c182b108b4c23a043c345bd278af603bde27167de4af9c344daaaec646039c11

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/05/2026, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-18_df5d4c2dced4bc08264d16a511db0382_elex_glassworm_icedid_njrat.exe
Size 1.7MB
Sample260518-rdsdpsd18t
SHA256 c182b108b4c23a043c345bd278af603bde27167de4af9c344daaaec646039c11
MD5 df5d4c2dced4bc08264d16a511db0382
SHA1 e61680f8ead4249582def0dcf44bb65ca25d0c28
SHA512 805f998172e3a333ea69e5cfccff8cd03548e2ff6e3f361c23f6ab36f94a028cbc8f74546d943a7379837e0de6ddb669787136666e2a162a48c85b6ebab72003
SSDEEP 12288:wVer5+nZoVLaA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJONgT0i1dcgsXW9VpLhMXm:wxbAVDKUTbQIzFLwLIM0iwg99Vpibu9F
TLSH
T17C852857EB819AD8F68D08376B684150D72EE261A74F2790366C420CCF873878FA5E7D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1468	wujj.exe
2052	whijr.exe
2520	wqvqkq.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wqvqkq.exe	whijr.exe
File created	C:\Windows\SysWOW64\wndwooo.exe	wqvqkq.exe
File created	C:\Windows\SysWOW64\wujj.exe	2026-05-18_df5d4c2dced4bc08264d16a511db0382_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\Windows\SysWOW64\wujj.exe	2026-05-18_df5d4c2dced4bc08264d16a511db0382_elex_glassworm_icedid_njrat.exe
File created	C:\Windows\SysWOW64\whijr.exe	wujj.exe
File opened for modification	C:\Windows\SysWOW64\whijr.exe	wujj.exe
File created	C:\Windows\SysWOW64\wqvqkq.exe	whijr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3028	2412	WerFault.exe	79
4232	2052	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-18_df5d4c2dced4bc08264d16a511db0382_elex_glassworm_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wujj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	whijr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqvqkq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 1468	2412	2026-05-18_df5d4c2dced4bc08264d16a511db0382_elex_glassworm_icedid_njrat.exe	80
PID 2412 wrote to memory of 4004	2412	2026-05-18_df5d4c2dced4bc08264d16a511db0382_elex_glassworm_icedid_njrat.exe	81
PID 1468 wrote to memory of 2052	1468	wujj.exe	86
PID 1468 wrote to memory of 1556	1468	wujj.exe	87
PID 2052 wrote to memory of 2520	2052	whijr.exe	89
PID 2052 wrote to memory of 4760	2052	whijr.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-05-18_df5d4c2dced4bc08264d16a511db0382_elex_glassworm_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-18_df5d4c2dced4bc08264d16a511db0382_elex_glassworm_icedid_njrat.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\wujj.exe
  "C:\Windows\system32\wujj.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\SysWOW64\whijr.exe
    "C:\Windows\system32\whijr.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2052
  - - C:\Windows\SysWOW64\wqvqkq.exe
      "C:\Windows\system32\wqvqkq.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      PID:2520
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\whijr.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4760
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 1716
      4⤵
      Program crash
      PID:4232
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wujj.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1556
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\2026-05-18_df5d4c2dced4bc08264d16a511db0382_elex_glassworm_icedid_njrat.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 1384
  2⤵
  - Program crash
  PID:3028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2412 -ip 2412
1⤵
PID:3188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2052 -ip 2052
1⤵
PID:1228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

whijr.exe

Path C:\Windows\SysWOW64\whijr.exe
Size 1.7MB
SHA256 df33bd8f44abe26df042f7d0fd24ce161543d0100fbc2fe5e9bf2cf56af826cc
MD5 5c6fcb6175f92da883164b41d133497b
SHA1 9476497d3c77a6b6f622398718a3722932cb43c7
SHA512 dde6e3393d4f3e3fe05e3c1913461dfea203a1a821083871aa7e42aacc792732f2cc8d970308a9324b4d662ebc80c1dcf53dddf97dc706780474151dd89f03fa
SSDEEP 12288:wVer5+nZoVLaA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJONgT0i1dcgsXW9VpLhMXH:wxbAVDKUTbQIzFLwLIM0iwg99Vpibu98
TLSH
T171852857EB819AD8F68D08376B684150D72EE261A74F2790366C420CCF873878FA5E7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqvqkq.exe

Path C:\Windows\SysWOW64\wqvqkq.exe
Size 1.7MB
SHA256 58f730d454c436eaee891568fd0985503da7eb8c3aa14bb9e441e622d7403877
MD5 0780204710a1cfb0a1c21bbf6c51b8d6
SHA1 6c2b6b8e55f6fedd7368614548b9f3ece8e2e9b1
SHA512 798ed1717984077c59c4c8971715264d63f934d43e81e279463f24888db8570118dee2e27d75236174c06906fa124fa0e412d9db7e84547f15d323d08bd1cffb
SSDEEP 12288:wVer5+nZoVLaA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJONgT0i1dcgsXW9VpLhMX/:wxbAVDKUTbQIzFLwLIM0iwg99Vpibu9u
TLSH
T128852857EB819AD8F68D08376B684150D72EE261A74F2790366C420CCF873878FA5E7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wujj.exe

Path C:\Windows\SysWOW64\wujj.exe
Size 1.7MB
SHA256 7014a84b5afb04ca11838933a3adef1066f04a6e5be4d6d62a24d137d281622e
MD5 65237d93fa3ef689649c944ca9ecdb6f
SHA1 3a207772cd68b38c37cfa41cc76b49c09abb2a8c
SHA512 3785ee2093a13eb3c78b705e5ea79cd680e56bfaeb5b45185ad40b87489e4eefde49633846ad9e279b7389d70a8395c1568d8f35e7506c77784321677604f9bf
SSDEEP 12288:wVer5+nZoVLaA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJONgT0i1dcgsXW9VpLhMXi:wxbAVDKUTbQIzFLwLIM0iwg99Vpibu9H
TLSH
T157852857EB819AD8F68D08376B684150D72EE261A74F2790366C420CCF873878FA5E7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1468-12-0x0000000000400000-0x00000000005BB000-memory.dmp

Download

memory/1468-14-0x0000000000400000-0x00000000005BB000-memory.dmp

Download

memory/1468-25-0x0000000000400000-0x00000000005BB000-memory.dmp

Download

memory/2052-24-0x0000000000400000-0x00000000005BB000-memory.dmp

Download

memory/2412-0-0x0000000000400000-0x00000000005BB000-memory.dmp

Download

memory/2412-1-0x0000000000414000-0x0000000000415000-memory.dmp

Download

memory/2412-13-0x0000000000400000-0x00000000005BB000-memory.dmp

Download

memory/2520-36-0x0000000000400000-0x00000000005BB000-memory.dmp

Download

memory/2520-37-0x0000000000400000-0x00000000005BB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads