05118dc61ad97264f02695c8cf15d0c2fc87f38dfee779a6c956547590df182a

Analysis

max time kernel
149s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_aa8d2b27f5e62ecacaf9846d293b7901_elex_icedid_njrat.exe
Size 1.0MB
Sample260511-msad8afw81
SHA256 05118dc61ad97264f02695c8cf15d0c2fc87f38dfee779a6c956547590df182a
MD5 aa8d2b27f5e62ecacaf9846d293b7901
SHA1 9261c0a0ea46344a5a4fee0def63afb41042ed70
SHA512 3424a530a16d813b11b703ac9d42edfe3dbb0e531e753ede96bf34b79f786989b024331a3195b57bf90fd1c6d4058d316e5e9a551764b1af02b22fa0d7dc8b69
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsod:jxPAPJmtu
TLSH
T10135A117E3818AD5D7990932DE6481A0532AF02D6BFB16723A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
3220	wcls.exe
4476	wyxac.exe
4800	wna.exe
4608	wooshogi.exe
568	wcfi.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wdcpgvnyp.exe	wcfi.exe
File created	C:\Windows\SysWOW64\wcls.exe	2026-05-11_aa8d2b27f5e62ecacaf9846d293b7901_elex_icedid_njrat.exe
File opened for modification	C:\Windows\SysWOW64\wcls.exe	2026-05-11_aa8d2b27f5e62ecacaf9846d293b7901_elex_icedid_njrat.exe
File created	C:\Windows\SysWOW64\wyxac.exe	wcls.exe
File opened for modification	C:\Windows\SysWOW64\wyxac.exe	wcls.exe
File opened for modification	C:\Windows\SysWOW64\wna.exe	wyxac.exe
File created	C:\Windows\SysWOW64\wooshogi.exe	wna.exe
File opened for modification	C:\Windows\SysWOW64\wooshogi.exe	wna.exe
File created	C:\Windows\SysWOW64\wcfi.exe	wooshogi.exe
File created	C:\Windows\SysWOW64\wna.exe	wyxac.exe
File opened for modification	C:\Windows\SysWOW64\wcfi.exe	wooshogi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2376	4476	WerFault.exe	82
1068	4476	WerFault.exe	82
1756	4608	WerFault.exe	93
3480	4608	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wyxac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wna.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcfi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_aa8d2b27f5e62ecacaf9846d293b7901_elex_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wooshogi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcls.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 3220	1056	2026-05-11_aa8d2b27f5e62ecacaf9846d293b7901_elex_icedid_njrat.exe	79
PID 1056 wrote to memory of 4888	1056	2026-05-11_aa8d2b27f5e62ecacaf9846d293b7901_elex_icedid_njrat.exe	80
PID 3220 wrote to memory of 4476	3220	wcls.exe	82
PID 3220 wrote to memory of 660	3220	wcls.exe	83
PID 4476 wrote to memory of 4800	4476	wyxac.exe	85
PID 4476 wrote to memory of 4576	4476	wyxac.exe	86
PID 4800 wrote to memory of 4608	4800	wna.exe	93
PID 4800 wrote to memory of 3240	4800	wna.exe	94
PID 4608 wrote to memory of 568	4608	wooshogi.exe	96
PID 4608 wrote to memory of 824	4608	wooshogi.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-05-11_aa8d2b27f5e62ecacaf9846d293b7901_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_aa8d2b27f5e62ecacaf9846d293b7901_elex_icedid_njrat.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\SysWOW64\wcls.exe
  "C:\Windows\system32\wcls.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3220
- - C:\Windows\SysWOW64\wyxac.exe
    "C:\Windows\system32\wyxac.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4476
  - - C:\Windows\SysWOW64\wna.exe
      "C:\Windows\system32\wna.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4800
    - - C:\Windows\SysWOW64\wooshogi.exe
        
        "C:\Windows\system32\wooshogi.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4608
      - C:\Windows\SysWOW64\wcfi.exe
        
        "C:\Windows\system32\wcfi.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:568
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wooshogi.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:824
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 1684
        6⤵
        Program crash
        
        PID:1756
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 1696
        6⤵
        Program crash
        
        PID:3480
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wna.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3240
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wyxac.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4576
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 1684
      4⤵
      Program crash
      PID:2376
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 1544
      4⤵
      Program crash
      PID:1068
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wcls.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:660
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\2026-05-11_aa8d2b27f5e62ecacaf9846d293b7901_elex_icedid_njrat.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4476 -ip 4476
1⤵
PID:3704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4476 -ip 4476
1⤵
PID:556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4608 -ip 4608
1⤵
PID:2620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4608 -ip 4608
1⤵
PID:904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wcfi.exe

Path C:\Windows\SysWOW64\wcfi.exe
Size 1.0MB
SHA256 9428fccd5c735d2e8e5908ec0383feb4a142c6b5c74f9aa5e514fce69543b95a
MD5 9ccf9baeff2d1449a962273ca0c50d8c
SHA1 530cd1be197c5db841b8e34767840c733c1b0953
SHA512 0dd63f0919f5b3220c4c54d25247497ed29ffec80f1bef985d8e63ae5368f874ba6329ea14aa619583ee24bcc35431adfd527ded106e3e070362d209f0036f53
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsor:jxPAPJmtG
TLSH
T16E35A117E3818AD5D7990932DE6481A0532AF02D6BFB16723A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wcls.exe

Path C:\Windows\SysWOW64\wcls.exe
Size 1.0MB
SHA256 3e7d023470c4425e31ab0f87a55e5b68b02a6cf62d5649aa792465475458f35c
MD5 6d4350f9221bb69a5537378ea332a098
SHA1 13586289e0833767841768ea12f485c834ff6b26
SHA512 409464798f986303aae5545537cacfa8538765ffad1551ee71bb4df609ec462b31d6cfdfe4a316ca7f833dd337604916f2489bebc892b57e88237746092dafb3
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoY:jxPAPJmtp
TLSH
T12335A117E3818AD5D7990932DE6481A0532AF02D6BFB16723A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wna.exe

Path C:\Windows\SysWOW64\wna.exe
Size 1.0MB
SHA256 d95cb0bf43868f85f49e1d5f2dc73dc92f3cfff4cfe9efd6211a10a40ea86270
MD5 fe55568d99ebffd79aa7bf2501a6ca52
SHA1 0f2b8fbd9f99f025a6eabe96e41e8dc4fa15fe86
SHA512 73c68a08b6561b49cf8f5b6d21815453a13eb00ff362924e7db1c35c711e9d53f649a159c4e71ca2db53351ecc9ade6084e745db75962607b3a081f2b0096583
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoI:jxPAPJmtd
TLSH
T19035A117E3818AD5D7990932DE6481A0532AF02D6BFB16723A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wooshogi.exe

Path C:\Windows\SysWOW64\wooshogi.exe
Size 1.0MB
SHA256 bfbf5731aa5963d49ef52a1bebc4d35b16676826086e103f8e3812271b7a92f7
MD5 0e6d418c046c4ccd952f5b4aa423c638
SHA1 96c682ade8e0c23469285438f2be8767f7061aaa
SHA512 486e74a5bea4e9dbfed3de84853e059f1978e31dacacc26d2332630c056ac9ded64041be297a076c2fe72e8c50fc5b7d914e9f80bd5b17ab53ce91b02cc0a7bf
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoV:jxPAPJmtq
TLSH
T10A35A117E3818AD5D7990932DE6481A0532AF02D6BFB16723A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wyxac.exe

Path C:\Windows\SysWOW64\wyxac.exe
Size 1.0MB
SHA256 777f489e1b8b8a91615b476a7a55cb044230320a9190f400b0469873257d09a2
MD5 5ae52f8e14ca321856e11d51c82f2999
SHA1 138a061b085b50a33e01d454c602be29e6b8d252
SHA512 0ec525c714e7cff42eedc44095f4d026afb8f5a35767f0ab5f1e1a3384ef313f6edcdd79ab0b03b5cfa29670959845feaff3da9ed939a68233a78e2017952690
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsod:jxPAPJmtG
TLSH
T12535A117E3818AD5D7990932DE6481A0532AF02D6BFB16723A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/568-74-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/568-73-0x0000000000950000-0x0000000000A62000-memory.dmp

Download

memory/568-70-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1056-1-0x0000000000414000-0x0000000000415000-memory.dmp

Download

memory/1056-13-0x0000000000BB0000-0x0000000000CC2000-memory.dmp

Download

memory/1056-14-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1056-0-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3220-16-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3220-28-0x0000000000930000-0x0000000000A42000-memory.dmp

Download

memory/3220-12-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3220-15-0x0000000000930000-0x0000000000A42000-memory.dmp

Download

memory/3220-29-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4476-27-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4476-42-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4476-41-0x0000000000950000-0x0000000000A62000-memory.dmp

Download

memory/4608-55-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4608-58-0x0000000000960000-0x0000000000A72000-memory.dmp

Download

memory/4608-59-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4608-71-0x0000000000960000-0x0000000000A72000-memory.dmp

Download

memory/4608-72-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4800-57-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4800-56-0x0000000000920000-0x0000000000A32000-memory.dmp

Download

memory/4800-40-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4800-44-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4800-43-0x0000000000920000-0x0000000000A32000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads