Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/11/2026, 19:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-09_57944256129519a4959b800765055044_elex_emotet_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-09_57944256129519a4959b800765055044_elex_emotet_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-11-09_57944256129519a4959b800765055044_elex_emotet_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys.exe
- Size 1.3MB
- Sample261110-xtargsab52
- SHA256 83b8f813d741c6532a7ec9ea1892a5c8b2204a1063aa8fcc931c928918101e9f
- MD5 57944256129519a4959b800765055044
- SHA1 e2f2eba147a1a1f37ce948303c6d50a797eff9ee
- SHA512 370bd5790f1f83567336c7c578c8b69bf479159736279b87d93a3102d11e4275f404681fe1f93bb88543656c209c4fd0a653b65b91a2c668d7d9f974e6a8ee6f
- SSDEEP 24576:GDVmpzoEj5DrfzXdaxgAOZGspkqLCVHpZktAIn1brR7ZHFGjbhDZlnfiuWXC:GDkpzoiNXdaxgAOZDp/Avkz1brR1HF6v
- TLSH T1FE55F11075D08EB0E1BF593048B59AB09ABBFC304E3147DB63947E6C3E74980AA36767
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 5028 googleupdatesetup32.exe 4892 eventviewer.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\syslog.exe 2026-11-09_57944256129519a4959b800765055044_elex_emotet_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys.exe File created C:\Windows\SysWOW64\eventviewer.exe 2026-11-09_57944256129519a4959b800765055044_elex_emotet_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\GUMFE50.tmp\GoogleCrashHandler.exe googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_zh-TW.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\GoogleUpdateOnDemand.exe googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_lv.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_no.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_el.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_en.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_sk.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\psuser_64.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_am.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_fil.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_hi.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_pt-BR.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\npGoogleUpdate3.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\GoogleUpdateBroker.exe googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_bn.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_et.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_fr.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_iw.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_ta.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\GoogleUpdateComRegisterShell64.exe googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\GoogleUpdateWebPlugin.exe googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_da.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_it.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_ja.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_sr.dll googleupdatesetup32.exe File opened for modification C:\Program Files (x86)\GUMFE50.tmp\GoogleUpdateSetup.exe googleupdatesetup32.exe File opened for modification C:\Program Files (x86)\GUTFE51.tmp googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_ca.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_fi.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_lt.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_sl.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_sw.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdate.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\psuser.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\GoogleCrashHandler64.exe googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_cs.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_es.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_fa.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_ko.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_mr.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_de.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_ms.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_pt-PT.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_ru.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_uk.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_ro.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_te.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_vi.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\psmachine.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_bg.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\GoogleUpdateCore.exe googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_gu.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_is.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_ml.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_nl.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_sv.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\psmachine_64.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_kn.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_tr.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_ar.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_hu.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_id.dll googleupdatesetup32.exe File created C:\Program Files (x86)\GUMFE50.tmp\goopdateres_en-GB.dll googleupdatesetup32.exe - Program crash 2 IoCs
pid pid_target Process procid_target 976 1248 WerFault.exe 84 1788 4892 WerFault.exe 86 - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-11-09_57944256129519a4959b800765055044_elex_emotet_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname eventviewer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain eventviewer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-11-09_57944256129519a4959b800765055044_elex_emotet_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-09_57944256129519a4959b800765055044_elex_emotet_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eventviewer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language googleupdatesetup32.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4892 eventviewer.exe 4892 eventviewer.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1248 wrote to memory of 5028 1248 2026-11-09_57944256129519a4959b800765055044_elex_emotet_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys.exe 85 PID 1248 wrote to memory of 4892 1248 2026-11-09_57944256129519a4959b800765055044_elex_emotet_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-09_57944256129519a4959b800765055044_elex_emotet_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-09_57944256129519a4959b800765055044_elex_emotet_icedid_luca-stealer_njrat_nymaim_remcos_rhadamanthys.exe"1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\googleupdatesetup32.exe"googleupdatesetup32.exe "2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5028
-
-
C:\Windows\SysWOW64\eventviewer.exe"C:\Windows\system32\eventviewer.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4892 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 12723⤵
- Program crash
PID:1788
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 12442⤵
- Program crash
PID:976
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4892 -ip 48921⤵PID:3712
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1248 -ip 12481⤵PID:116
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
- Size 808B
- SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
- MD5 878e958d6bff424e59d1feb51584a01f
- SHA1 b11261559bbea40f1874448196e2934277a537e9
- SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
- TLSH T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
- Size 241KB
- SHA256 783bfd2cf76d912605d4979b22a7ba95d5c74ce11587a1adb6e22572023d8dc6
- MD5 1471480b7d7e19cf1c16541a7a41c560
- SHA1 42c0f75410b85bf2be14a7a1d531f394a412adb6
- SHA512 be4181fa7dbeb947b603b983d8972f0c011fe7849624e4435fa8c6e5aa3aa88b52f440fc38f8ffae30db09a63d5299f1a5418b5f95837a7742f0008e04658c94
- SSDEEP 3072:TPsBiIOlbXrmoUMCUhBdmWUHB+BAsK7XL0eXbHsoXioNJ8dlDc:br7UMCAdmWCUBAJv0eLMoXj24
- TLSH T11B34DF589DB7F0565E8A9DE18CD79E9647F8319B23427F1B4EA05FC01C17BBB8E62080
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
- Size 701B
- SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
- MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
- SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
- SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
- TLSH T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
- Size 192B
- SHA256 238a97659bde2d79fd81f1597de2549975203b8236d7712d268b988610d1dc0d
- MD5 c94b89750abd7e1deb3c0e5420d7f74d
- SHA1 9e79e859cd65cec1af85c1d85e717c3ed7072744
- SHA512 802eed530021b3897d2fb9827838b776c491112a625bb0878a4b3471bfb27fe6a2f9da6b9a1d63907bafbfbf2d3bfb9185b767d1817b10b3246da382fdabad69
- TLSH T111C022082A832300F28883BC02803A028B80A200E080CF0B0AF20B08C22BA0A3820E3A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
- Size 192B
- SHA256 33a1fd728ea746ce9cbefac2d49cbb037870b6f3c7c43c61d9ebc6568d116d35
- MD5 892ae747c584eceac929a726f77c78b4
- SHA1 361221b03ae52f6de6b61bb5e54eafa8eddba5fa
- SHA512 b3081aaf88d4a7a390d1ade3537bc58cdf3e88815d3dac6bd70b1a2f48827e7294470f632022e8d09f08fe33c226774b345f5446cb8e289d88152c9015829ef5
- TLSH T198C08C1C1AA21A06F2A883BC02C13D139B209101E241CF0A1AF12A08C99AB162838C3A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
- Size 246B
- SHA256 1175b74eb2fca0a928f35c00e7a3758218124bc46c4db381545b2b6dcf55df37
- MD5 ad00ebfba3053643a608644ebdbc022b
- SHA1 c060c240dd176d7d1d8a63240b946830e224f55b
- SHA512 378d9f63aca111274528b9bab9efca5c81badcf027cb3b3955d7d37cb43cc984ceb743fd07cfe7a73a06a4a88a4a352a870e08a9b1fd9df2176618a9a1c6d29c
- TLSH T17FD012392B558623F0391A391D751A41DFE45925F481978E1F216658846DD460CB6C4D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
- Size 192B
- SHA256 a193e85f77c504f1e100706069d324e7a94b7dc77a2637ca911d4d486923b5ea
- MD5 0ed2d50b85a6441f2d7844d5ec85b8ae
- SHA1 185865aef4f029fb9def188235c4cc20211bde91
- SHA512 67a4a990b7b51ecbc7aebdd502e322f43e035cc903fa0b8f0e51a1381f039ce631510f96a02df6b028139cbeabf9fe175fe27477c57f99dfdabde35f45462b86
- TLSH T1EFC09B0C5B564315F58897791351558286509510F5919B1615B5060CD53AF052470E55
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
- Size 192B
- SHA256 90f6d9eb5e69375b90840ef23fa2c9dcae6b893cc3905e28d5656110e7ebcc41
- MD5 1603e1598940d8ae33227f12cb2ab540
- SHA1 a54ceb6a656394d8b8c647551c207f892d0cb643
- SHA512 032d9ef3abfef1101f1c08c72288fdcd935144c79356c5f95bd436193cd671f069d2465837caa7e2de0230c198455ad256366393ade06e356b2f98f4a3341c46
- TLSH T1B9C08C1C4A660606F6A883B813C26D838A208120F3819F0626B12A08CD38F122834D29
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\googleupdatesetup32.exe
- Size 1.1MB
- SHA256 f91e258ea71dcbfc82371b2ee3e20852e45bef0cb946223d1141a6ef1dfb793f
- MD5 53baee50f7a69bf3bc0fffe25341a923
- SHA1 0b7998f5517ed4e7c5aeea3a89d73b60d2a2d102
- SHA512 0eb28032849f775f604b7064a4f00f7d802c8c2fd5c7bc21b48298e6c3d316286963794b4c6c4981199c21f56b08d9aa466a470d40738d1b633b7feddc8e6241
- SSDEEP 24576:pEj5DrfzXdaxgAOZGspkqLCVHpZktAIn1brR7ZHFGjbhDZlnN:piNXdaxgAOZDp/Avkz1brR1HF69HN
- TLSH T120351210B5E480B0F5F26F3454F895E05ABEFC3149788A5F6384196C1FB46C1BA3AB6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
- Size 209KB
- SHA256 7b29d3bbb9fee6fd4d4a36efb24f0bac7e7f986e8c56bc9b8a93268cb91e0c4d
- MD5 1e9fab3c209934426ad77ed5575774d7
- SHA1 7bfd2cea51ab93b3a7379ce42e0efd7e4728dcdb
- SHA512 3ff40e847e2f26da8d8bdf9ae32734db896c61ffb084cd3e612d3606c2dfc317953e7d1442b8bbf3fd637bca91bae08418a08b324e48c9a0e88ba6cb3d38796e
- SSDEEP 1536:c2PHyOTCasJY2as2tvlRUGWhFOQpbHtp+wcQkM4cWSprWPnOEDkLZBtMascbfXNv:c4SOTX67XpWC6AZBtRbfBAwMW
- TLSH T16C24287153F009BA60C343A8BBA576697D66D14BF553D0ECF3AE42102F83D668837A9C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\eventviewer.exe
- Size 88KB
- SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
- MD5 188a727732ea436cedbfa4f016e7bbdf
- SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
- SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
- SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
- TLSH T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
- MD5 SHA1 SHA512 SSDEEP TLSH