cc9399f7d72c6e5bad1b6ee8d23e59c55eb54d1a8e5edc597161ae2da49d8516

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 02:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_d75ed08fafcfcc0a1db5c6fc6279e26a_elex_icedid_njrat.exe
Size 1.0MB
Sample260710-c7pscacs8k
SHA256 cc9399f7d72c6e5bad1b6ee8d23e59c55eb54d1a8e5edc597161ae2da49d8516
MD5 d75ed08fafcfcc0a1db5c6fc6279e26a
SHA1 cb06edd953d64b1ee2cef45d8f83aea1319aebbe
SHA512 8d7578a8ea044ac25a7ba7287c42b933f56728ffee41409493e8358b183af8b250eac2d34d4289186186c755a4e4d03269ca10f0e03ebb878d13427bb0560016
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoA:jxPAPJmtB
TLSH
T10135A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 15 IoCs

pid	Process
5412	wfdjtkk.exe
4892	wbmm.exe
4228	wcpjkdd.exe
2948	wyqvwh.exe
3312	wimibkj.exe
2024	wrumymf.exe
3420	wfnwp.exe
1988	wevdtya.exe
3308	wswyfmwui.exe
1544	womtxr.exe
3756	whlcy.exe
3624	wxhmafw.exe
2264	wud.exe
3256	wbcwcn.exe
1276	wlrprrl.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wcpjkdd.exe	wbmm.exe
File created	C:\Windows\SysWOW64\wrumymf.exe	wimibkj.exe
File created	C:\Windows\SysWOW64\womtxr.exe	wswyfmwui.exe
File created	C:\Windows\SysWOW64\wxhmafw.exe	whlcy.exe
File opened for modification	C:\Windows\SysWOW64\wbcwcn.exe	wud.exe
File opened for modification	C:\Windows\SysWOW64\wfdjtkk.exe	2026-07-10_d75ed08fafcfcc0a1db5c6fc6279e26a_elex_icedid_njrat.exe
File opened for modification	C:\Windows\SysWOW64\wimibkj.exe	wyqvwh.exe
File created	C:\Windows\SysWOW64\wfnwp.exe	wrumymf.exe
File opened for modification	C:\Windows\SysWOW64\wevdtya.exe	wfnwp.exe
File opened for modification	C:\Windows\SysWOW64\wswyfmwui.exe	wevdtya.exe
File created	C:\Windows\SysWOW64\wfdjtkk.exe	2026-07-10_d75ed08fafcfcc0a1db5c6fc6279e26a_elex_icedid_njrat.exe
File opened for modification	C:\Windows\SysWOW64\wfnwp.exe	wrumymf.exe
File created	C:\Windows\SysWOW64\wevdtya.exe	wfnwp.exe
File opened for modification	C:\Windows\SysWOW64\whlcy.exe	womtxr.exe
File created	C:\Windows\SysWOW64\wud.exe	wxhmafw.exe
File created	C:\Windows\SysWOW64\wbcwcn.exe	wud.exe
File opened for modification	C:\Windows\SysWOW64\wlrprrl.exe	wbcwcn.exe
File created	C:\Windows\SysWOW64\wbmm.exe	wfdjtkk.exe
File created	C:\Windows\SysWOW64\wcpjkdd.exe	wbmm.exe
File opened for modification	C:\Windows\SysWOW64\wrumymf.exe	wimibkj.exe
File created	C:\Windows\SysWOW64\whlcy.exe	womtxr.exe
File opened for modification	C:\Windows\SysWOW64\wxhmafw.exe	whlcy.exe
File created	C:\Windows\SysWOW64\wyqvwh.exe	wcpjkdd.exe
File opened for modification	C:\Windows\SysWOW64\womtxr.exe	wswyfmwui.exe
File opened for modification	C:\Windows\SysWOW64\wud.exe	wxhmafw.exe
File opened for modification	C:\Windows\SysWOW64\wbmm.exe	wfdjtkk.exe
File created	C:\Windows\SysWOW64\wimibkj.exe	wyqvwh.exe
File created	C:\Windows\SysWOW64\wswyfmwui.exe	wevdtya.exe
File opened for modification	C:\Windows\SysWOW64\wyqvwh.exe	wcpjkdd.exe
File created	C:\Windows\SysWOW64\wlrprrl.exe	wbcwcn.exe
File created	C:\Windows\SysWOW64\wulhkkmnn.exe	wlrprrl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 6 IoCs

pid	pid_target	Process	procid_target
1668	1988	WerFault.exe	107
3084	3308	WerFault.exe	110
4388	2264	WerFault.exe	127
5192	2264	WerFault.exe	127
860	2264	WerFault.exe	127
5040	2264	WerFault.exe	127

System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wimibkj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wbcwcn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrumymf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	womtxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wbmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcpjkdd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wfnwp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	whlcy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_d75ed08fafcfcc0a1db5c6fc6279e26a_elex_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wfdjtkk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevdtya.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wxhmafw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wud.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wlrprrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wyqvwh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wswyfmwui.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 5412	1976	2026-07-10_d75ed08fafcfcc0a1db5c6fc6279e26a_elex_icedid_njrat.exe	86
PID 1976 wrote to memory of 4684	1976	2026-07-10_d75ed08fafcfcc0a1db5c6fc6279e26a_elex_icedid_njrat.exe	87
PID 5412 wrote to memory of 4892	5412	wfdjtkk.exe	89
PID 5412 wrote to memory of 4796	5412	wfdjtkk.exe	90
PID 4892 wrote to memory of 4228	4892	wbmm.exe	92
PID 4892 wrote to memory of 2960	4892	wbmm.exe	93
PID 4228 wrote to memory of 2948	4228	wcpjkdd.exe	95
PID 4228 wrote to memory of 860	4228	wcpjkdd.exe	96
PID 2948 wrote to memory of 3312	2948	wyqvwh.exe	98
PID 2948 wrote to memory of 5836	2948	wyqvwh.exe	99
PID 3312 wrote to memory of 2024	3312	wimibkj.exe	101
PID 3312 wrote to memory of 4436	3312	wimibkj.exe	102
PID 2024 wrote to memory of 3420	2024	wrumymf.exe	104
PID 2024 wrote to memory of 5064	2024	wrumymf.exe	105
PID 3420 wrote to memory of 1988	3420	wfnwp.exe	107
PID 3420 wrote to memory of 5656	3420	wfnwp.exe	108
PID 1988 wrote to memory of 3308	1988	wevdtya.exe	110
PID 1988 wrote to memory of 2236	1988	wevdtya.exe	111
PID 3308 wrote to memory of 1544	3308	wswyfmwui.exe	116
PID 3308 wrote to memory of 2812	3308	wswyfmwui.exe	117
PID 1544 wrote to memory of 3756	1544	womtxr.exe	121
PID 1544 wrote to memory of 1672	1544	womtxr.exe	122
PID 3756 wrote to memory of 3624	3756	whlcy.exe	124
PID 3756 wrote to memory of 2524	3756	whlcy.exe	125
PID 3624 wrote to memory of 2264	3624	wxhmafw.exe	127
PID 3624 wrote to memory of 4548	3624	wxhmafw.exe	128
PID 2264 wrote to memory of 3256	2264	wud.exe	130
PID 2264 wrote to memory of 3672	2264	wud.exe	131
PID 3256 wrote to memory of 1276	3256	wbcwcn.exe	141
PID 3256 wrote to memory of 3244	3256	wbcwcn.exe	142

C:\Users\Admin\AppData\Local\Temp\2026-07-10_d75ed08fafcfcc0a1db5c6fc6279e26a_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_d75ed08fafcfcc0a1db5c6fc6279e26a_elex_icedid_njrat.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\wfdjtkk.exe
  "C:\Windows\system32\wfdjtkk.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5412
- - C:\Windows\SysWOW64\wbmm.exe
    "C:\Windows\system32\wbmm.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\Windows\SysWOW64\wcpjkdd.exe
      "C:\Windows\system32\wcpjkdd.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4228
    - - C:\Windows\SysWOW64\wyqvwh.exe
        
        "C:\Windows\system32\wyqvwh.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2948
      - C:\Windows\SysWOW64\wimibkj.exe
        
        "C:\Windows\system32\wimibkj.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3312
        
        C:\Windows\SysWOW64\wrumymf.exe
        
        "C:\Windows\system32\wrumymf.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2024
        
        C:\Windows\SysWOW64\wfnwp.exe
        
        "C:\Windows\system32\wfnwp.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3420
        
        C:\Windows\SysWOW64\wevdtya.exe
        
        "C:\Windows\system32\wevdtya.exe"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1988
        
        C:\Windows\SysWOW64\wswyfmwui.exe
        
        "C:\Windows\system32\wswyfmwui.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3308
        
        C:\Windows\SysWOW64\womtxr.exe
        
        "C:\Windows\system32\womtxr.exe"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1544
        
        C:\Windows\SysWOW64\whlcy.exe
        
        "C:\Windows\system32\whlcy.exe"
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3756
        
        C:\Windows\SysWOW64\wxhmafw.exe
        
        "C:\Windows\system32\wxhmafw.exe"
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3624
        
        C:\Windows\SysWOW64\wud.exe
        
        "C:\Windows\system32\wud.exe"
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2264
        
        C:\Windows\SysWOW64\wbcwcn.exe
        
        "C:\Windows\system32\wbcwcn.exe"
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3256
        
        C:\Windows\SysWOW64\wlrprrl.exe
        
        "C:\Windows\system32\wlrprrl.exe"
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1276
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wbcwcn.exe"
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:3244
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wud.exe"
        15⤵
        System Location Discovery: System Language Discovery
        
        PID:3672
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 1764
        15⤵
        Program crash
        
        PID:4388
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 1776
        15⤵
        Program crash
        
        PID:5192
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 476
        15⤵
        Program crash
        
        PID:860
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 1652
        15⤵
        Program crash
        
        PID:5040
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxhmafw.exe"
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:4548
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\whlcy.exe"
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:2524
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\womtxr.exe"
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:1672
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wswyfmwui.exe"
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:2812
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 1296
        11⤵
        Program crash
        
        PID:3084
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wevdtya.exe"
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:2236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 1276
        10⤵
        Program crash
        
        PID:1668
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wfnwp.exe"
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5656
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wrumymf.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5064
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wimibkj.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4436
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wyqvwh.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5836
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wcpjkdd.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:860
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wbmm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2960
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wfdjtkk.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4796
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\2026-07-10_d75ed08fafcfcc0a1db5c6fc6279e26a_elex_icedid_njrat.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 1988 -ip 1988
1⤵
PID:1488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3308 -ip 3308
1⤵
PID:5060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2264 -ip 2264
1⤵
PID:3760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2264 -ip 2264
1⤵
PID:1864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2264 -ip 2264
1⤵
PID:4268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2264 -ip 2264
1⤵
PID:240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install[2].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8PCNG0VN\install[2].htm
Size 341B
SHA256 faceb706d4b7fe88330c0affe20eaa97e2d4ab7fdd5206724896ac2f59cd8ca0
MD5 21dcd9c130d5994cc4275d7d96c7c77f
SHA1 a9bd12053de9283bd1c730ceb68458ece87f963b
SHA512 47cd7375c22d88804fa8358df7ff596945950008f70bde49db0ed2d6302cce24f49c08de660538f0e94c26718f1625bd934c53bffbe6660acaef3e45138576f0
TLSH
T1E3E0264A0B219415B41120981CD17278A48BA587EB7BCDB59BFFB0A1D900AD498AA918
MD5 SHA1 SHA512 TLSH

Submit Download

wbcwcn.exe

Path C:\Windows\SysWOW64\wbcwcn.exe
Size 1.0MB
SHA256 13dc44cf79ade49644770c96256ddafb1022ad706da4629c2db27f632ed3d437
MD5 e41598e8d5b1fd33094cba031800ea25
SHA1 e5e847bacc314d9f683f18d05d841d4b9b949722
SHA512 6ab649a4eedfd88378affa2a3cf408025b07087739dc16262003c5551d6598ef840623175a8b1570ce34a601353479e63fd2a21affe6a95bcf830bf1420dde4d
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoP:jxPAPJmt+
TLSH
T1CC35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbmm.exe

Path C:\Windows\SysWOW64\wbmm.exe
Size 1.0MB
SHA256 db02939b08989c6080a0092c65d977efd58edba896c7851e0b26eb29215b22e1
MD5 8ca2720b8a6ba68b003da60b29e4045e
SHA1 1706cd1a2df802c2c1a30f83c1f4d157048ba782
SHA512 faf7b18ee862ff0c5086168bae4621964f0936a5717d64427f146f6cf83045a3fb97e842210d86018426f50feaa2bfacdb56760c939c93a5c5b055fe7b32181c
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nso1:jxPAPJmtw
TLSH
T1E135A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wcpjkdd.exe

Path C:\Windows\SysWOW64\wcpjkdd.exe
Size 1.0MB
SHA256 b6e4d900182a19b92003240d79c372fd5ffb7b5bde8a85c85f3f52403ed376f1
MD5 409da9f35f386371e6cee3964bd1d067
SHA1 2e856b880eae82bcaff67b47853495663ed6dc0a
SHA512 dfbd54fd5e480793b6495b74dbb7f872b58a1539e4595a5bb359e379eb139acab142a3640f39498c2eb8e67012051792daf252e53b357f1536ec112e943f6443
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsob:jxPAPJmtG
TLSH
T10235A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wevdtya.exe

Path C:\Windows\SysWOW64\wevdtya.exe
Size 1.0MB
SHA256 34af2bc8b538a16a4cc045f9ea20a29ed9d13c7a2b31094e3ce2b89dc1bed97d
MD5 6c7a907fbd5798b0d27222b86dd222ea
SHA1 1c12584f2a28db4e425f31ee216f31a9cec15e99
SHA512 4f662656ec267785202af87439302d817a45a720cf5a82354caa75be2ad090db0e33f592761edd0471566cf49121a92460bfe2dfd7958651f319d8075366d6d2
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsot:jxPAPJmto
TLSH
T15C35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wfdjtkk.exe

Path C:\Windows\SysWOW64\wfdjtkk.exe
Size 1.0MB
SHA256 ede1d1a0d18b7d7d8afb851b2b4031a3de06316068b267b28a9663eb4a314fd6
MD5 5796179786942a1395a5ea22d25833f8
SHA1 15c700aa37e950464a05c529e6d1c677167e3615
SHA512 f9bebeee0e8390149747e012b5b2f0a6d8c466f20d3710ae5b831756cfb62b5f344e86c5520ddba72eea2e41ad017cf3ab1bf05ecdf108a90aa5b39de9857a12
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsof:jxPAPJmtW
TLSH
T1E435A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wfnwp.exe

Path C:\Windows\SysWOW64\wfnwp.exe
Size 1.0MB
SHA256 0cfc7dc2b6bc6e8336f6a5ad14158ff51a79e011422af4ff1e61f7d961d6a077
MD5 10ad64b7c1c5577e983380aa8dec1154
SHA1 6a6714d694bf01a1a4d597c2d8ad4634c9056f6d
SHA512 f5aa5152b362ff494ab3c4d38cb5ba0a39c26f6adc62a1f844c104d29bf00f568da18c10f2f6c5461bd9d3cfd9941b4fafe652db40951dd9b2dce4c498bbd5d0
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoE:jxPAPJmtx
TLSH
T12335A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

whlcy.exe

Path C:\Windows\SysWOW64\whlcy.exe
Size 1.0MB
SHA256 0252f6e212e74e9ec5201e66177004c9e9823e9d644de2a18c4a38212b4afbd7
MD5 3779c8b12cda04f0237a264a02ec0e43
SHA1 f5dc4b11b63d88fbf236e8c1f39e5e77f4a57fbe
SHA512 e55f6a618996a3ab9fa0af6ff299549d73d395ea8a616a97272ceb22e882389e3db16f6e5cb175c2595898c898675e6cb1eab5c35967a139b4f27d14f52ff69a
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsox:jxPAPJmtU
TLSH
T15E35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wimibkj.exe

Path C:\Windows\SysWOW64\wimibkj.exe
Size 1.0MB
SHA256 ea5e7ea7efe1f4ac15867105108f399d2ee5117ada134cfb2e95d3616da9d62e
MD5 2a46184bb42ec3993ab59b2a9db2738e
SHA1 876ae8755806729a183960efcd8b201aad99e0da
SHA512 800844f087ee4ed5c39005867d1a252919e61d48e1d3730559fb5a5537d69d789292413ae8cdea90382932d930541305e67feeb457f983e244f4955ca0620926
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsog:jxPAPJmt5
TLSH
T15835A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wlrprrl.exe

Path C:\Windows\SysWOW64\wlrprrl.exe
Size 1.0MB
SHA256 a8e2b13323b6c18e001da7e55269a11efe179a32686aa8790cbd80f51470e2c1
MD5 088ad77013012bd76452ed954a2730cf
SHA1 f0880bcd6f8063fe48f1c9f66ef3536e5ab4d96c
SHA512 00829098a7f8c4d8a3d0ae9f29b596dd3dced667c23c836fc767e4cc11390ebb3ce7784512b1758c6f7d33dad69ecefe98e14459511e94b73810c2a6f7c73e5b
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoy:jxPAPJmtf
TLSH
T17F35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

womtxr.exe

Path C:\Windows\SysWOW64\womtxr.exe
Size 1.0MB
SHA256 189ccc8d62ebadfeab6bb82b74fa9dd1989b3b4931221d458925dd42625aec44
MD5 4abe8f71b634e6c17f734e67de643543
SHA1 a038a751f7fe28f02488e47325b837b30163b111
SHA512 abf2fd9a92a512c4755ee144c1ac063d0266d8d53f229554355fef918f646ab4637a27f03f3be3d23da01f439e2049bf0a2f63e0a569b4ea6f3556c82a09bf50
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nso/:jxPAPJmtm
TLSH
T17235A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrumymf.exe

Path C:\Windows\SysWOW64\wrumymf.exe
Size 1.0MB
SHA256 eb0bb85d95062add9d2edeb9719cf3bc6ffef07168337d9540d531191d0f69ba
MD5 c1e7b924c0fcec1a6a400e41860c6065
SHA1 7b959576c1a60fc5179463f393ae82b486b9a3ff
SHA512 303d480fdda7b3288b422d9cda3ae71ac5cb576f2fcc4964f66b79cdd1ed104ec5b1a0877376c8ea6ea85245c016b6a9f989186873ad05410684ca27e99cdea5
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoY:jxPAPJmtN
TLSH
T19535A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wswyfmwui.exe

Path C:\Windows\SysWOW64\wswyfmwui.exe
Size 1.0MB
SHA256 daa94256a7e77ee56bec97e6fb7cd0c8c4841a65b086de925bb31ca25bc0db5a
MD5 46fd760eef41ed765eb4377d8bf6f7f1
SHA1 c895f4671cc47ed2cb020809f987cc37fa8b2020
SHA512 fdc29250bdb720936bd7d985dfd49491156407b544d27d0c95daf0d9da596f9aa0a198b245e03a8a93b1c10dda0dc63d76ddccb7ac4e1c07b3a9e2ef96fbb248
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsom:jxPAPJmtf
TLSH
T1CE35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wud.exe

Path C:\Windows\SysWOW64\wud.exe
Size 1.0MB
SHA256 f2fb61e207dd80a5fe7cf533a1f62802bb336783945c837ef046a5151e2bfeca
MD5 1d0ede68a9c60f1c40d3020598ae9310
SHA1 f3cd4396fa33a8200b563b771173c0691b5dfc1f
SHA512 7274593f8959f126b5ffb65b0a4cf752d76789f0c115f36eac6dab311f75252953e1fa8db25477d11817c33b4d051b0ceb36db49d9bd6c918be1b4080da63073
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoq:jxPAPJmtv
TLSH
T13535A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wxhmafw.exe

Path C:\Windows\SysWOW64\wxhmafw.exe
Size 1.0MB
SHA256 d07171a89d32fc68bb850b4d4e23c61c2e041a07fe4ed47457c41272f00ab582
MD5 00ed473f1c5e3405b51d1285e3ca58ae
SHA1 02e7f58ea82429dd2e0d2d85a4163e4eacb41c97
SHA512 1cdc5c28418e9846e6a6eabd00c73e84bd60fa304a91e0934bf70e4269e8d38aa70d3ac3a41f664d54a6e66c97504234a45ae1870ee0530dfac3beec1f787e2e
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoD:jxPAPJmt+
TLSH
T19935A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wyqvwh.exe

Path C:\Windows\SysWOW64\wyqvwh.exe
Size 1.0MB
SHA256 641125c4581b041ed7ebb44a1fa9dccaeccb6636263f9a2817ca9bd4059f2ee5
MD5 d4641e5e27fdaa377c4bf6b7ce3eb080
SHA1 69c97197e4f0936584bacce0be6cda5fc4ef63a1
SHA512 ad895c739f562dcc0cec6f8e2ed66b9d1bfe7a128102faf3cd9ab92c8d227edf45fa59bf046554f2e9ee54ce45f7f021a39026191354d98f3ad2658140880c6f
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsox:jxPAPJmtE
TLSH
T12235A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1276-191-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1276-194-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1544-131-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1544-143-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1544-130-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1976-14-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1976-1-0x0000000000414000-0x0000000000415000-memory.dmp

Download

memory/1976-0-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1988-118-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1988-103-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2024-77-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2024-92-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2264-166-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2264-180-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2948-51-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2948-66-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3256-193-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3256-181-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3256-178-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3308-117-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3312-67-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3312-64-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3312-79-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3420-105-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3420-91-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3624-168-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3624-154-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3756-156-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3756-141-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3756-144-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4228-53-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4228-38-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4892-40-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4892-25-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5412-27-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5412-13-0x0000000000400000-0x000000000050A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads