f7f020efeb49ed2dcf13ccd013a9d6cb7e0046f61e79accc6ea9dbfb5e7977fa

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_1ae73d6e89eea3ce2f7bac2410b4f13c_elex_icedid_njrat.exe
Size 1.0MB
Sample260511-pchf1acv2n
SHA256 f7f020efeb49ed2dcf13ccd013a9d6cb7e0046f61e79accc6ea9dbfb5e7977fa
MD5 1ae73d6e89eea3ce2f7bac2410b4f13c
SHA1 6aa4f75340c3837994f9ce369f314781a0619045
SHA512 5d5e3a5004ec1a1931bc8c0bd4593a40ac2c830e6f3d76efb55b191aec90a4481865bb8d51c135db7c905d6f4f97e4ef522150166ae024cccbf5d585cad6dd35
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsos:jxPAPJmt3
TLSH
T1F135A117E3818AD5D7990932DE6481A0532AF02D6BFB16723A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	wtbem.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	wmbscqs.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	wtppxmwq.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	wvkjiv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	wwyst.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	2026-05-11_1ae73d6e89eea3ce2f7bac2410b4f13c_elex_icedid_njrat.exe

Executes dropped EXE 6 IoCs

pid	Process
4880	wtbem.exe
5552	wmbscqs.exe
100	wtppxmwq.exe
3432	wvkjiv.exe
4496	wwyst.exe
4732	wtwwl.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wtwwl.exe	wwyst.exe
File opened for modification	C:\Windows\SysWOW64\wtwwl.exe	wwyst.exe
File created	C:\Windows\SysWOW64\wtbem.exe	2026-05-11_1ae73d6e89eea3ce2f7bac2410b4f13c_elex_icedid_njrat.exe
File opened for modification	C:\Windows\SysWOW64\wtbem.exe	2026-05-11_1ae73d6e89eea3ce2f7bac2410b4f13c_elex_icedid_njrat.exe
File opened for modification	C:\Windows\SysWOW64\wmbscqs.exe	wtbem.exe
File created	C:\Windows\SysWOW64\wtppxmwq.exe	wmbscqs.exe
File opened for modification	C:\Windows\SysWOW64\wvkjiv.exe	wtppxmwq.exe
File opened for modification	C:\Windows\SysWOW64\wwyst.exe	wvkjiv.exe
File created	C:\Windows\SysWOW64\wthhbh.exe	wtwwl.exe
File created	C:\Windows\SysWOW64\wmbscqs.exe	wtbem.exe
File opened for modification	C:\Windows\SysWOW64\wtppxmwq.exe	wmbscqs.exe
File created	C:\Windows\SysWOW64\wvkjiv.exe	wtppxmwq.exe
File created	C:\Windows\SysWOW64\wwyst.exe	wvkjiv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
992	5552	WerFault.exe	110
3076	5552	WerFault.exe	110

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wwyst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtwwl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_1ae73d6e89eea3ce2f7bac2410b4f13c_elex_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtbem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmbscqs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtppxmwq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wvkjiv.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 4880	4744	2026-05-11_1ae73d6e89eea3ce2f7bac2410b4f13c_elex_icedid_njrat.exe	104
PID 4744 wrote to memory of 5204	4744	2026-05-11_1ae73d6e89eea3ce2f7bac2410b4f13c_elex_icedid_njrat.exe	107
PID 4880 wrote to memory of 5552	4880	wtbem.exe	110
PID 4880 wrote to memory of 3884	4880	wtbem.exe	111
PID 5552 wrote to memory of 100	5552	wmbscqs.exe	114
PID 5552 wrote to memory of 2020	5552	wmbscqs.exe	115
PID 100 wrote to memory of 3432	100	wtppxmwq.exe	123
PID 100 wrote to memory of 3180	100	wtppxmwq.exe	124
PID 3432 wrote to memory of 4496	3432	wvkjiv.exe	127
PID 3432 wrote to memory of 5372	3432	wvkjiv.exe	128
PID 4496 wrote to memory of 4732	4496	wwyst.exe	131
PID 4496 wrote to memory of 5028	4496	wwyst.exe	132

C:\Users\Admin\AppData\Local\Temp\2026-05-11_1ae73d6e89eea3ce2f7bac2410b4f13c_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_1ae73d6e89eea3ce2f7bac2410b4f13c_elex_icedid_njrat.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\SysWOW64\wtbem.exe
  "C:\Windows\system32\wtbem.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Windows\SysWOW64\wmbscqs.exe
    "C:\Windows\system32\wmbscqs.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5552
  - - C:\Windows\SysWOW64\wtppxmwq.exe
      "C:\Windows\system32\wtppxmwq.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:100
    - - C:\Windows\SysWOW64\wvkjiv.exe
        
        "C:\Windows\system32\wvkjiv.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3432
      - C:\Windows\SysWOW64\wwyst.exe
        
        "C:\Windows\system32\wwyst.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4496
        
        C:\Windows\SysWOW64\wtwwl.exe
        
        "C:\Windows\system32\wtwwl.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4732
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wwyst.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5028
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wvkjiv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5372
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtppxmwq.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3180
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wmbscqs.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2020
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5552 -s 1692
      4⤵
      Program crash
      PID:992
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5552 -s 1736
      4⤵
      Program crash
      PID:3076
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtbem.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3884
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\2026-05-11_1ae73d6e89eea3ce2f7bac2410b4f13c_elex_icedid_njrat.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5552 -ip 5552
1⤵
PID:4088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5552 -ip 5552
1⤵
PID:1456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wmbscqs.exe

Path C:\Windows\SysWOW64\wmbscqs.exe
Size 1.0MB
SHA256 1e419502127cef396ab523bd40240f99d4e727d8d5c32c1a7ce8de3e0fd106f2
MD5 febe90baa36fcbf68a5de9f95b71b8d9
SHA1 63deabb36bd34b6b2abf51b33acef32bb48b6b2e
SHA512 70b061f591d70b25fceae6bce7b490026eb6ff8590e0aa8955acefe583b7074e369de6c072fbc79840daca106a9cdbaac851fe2ef53b8a3a4f33271b735bd6cf
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoh:jxPAPJmt2
TLSH
T12D35A117E3818AD5D7990932DE6481A0532AF02D6BFB16723A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtbem.exe

Path C:\Windows\SysWOW64\wtbem.exe
Size 1.0MB
SHA256 fda930812d3d77c8c9266ea9e275a09a5fda2f9410892f84a8a560306cf18054
MD5 20443f242519140fd7a45fd873724610
SHA1 f31ea385218dd78c5567cd50b379bfd044a1f2c3
SHA512 977a5c119cec552f897ed261644943a6d1893e7831afead630e04ed7b04b42ce2b574bf56ad9ae3162a70aa87a0eb2c1e0c97c5dfe842b6e4eebb9f3990e4007
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsok:jxPAPJmtt
TLSH
T16B35A117E3818AD5D7990932DE6481A0532AF02D6BFB16723A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtppxmwq.exe

Path C:\Windows\SysWOW64\wtppxmwq.exe
Size 1.0MB
SHA256 8b6520ea78057c7fb6d5f517deba2486d8ec1997be798d8c3e78b348b15262be
MD5 182e10165546f043c26975d46f5329ce
SHA1 5f550935709b94d4a5b0383be469ff43a9a7b67f
SHA512 b945d7e669a79b6a578fb1828b60259c37120b8ac1a417b59dbadb233b2c81edcb703efcdff250db8c9cb1c907a81300b71e99ad68a307504724b624d12b0bfd
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoI:jxPAPJmt5
TLSH
T15435A117E3818AD5D7990932DE6481A0532AF02D6BFB16723A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtwwl.exe

Path C:\Windows\SysWOW64\wtwwl.exe
Size 1.0MB
SHA256 0b0c4e919d61ca459fa011b9a3b1d323e3393d10d8855d45921d94332fe998f5
MD5 f166aeb6065d5be9794a035e04a44609
SHA1 16d38b332470fc6bcd252acd4a29c2ca61e5a849
SHA512 2c9288245367026a52c6b1cb1290138ea5993fa0020c6e8fbd94243196e4a5eb23cf17be282e3420db9c8724dd5cd411d3827b0c50ca13570513f251d9eafe3c
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsot:jxPAPJmtC
TLSH
T1A735A117E3818AD5D7990932DE6481A0532AF02D6BFB16723A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wvkjiv.exe

Path C:\Windows\SysWOW64\wvkjiv.exe
Size 1.0MB
SHA256 63a64237d1f4dcf671d1b2f390fcfd418deba7d1d915de23276837945609c357
MD5 342a3704e704b1dea0132fe22dbf1b00
SHA1 27228575a9236a949d302fe68b9a7d7028972a2d
SHA512 bf7c8a005fc5036a32f514546b150df4eadf8b6da83ba539a7c1b6506e59af4f4376da1b6d34839e683c8a77f5b98f95b057f5feb00355a86fef4b7d011834c5
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsof:jxPAPJmts
TLSH
T13135A117E3818AD5D7990932DE6481A0532AF02D6BFB16723A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wwyst.exe

Path C:\Windows\SysWOW64\wwyst.exe
Size 1.0MB
SHA256 c585293c92a2f167765a858379994b4c71d32133e00372caa8af5b093d786f81
MD5 a56c34f54efa1a10b45f940874e51070
SHA1 332dd9cfe1a5d9488ad0707cd4390ca4d45b612a
SHA512 440da39347c6f39d514a0caaa7b203217c21f34f031f971289852f89639b0ca830cc764ecdc49c6e5cf72c76556ba1e1e8076ce5f98605bd248fbe5d559f806d
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoQ:jxPAPJmt9
TLSH
T19235A117E3818AD5D7990932DE6481A0532AF02D6BFB16723A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/100-70-0x0000000003410000-0x000000000348E000-memory.dmp

Download

memory/100-71-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/100-53-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/100-57-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/100-56-0x0000000003410000-0x000000000348E000-memory.dmp

Download

memory/3432-84-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3432-83-0x00000000033F0000-0x000000000346E000-memory.dmp

Download

memory/3432-69-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4496-82-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4496-96-0x0000000002290000-0x000000000230E000-memory.dmp

Download

memory/4496-97-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4732-95-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4744-20-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4744-0-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4744-1-0x0000000000414000-0x0000000000415000-memory.dmp

Download

memory/4744-2-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4744-4-0x0000000000414000-0x0000000000415000-memory.dmp

Download

memory/4744-3-0x00000000034D0000-0x000000000354E000-memory.dmp

Download

memory/4744-19-0x00000000034D0000-0x000000000354E000-memory.dmp

Download

memory/4880-39-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4880-21-0x00000000033C0000-0x000000000343E000-memory.dmp

Download

memory/4880-22-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4880-18-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4880-38-0x00000000033C0000-0x000000000343E000-memory.dmp

Download

memory/5552-37-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5552-55-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5552-40-0x0000000003740000-0x00000000037BE000-memory.dmp

Download

memory/5552-41-0x0000000000400000-0x000000000050A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads