c182b108b4c23a043c345bd278af603bde27167de4af9c344daaaec646039c11

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/05/2026, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-18_df5d4c2dced4bc08264d16a511db0382_elex_glassworm_icedid_njrat.exe
Size 1.7MB
Sample260518-rdsdpsd18t
SHA256 c182b108b4c23a043c345bd278af603bde27167de4af9c344daaaec646039c11
MD5 df5d4c2dced4bc08264d16a511db0382
SHA1 e61680f8ead4249582def0dcf44bb65ca25d0c28
SHA512 805f998172e3a333ea69e5cfccff8cd03548e2ff6e3f361c23f6ab36f94a028cbc8f74546d943a7379837e0de6ddb669787136666e2a162a48c85b6ebab72003
SSDEEP 12288:wVer5+nZoVLaA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJONgT0i1dcgsXW9VpLhMXm:wxbAVDKUTbQIzFLwLIM0iwg99Vpibu9F
TLSH
T17C852857EB819AD8F68D08376B684150D72EE261A74F2790366C420CCF873878FA5E7D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	wqmincwp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	2026-05-18_df5d4c2dced4bc08264d16a511db0382_elex_glassworm_icedid_njrat.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	waanktokc.exe

Executes dropped EXE 3 IoCs

pid	Process
3256	waanktokc.exe
984	wqmincwp.exe
1032	wedkga.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\waanktokc.exe	2026-05-18_df5d4c2dced4bc08264d16a511db0382_elex_glassworm_icedid_njrat.exe
File created	C:\Windows\SysWOW64\wqmincwp.exe	waanktokc.exe
File opened for modification	C:\Windows\SysWOW64\wqmincwp.exe	waanktokc.exe
File created	C:\Windows\SysWOW64\wedkga.exe	wqmincwp.exe
File opened for modification	C:\Windows\SysWOW64\wedkga.exe	wqmincwp.exe
File created	C:\Windows\SysWOW64\wjaph.exe	wedkga.exe
File created	C:\Windows\SysWOW64\waanktokc.exe	2026-05-18_df5d4c2dced4bc08264d16a511db0382_elex_glassworm_icedid_njrat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqmincwp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wedkga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-18_df5d4c2dced4bc08264d16a511db0382_elex_glassworm_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	waanktokc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 3256	1656	2026-05-18_df5d4c2dced4bc08264d16a511db0382_elex_glassworm_icedid_njrat.exe	90
PID 1656 wrote to memory of 3624	1656	2026-05-18_df5d4c2dced4bc08264d16a511db0382_elex_glassworm_icedid_njrat.exe	92
PID 3256 wrote to memory of 984	3256	waanktokc.exe	102
PID 3256 wrote to memory of 3524	3256	waanktokc.exe	103
PID 984 wrote to memory of 1032	984	wqmincwp.exe	108
PID 984 wrote to memory of 3936	984	wqmincwp.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-05-18_df5d4c2dced4bc08264d16a511db0382_elex_glassworm_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-18_df5d4c2dced4bc08264d16a511db0382_elex_glassworm_icedid_njrat.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\SysWOW64\waanktokc.exe
  "C:\Windows\system32\waanktokc.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3256
- - C:\Windows\SysWOW64\wqmincwp.exe
    "C:\Windows\system32\wqmincwp.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:984
  - - C:\Windows\SysWOW64\wedkga.exe
      "C:\Windows\system32\wedkga.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      PID:1032
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wqmincwp.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3936
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\waanktokc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3524
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\2026-05-18_df5d4c2dced4bc08264d16a511db0382_elex_glassworm_icedid_njrat.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

waanktokc.exe

Path C:\Windows\SysWOW64\waanktokc.exe
Size 1.7MB
SHA256 54599a150ccd6a7bc2770d41dfcbd745501a191e77fe66558626b6823126bddd
MD5 defeaa29d3a3c0eb97b882b37c312447
SHA1 4f6c1ccfbf9407c5821ef3dfc4246727d8796ffd
SHA512 05b8b42ccfc4abf503e3fbc748c0786567a074d3f3510848443b09577e098042d76ef42b49fe2fc2d4b4997a3436f4070ff5a6c9b6a63e3ee9052ffab93e3807
SSDEEP 12288:wVer5+nZoVLaA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJONgT0i1dcgsXW9VpLhMXS:wxbAVDKUTbQIzFLwLIM0iwg99Vpibu9D
TLSH
T186852857EB819AD8F68D08376B684150D72EE261A74F2790366C420CCF873878FA5E7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wedkga.exe

Path C:\Windows\SysWOW64\wedkga.exe
Size 1.7MB
SHA256 b6e6420e35f9aa64ca3564f4eb7a1ef007d0b7de34934309a601c3fa76c23955
MD5 31dd77db7046359c602eec1f650e7553
SHA1 8160e29bf6209d5402d3f2b2f217f2b8f72fa54f
SHA512 afc0522c966ce4b5d42e70ef79d856fa7c4cb812633d4fe7ee19a37d39dec8fd2da4f0d3d65d4dc394e2104f25173c800db2112ee994039c59c68a7bea8cc8d0
SSDEEP 12288:wVer5+nZoVLaA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJONgT0i1dcgsXW9VpLhMXo:wxbAVDKUTbQIzFLwLIM0iwg99Vpibu9R
TLSH
T194852857EB819AD8F68D08376B684150D72EE261A74F2790366C420CCF873878FA5E7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqmincwp.exe

Path C:\Windows\SysWOW64\wqmincwp.exe
Size 1.7MB
SHA256 d160daa66eda477526cace8fb533b28c742d4738c6f179eb71990b7377b92fa6
MD5 5399431e7be424805a0e2a47d9f8d431
SHA1 01ebc32182105dc898a7bb7d290bccc8a2a8b8ed
SHA512 a4a83f6e6115b0f86b200d092e38141ab56d805c21d9b5a5e454af292bb901a7fa01ec257e16599b8615472e84cc4c02586c15a74468f6684246037825848046
SSDEEP 12288:wVer5+nZoVLaA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJONgT0i1dcgsXW9VpLhMXl:wxbAVDKUTbQIzFLwLIM0iwg99Vpibu9u
TLSH
T1BC852857EB819AD8F68D08376B684150D72EE261A74F2790366C420CCF873878FA5E7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/984-27-0x0000000000400000-0x00000000005BB000-memory.dmp

Download

memory/984-25-0x0000000000400000-0x00000000005BB000-memory.dmp

Download

memory/984-38-0x0000000000400000-0x00000000005BB000-memory.dmp

Download

memory/1032-37-0x0000000000400000-0x00000000005BB000-memory.dmp

Download

memory/1032-39-0x0000000000400000-0x00000000005BB000-memory.dmp

Download

memory/1656-1-0x0000000000414000-0x0000000000415000-memory.dmp

Download

memory/1656-14-0x0000000000400000-0x00000000005BB000-memory.dmp

Download

memory/1656-2-0x0000000000400000-0x00000000005BB000-memory.dmp

Download

memory/1656-3-0x0000000000414000-0x0000000000415000-memory.dmp

Download

memory/1656-0-0x0000000000400000-0x00000000005BB000-memory.dmp

Download

memory/3256-13-0x0000000000400000-0x00000000005BB000-memory.dmp

Download

memory/3256-15-0x0000000000400000-0x00000000005BB000-memory.dmp

Download

memory/3256-26-0x0000000000400000-0x00000000005BB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads