb79702783771a793e74dde11d2724c2fb3680285c5464d5e
SSDEEP 3072:YyDJ0BPPt3zWQAJdB9RqPrBXUMmpp7dyO0+keVWh3Mt1:1X2Q
TLSH
T110F37487C66E44BB30530BA7C37A9C585666171D935E4F1C61EF82CEE081E03C6AE5EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 12KB
SHA256 f1317ba1a9458bd3e0886a325da80bfe2e2f3f9cea0563859e46a220f2cd512c
MD5 9db4b61bc47c4facd47758cea3182eb0
SHA1 153cc8760566c8bcf5de84353ce75c3ddad52ecb
SHA512 5614a2b13d0a585543af717b83004c1e3520b7ef7d1fb3e760764da117a01ee933f3f304e3a0aee5268f6376ee5dff8fc0fa860961e0395a07b0cedb578c7f13
SSDEEP 192:huqQmVA+k2IU4OlV4o73QbyRON1A06OmtzIYCD6Mk1g+dJHICxbN1thfTizw36Hs:wqQmVAz24xhbyO+OmtzIYu6MklJ
TLSH
T17642D67B9821842225F1515F7BBFB208E066F2079541DCD1FE8C43051F927ABE572E9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 206KB
SHA256 2d5df084ff251c96c7efa4be6022edde3ef68a354aacdbcc67b5f72f98b5d6ef
MD5 d4120e38627592ad5da8c8d375fea9ac
SHA1 2ca2c6b649fdf01b70965aadc7c465d1898ec2f2
SHA512 518ffd4f33b3a8e80a2fdba2d42ef96a7d11740e422bf7a6287b034e852a103d67663ae4c45874fd309a597a93086bb50850619e356995a7112dbc955b8aca10
SSDEEP 1536:624HyOTCasJY2asmyvmRUOyhFOQpbHtp+wcQkM4cWSprqPnOEDkLZBtMascblXNv:61SOTV6TXpWCmAZBtRb1BAwMW
TLSH
T12B24287153F009BA60C343A8BBA576697D66D14BF513D0ECF3AE42112F83D668837A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download