33edce4486d750478fbe8f3900b0f85954e24f3dc243e32264d439f79b358aea

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 01:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_1e239c6476a0759772b36b4968833dde_elex_icedid_njrat.exe
Size 1.0MB
Sample260602-b6m2pact7r
SHA256 33edce4486d750478fbe8f3900b0f85954e24f3dc243e32264d439f79b358aea
MD5 1e239c6476a0759772b36b4968833dde
SHA1 013029456534378bc9d3aba46310909e686b9429
SHA512 516ee4dd31a51f644dd40bb87297e2cb36b17d41873be871a9b261eac1dd483acc5e6f5a5c9fddbff53bb176374c0ab5b5a87fab9b9fe30615242d905e20a0fe
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsok:jxPAPJmtP
TLSH
T10435A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
2328	wdakc.exe
3500	wnvrbcm.exe
3772	wlyemfo.exe
2404	wur.exe
3716	wgxof.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wdakc.exe	2026-06-02_1e239c6476a0759772b36b4968833dde_elex_icedid_njrat.exe
File opened for modification	C:\Windows\SysWOW64\wnvrbcm.exe	wdakc.exe
File opened for modification	C:\Windows\SysWOW64\wlyemfo.exe	wnvrbcm.exe
File created	C:\Windows\SysWOW64\wur.exe	wlyemfo.exe
File opened for modification	C:\Windows\SysWOW64\wur.exe	wlyemfo.exe
File created	C:\Windows\SysWOW64\wgxof.exe	wur.exe
File opened for modification	C:\Windows\SysWOW64\wgxof.exe	wur.exe
File created	C:\Windows\SysWOW64\wdakc.exe	2026-06-02_1e239c6476a0759772b36b4968833dde_elex_icedid_njrat.exe
File created	C:\Windows\SysWOW64\wnvrbcm.exe	wdakc.exe
File created	C:\Windows\SysWOW64\wlyemfo.exe	wnvrbcm.exe
File created	C:\Windows\SysWOW64\wcub.exe	wgxof.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 8 IoCs

pid	pid_target	Process	procid_target
5024	3964	WerFault.exe	79
1372	3500	WerFault.exe	86
3796	3772	WerFault.exe	89
2144	3772	WerFault.exe	89
2276	3772	WerFault.exe	89
4876	3772	WerFault.exe	89
1264	2404	WerFault.exe	94
3244	2404	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wgxof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wdakc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wnvrbcm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wlyemfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_1e239c6476a0759772b36b4968833dde_elex_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 2328	3964	2026-06-02_1e239c6476a0759772b36b4968833dde_elex_icedid_njrat.exe	80
PID 3964 wrote to memory of 2640	3964	2026-06-02_1e239c6476a0759772b36b4968833dde_elex_icedid_njrat.exe	81
PID 2328 wrote to memory of 3500	2328	wdakc.exe	86
PID 2328 wrote to memory of 4248	2328	wdakc.exe	87
PID 3500 wrote to memory of 3772	3500	wnvrbcm.exe	89
PID 3500 wrote to memory of 3296	3500	wnvrbcm.exe	90
PID 3772 wrote to memory of 2404	3772	wlyemfo.exe	94
PID 3772 wrote to memory of 2944	3772	wlyemfo.exe	95
PID 2404 wrote to memory of 3716	2404	wur.exe	105
PID 2404 wrote to memory of 1188	2404	wur.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-06-02_1e239c6476a0759772b36b4968833dde_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_1e239c6476a0759772b36b4968833dde_elex_icedid_njrat.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Windows\SysWOW64\wdakc.exe
  "C:\Windows\system32\wdakc.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\SysWOW64\wnvrbcm.exe
    "C:\Windows\system32\wnvrbcm.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3500
  - - C:\Windows\SysWOW64\wlyemfo.exe
      "C:\Windows\system32\wlyemfo.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3772
    - - C:\Windows\SysWOW64\wur.exe
        
        "C:\Windows\system32\wur.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2404
      - C:\Windows\SysWOW64\wgxof.exe
        
        "C:\Windows\system32\wgxof.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3716
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wur.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1188
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 1720
        6⤵
        Program crash
        
        PID:1264
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 1728
        6⤵
        Program crash
        
        PID:3244
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wlyemfo.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2944
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 1712
        5⤵
        Program crash
        
        PID:3796
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 1720
        5⤵
        Program crash
        
        PID:2144
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 1656
        5⤵
        Program crash
        
        PID:2276
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 776
        5⤵
        Program crash
        
        PID:4876
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wnvrbcm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3296
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 1516
      4⤵
      Program crash
      PID:1372
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wdakc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4248
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\2026-06-02_1e239c6476a0759772b36b4968833dde_elex_icedid_njrat.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 1388
  2⤵
  - Program crash
  PID:5024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3964 -ip 3964
1⤵
PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3500 -ip 3500
1⤵
PID:3768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3772 -ip 3772
1⤵
PID:2252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 3772 -ip 3772
1⤵
PID:1008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3772 -ip 3772
1⤵
PID:3508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3772 -ip 3772
1⤵
PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2404 -ip 2404
1⤵
PID:2268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2404 -ip 2404
1⤵
PID:4012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wdakc.exe

Path C:\Windows\SysWOW64\wdakc.exe
Size 1.0MB
SHA256 e6c0793a21ae25efcc21aa274cf7cb37f26bb7f7a1737573c12001e9f86c8302
MD5 acfc312a09fc48cfe168808d7dac8944
SHA1 dccd6dc3aee22e6e078248097a2ec0e4f2388707
SHA512 442908e0c1022d404bd2bfe7fe4e56f6dfc37e29655d50994d01a7a5448d18cc2436b2847bb7ee680037d2ac5c0a5edbbd686eeb6d63a7c7387bf8f03122043d
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nso6:jxPAPJmtz
TLSH
T17835A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wgxof.exe

Path C:\Windows\SysWOW64\wgxof.exe
Size 1.0MB
SHA256 8385bafe3405511aab44ebc913d876a0fd033456cba2f617952be68816a6a492
MD5 0b0cdc0d27599ad4680a795d3780bde6
SHA1 f05f68aefb69ac4e05c68a6c6405b156d3fecfca
SHA512 ff40fdf70bbbf4299de370250edf0fddcb3d8989c18007bdc3f0393c6b3b5d9c25d317dd7ba1868644494651b9234a7bb4cbee4d3ba44fe34de538a1009fb4cf
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoP:jxPAPJmtO
TLSH
T1A735A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wlyemfo.exe

Path C:\Windows\SysWOW64\wlyemfo.exe
Size 1.0MB
SHA256 7732373cb2c2ac2ecf3cbbf0953dcda623a02c9925c618ace23328dca2f692b3
MD5 7129c2882bcf1cba3602b49fa0680583
SHA1 2c28bfd07c0f472df4e770fa81a7dca5d1cd9475
SHA512 6395ab11fc08d9e65c8b289726d1b04835513cfccb4714af1283ce4e84faef5e8c4e01ac5776e0f267d921b2cea71959b2ec0bbe7e1e17dd0054634fa9c4628f
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoz:jxPAPJmtu
TLSH
T1DF35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wnvrbcm.exe

Path C:\Windows\SysWOW64\wnvrbcm.exe
Size 1.0MB
SHA256 b4d5df1a4b9287328017518c8addc9499216ba5ca12c7a59f399d4dabe60e3cf
MD5 c91f91cddf52a76ac6431d740c8f080a
SHA1 5faa40d59bb0cafac6e66073c75a85b9b7a3c4a3
SHA512 33bed232174b382037a6d14abd680928a82b1f3a48168552dae42e58e48feb43b47a22921bdeafb7829ffc326825c2ae093a87cd0b4171a5a1da74d9ff393617
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoD:jxPAPJmtk
TLSH
T1A335A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wur.exe

Path C:\Windows\SysWOW64\wur.exe
Size 1.0MB
SHA256 3ed35daed5c5a786fb17e32fb4e631f6f56dc95db444627eb5faacc32c868dc8
MD5 0ff754d92bbcf38004ea7bc677f9a985
SHA1 871ebe1f15f82e14b2f9c3c2b93f4bf55d5b9612
SHA512 a1f76950b9d0d04ca8ac3f24e1299f1790057878009cc1675b32d0c1071efbc8defb53e4b98d7b4298f7370d30d45447320e34552c12477c17a3310c942a5ab7
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsow:jxPAPJmtD
TLSH
T19235A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2328-11-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2328-22-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2404-59-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2404-48-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2404-46-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3500-24-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3500-21-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3500-35-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3716-57-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3716-60-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3772-34-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3772-47-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3772-36-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3964-0-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3964-23-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3964-1-0x0000000000414000-0x0000000000415000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads