05118dc61ad97264f02695c8cf15d0c2fc87f38dfee779a6c956547590df182a

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_aa8d2b27f5e62ecacaf9846d293b7901_elex_icedid_njrat.exe
Size 1.0MB
Sample260511-msad8afw81
SHA256 05118dc61ad97264f02695c8cf15d0c2fc87f38dfee779a6c956547590df182a
MD5 aa8d2b27f5e62ecacaf9846d293b7901
SHA1 9261c0a0ea46344a5a4fee0def63afb41042ed70
SHA512 3424a530a16d813b11b703ac9d42edfe3dbb0e531e753ede96bf34b79f786989b024331a3195b57bf90fd1c6d4058d316e5e9a551764b1af02b22fa0d7dc8b69
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsod:jxPAPJmtu
TLSH
T10135A117E3818AD5D7990932DE6481A0532AF02D6BFB16723A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Control Panel\International\Geo\Nation	wfarxaqm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Control Panel\International\Geo\Nation	wyis.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Control Panel\International\Geo\Nation	wqli.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Control Panel\International\Geo\Nation	2026-05-11_aa8d2b27f5e62ecacaf9846d293b7901_elex_icedid_njrat.exe

Executes dropped EXE 4 IoCs

pid	Process
3324	wfarxaqm.exe
1292	wyis.exe
416	wqli.exe
2008	wkgu.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wqli.exe	wyis.exe
File opened for modification	C:\Windows\SysWOW64\wkgu.exe	wqli.exe
File created	C:\Windows\SysWOW64\who.exe	wkgu.exe
File created	C:\Windows\SysWOW64\wfarxaqm.exe	2026-05-11_aa8d2b27f5e62ecacaf9846d293b7901_elex_icedid_njrat.exe
File opened for modification	C:\Windows\SysWOW64\wfarxaqm.exe	2026-05-11_aa8d2b27f5e62ecacaf9846d293b7901_elex_icedid_njrat.exe
File created	C:\Windows\SysWOW64\wqli.exe	wyis.exe
File created	C:\Windows\SysWOW64\wkgu.exe	wqli.exe
File created	C:\Windows\SysWOW64\wyis.exe	wfarxaqm.exe
File opened for modification	C:\Windows\SysWOW64\wyis.exe	wfarxaqm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
948	2944	WerFault.exe	85
4300	3324	WerFault.exe	87
4356	1292	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wyis.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_aa8d2b27f5e62ecacaf9846d293b7901_elex_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wfarxaqm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wkgu.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 3324	2944	2026-05-11_aa8d2b27f5e62ecacaf9846d293b7901_elex_icedid_njrat.exe	87
PID 2944 wrote to memory of 3628	2944	2026-05-11_aa8d2b27f5e62ecacaf9846d293b7901_elex_icedid_njrat.exe	90
PID 3324 wrote to memory of 1292	3324	wfarxaqm.exe	95
PID 3324 wrote to memory of 1516	3324	wfarxaqm.exe	96
PID 1292 wrote to memory of 416	1292	wyis.exe	119
PID 1292 wrote to memory of 1956	1292	wyis.exe	120
PID 416 wrote to memory of 2008	416	wqli.exe	125
PID 416 wrote to memory of 1776	416	wqli.exe	126

C:\Users\Admin\AppData\Local\Temp\2026-05-11_aa8d2b27f5e62ecacaf9846d293b7901_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_aa8d2b27f5e62ecacaf9846d293b7901_elex_icedid_njrat.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\wfarxaqm.exe
  "C:\Windows\system32\wfarxaqm.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Windows\SysWOW64\wyis.exe
    "C:\Windows\system32\wyis.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1292
  - - C:\Windows\SysWOW64\wqli.exe
      "C:\Windows\system32\wqli.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:416
    - - C:\Windows\SysWOW64\wkgu.exe
        
        "C:\Windows\system32\wkgu.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2008
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wqli.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1776
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wyis.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1956
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1292 -s 1664
      4⤵
      Program crash
      PID:4356
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wfarxaqm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1516
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 1396
    3⤵
    - Program crash
    PID:4300
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\2026-05-11_aa8d2b27f5e62ecacaf9846d293b7901_elex_icedid_njrat.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 524
  2⤵
  - Program crash
  PID:948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2944 -ip 2944
1⤵
PID:4120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3324 -ip 3324
1⤵
PID:3900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1292 -ip 1292
1⤵
PID:4560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wfarxaqm.exe

Path C:\Windows\SysWOW64\wfarxaqm.exe
Size 1.0MB
SHA256 a3c01f36b0d0fff6b2e6c8c5f1a45a3372407350d752510ddbd8882f41de6e36
MD5 6963365bf4ce9e914b5a7e476ac3e57e
SHA1 b518cb797b23d638ac7d3f47a108280dff0adc6d
SHA512 8562af0bdfd7338c6fb0476193d364f5be1f84358ceebd59692518776a1d1d35d875ae5ae90bdde1ee48f085eddaa298e7ce075f5c9f988a54cd7de24b8166f6
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoy:jxPAPJmt/
TLSH
T1DA35A117E3818AD5D7990932DE6481A0532AF02D6BFB16723A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wkgu.exe

Path C:\Windows\SysWOW64\wkgu.exe
Size 1.0MB
SHA256 b169f1bfe4704e189147e671a2cc2936abe269a16b742c828e3d7a9998f983a1
MD5 36644027d7acbae6e3a76858a46e38f7
SHA1 0529fa6bec0bea277cb4e61d058b78489c3eb41a
SHA512 71caa02c566e620fa7b70c0d845489858aebaf4f4a570247f58239faf75245679a7095b2faf55fdfa25b7b85ba13e639c85c433c4ea0c01e688f63ac02876705
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoD:jxPAPJmto
TLSH
T17A35A117E3818AD5D7990932DE6481A0532AF02D6BFB16723A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqli.exe

Path C:\Windows\SysWOW64\wqli.exe
Size 1.0MB
SHA256 62d0f47ba5a39429ad459adc0b0485e9c7f5f44ad819a7bea42257d7ea7d90f8
MD5 80d3ff16cae62e7c1efc4add275cfe5a
SHA1 7caa7faf9d5abdf9c484504f86595149405dab21
SHA512 f49b908ed4b87c1c3f90164cd7f600c9dcf934b9c1df5bbe73f4042ff83f34dbb2fcc97e8ff48b7e4f2ada25a9e3ee9c566535c5771838f945eefa488661f9ab
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoG:jxPAPJmtT
TLSH
T1B335A117E3818AD5D7990932DE6481A0532AF02D6BFB16723A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wyis.exe

Path C:\Windows\SysWOW64\wyis.exe
Size 1.0MB
SHA256 2d9a83b35792d551eab25fcfb560deae86eddf72622ddf13094caad819ad6296
MD5 43c268cc778b4a540642747faab850c3
SHA1 dddbd148a2f8577bf7ca0c8c637ea4e0b06770cb
SHA512 bbcea2ac28d045f56812527cb3814f909bb33c8ef0cab9d1928f54b87c6e97b36e0b08e23f41703a79f79f9b3228980b50b012cc9871081b9e9450bb8d211368
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoW:jxPAPJmtl
TLSH
T1A735A117E3818AD5D7990932DE6481A0532AF02D6BFB16723A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/416-39-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/416-51-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/416-40-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1292-25-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1292-28-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2008-52-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2008-49-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2944-0-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2944-3-0x0000000000414000-0x0000000000415000-memory.dmp

Download

memory/2944-1-0x0000000000414000-0x0000000000415000-memory.dmp

Download

memory/2944-26-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2944-2-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3324-27-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3324-14-0x0000000000400000-0x000000000050A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads