f7f020efeb49ed2dcf13ccd013a9d6cb7e0046f61e79accc6ea9dbfb5e7977fa

Analysis

max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_1ae73d6e89eea3ce2f7bac2410b4f13c_elex_icedid_njrat.exe
Size 1.0MB
Sample260511-pchf1acv2n
SHA256 f7f020efeb49ed2dcf13ccd013a9d6cb7e0046f61e79accc6ea9dbfb5e7977fa
MD5 1ae73d6e89eea3ce2f7bac2410b4f13c
SHA1 6aa4f75340c3837994f9ce369f314781a0619045
SHA512 5d5e3a5004ec1a1931bc8c0bd4593a40ac2c830e6f3d76efb55b191aec90a4481865bb8d51c135db7c905d6f4f97e4ef522150166ae024cccbf5d585cad6dd35
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsos:jxPAPJmt3
TLSH
T1F135A117E3818AD5D7990932DE6481A0532AF02D6BFB16723A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
5468	wxryl.exe
1888	wtdpfqyp.exe
3336	wvgnww.exe
5752	wegnkt.exe
2104	wdsbvk.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wdsbvk.exe	wegnkt.exe
File created	C:\Windows\SysWOW64\wtdpfqyp.exe	wxryl.exe
File opened for modification	C:\Windows\SysWOW64\wtdpfqyp.exe	wxryl.exe
File opened for modification	C:\Windows\SysWOW64\wvgnww.exe	wtdpfqyp.exe
File opened for modification	C:\Windows\SysWOW64\wdsbvk.exe	wegnkt.exe
File created	C:\Windows\SysWOW64\wdftfix.exe	wdsbvk.exe
File created	C:\Windows\SysWOW64\wxryl.exe	2026-05-11_1ae73d6e89eea3ce2f7bac2410b4f13c_elex_icedid_njrat.exe
File opened for modification	C:\Windows\SysWOW64\wxryl.exe	2026-05-11_1ae73d6e89eea3ce2f7bac2410b4f13c_elex_icedid_njrat.exe
File created	C:\Windows\SysWOW64\wvgnww.exe	wtdpfqyp.exe
File created	C:\Windows\SysWOW64\wegnkt.exe	wvgnww.exe
File opened for modification	C:\Windows\SysWOW64\wegnkt.exe	wvgnww.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5576	5752	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wdsbvk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wvgnww.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_1ae73d6e89eea3ce2f7bac2410b4f13c_elex_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wxryl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtdpfqyp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wegnkt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 5468	3340	2026-05-11_1ae73d6e89eea3ce2f7bac2410b4f13c_elex_icedid_njrat.exe	79
PID 3340 wrote to memory of 2288	3340	2026-05-11_1ae73d6e89eea3ce2f7bac2410b4f13c_elex_icedid_njrat.exe	80
PID 5468 wrote to memory of 1888	5468	wxryl.exe	82
PID 5468 wrote to memory of 1500	5468	wxryl.exe	83
PID 1888 wrote to memory of 3336	1888	wtdpfqyp.exe	85
PID 1888 wrote to memory of 3864	1888	wtdpfqyp.exe	86
PID 3336 wrote to memory of 5752	3336	wvgnww.exe	88
PID 3336 wrote to memory of 2928	3336	wvgnww.exe	89
PID 5752 wrote to memory of 2104	5752	wegnkt.exe	91
PID 5752 wrote to memory of 5980	5752	wegnkt.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-05-11_1ae73d6e89eea3ce2f7bac2410b4f13c_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_1ae73d6e89eea3ce2f7bac2410b4f13c_elex_icedid_njrat.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Windows\SysWOW64\wxryl.exe
  "C:\Windows\system32\wxryl.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5468
- - C:\Windows\SysWOW64\wtdpfqyp.exe
    "C:\Windows\system32\wtdpfqyp.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1888
  - - C:\Windows\SysWOW64\wvgnww.exe
      "C:\Windows\system32\wvgnww.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3336
    - - C:\Windows\SysWOW64\wegnkt.exe
        
        "C:\Windows\system32\wegnkt.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5752
      - C:\Windows\SysWOW64\wdsbvk.exe
        
        "C:\Windows\system32\wdsbvk.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2104
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wegnkt.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5980
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5752 -s 1332
        6⤵
        Program crash
        
        PID:5576
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wvgnww.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2928
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtdpfqyp.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3864
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxryl.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1500
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\2026-05-11_1ae73d6e89eea3ce2f7bac2410b4f13c_elex_icedid_njrat.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5752 -ip 5752
1⤵
PID:5884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wdsbvk.exe

Path C:\Windows\SysWOW64\wdsbvk.exe
Size 1.0MB
SHA256 36412b42d909e1e5527f4ae6bd58dfd9f650adb9b98855429cd82d30151603c0
MD5 6ad6fccb3887b5925374cc6ece8adc33
SHA1 e3d79c72039ed75a2e6dd8465dc77813b9f0faa5
SHA512 c6f63b741b94bee9c0124eaa80db7e22c71aeb26f0f856434bbc32596fdc81803cafcb236b1460552c42b6d9f02c6b60179d1ab598e761ece8e4ab5cf970548c
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nso3:jxPAPJmtm
TLSH
T15935A117E3818AD5D7990932DE6481A0532AF02D6BFB16723A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wegnkt.exe

Path C:\Windows\SysWOW64\wegnkt.exe
Size 1.0MB
SHA256 836bc90bb7ca7ff32518b4640500dce7a522ce1f46ef2926b4c3d899a361b3ed
MD5 04deab519e6c1173917b21ec500a1665
SHA1 dc62cd05b58677ec31dc0cd203f887b9a91cb2e8
SHA512 980f116ced1ce9b2eb5783278f4cc2e4ff027cf2f42b70a7105a15f642d59d6ed1c62ea7b1b576aa9cd3c512dd9329b81cc4dd7db6e242457ab75f8356e07d27
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsod:jxPAPJmtO
TLSH
T19135A117E3818AD5D7990932DE6481A0532AF02D6BFB16723A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtdpfqyp.exe

Path C:\Windows\SysWOW64\wtdpfqyp.exe
Size 1.0MB
SHA256 90192b020510f9af7ec441e135fbacee84bf4fdc4832c749544ce48a5be34b07
MD5 a1043d5f78352021afaaf45050906fd6
SHA1 cad74218d1dcbae62ec5b3deb94b95bb1202f298
SHA512 425c984f730f6094b977ada61f9a0b8a300fe6dffc6c94224fba148cca6e5d44d24e15cfa26c0c3e8183e2da3e2afc79462e912a06e279a5a3388e2b573d23c3
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsox:jxPAPJmt2
TLSH
T10935A117E3818AD5D7990932DE6481A0532AF02D6BFB16723A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wvgnww.exe

Path C:\Windows\SysWOW64\wvgnww.exe
Size 1.0MB
SHA256 633e362b95bd48f3a4e598a75f3730c6e71a21414b65e1d960afa894f16516bc
MD5 c088e49f84064ec05d2448ac35eb9a60
SHA1 3e18be11c19e6275c29384f41296858f088f0db2
SHA512 53a98a342a8a6532c6dc7b6b6dfe50727382189905f1c54e14a995b9402a713b1cc8292aa5db9cea668d8596775e06b0a4b024d1b398404f57db7fb1e94496e1
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoO:jxPAPJmtf
TLSH
T10135A117E3818AD5D7990932DE6481A0532AF02D6BFB16723A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wxryl.exe

Path C:\Windows\SysWOW64\wxryl.exe
Size 1.0MB
SHA256 b20e293b3edf43cc70d1316f6085f1cabdb9f2a46b42a0a863ac867a23152471
MD5 68504c9607785830c5e06210feced33d
SHA1 41eae6bafcf8bcfbdc2ae3fd6e9127388b3602ed
SHA512 f158ade1c9ecfdb315913002528858a317d09442ef4e8af844d67805fdc9c56b6b129960b8471dae8026e37f0172231091be845d8ee5b0746ec22e952231720a
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoW:jxPAPJmtH
TLSH
T1AA35A117E3818AD5D7990932DE6481A0532AF02D6BFB16723A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1888-28-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1888-39-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1888-26-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2104-63-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2104-65-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3336-38-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3336-40-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3336-52-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3340-2-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3340-1-0x0000000000414000-0x0000000000415000-memory.dmp

Download

memory/3340-3-0x0000000000414000-0x0000000000415000-memory.dmp

Download

memory/3340-14-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3340-0-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5468-13-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5468-27-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5468-15-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5752-51-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5752-64-0x0000000000400000-0x000000000050A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads