01768fa95e9bd67026d3a8f27e9d42427a65203608d3947cbbc63cb06edad129

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/07/2026, 18:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_81b13e1db97860d794772f0ecceb7c94_elex_icedid_njrat.exe
Size 1.0MB
Sample260717-xjc4vsft21
SHA256 01768fa95e9bd67026d3a8f27e9d42427a65203608d3947cbbc63cb06edad129
MD5 81b13e1db97860d794772f0ecceb7c94
SHA1 31ddf9883db5a0550c424e94011ddacecaf532f4
SHA512 f66ccb88c69aacf8a79de1c126879889df61d9aa22b37eb88a89cfb2ab455507f90be2aa00ec88f3e4716bf21c2af6c145549436230c14624812e9f0f36485e1
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nso4:jxPAPJmtD
TLSH
T12835A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	2026-07-17_81b13e1db97860d794772f0ecceb7c94_elex_icedid_njrat.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	wqgn.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	wxqfmk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	wglsqog.exe

Executes dropped EXE 4 IoCs

pid	Process
1344	wqgn.exe
5116	wxqfmk.exe
3356	wglsqog.exe
5012	wgsolvtd.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wxqfmk.exe	wqgn.exe
File opened for modification	C:\Windows\SysWOW64\wxqfmk.exe	wqgn.exe
File created	C:\Windows\SysWOW64\wglsqog.exe	wxqfmk.exe
File opened for modification	C:\Windows\SysWOW64\wglsqog.exe	wxqfmk.exe
File created	C:\Windows\SysWOW64\wgsolvtd.exe	wglsqog.exe
File opened for modification	C:\Windows\SysWOW64\wgsolvtd.exe	wglsqog.exe
File created	C:\Windows\SysWOW64\wijaxu.exe	wgsolvtd.exe
File created	C:\Windows\SysWOW64\wqgn.exe	2026-07-17_81b13e1db97860d794772f0ecceb7c94_elex_icedid_njrat.exe
File opened for modification	C:\Windows\SysWOW64\wqgn.exe	2026-07-17_81b13e1db97860d794772f0ecceb7c94_elex_icedid_njrat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_81b13e1db97860d794772f0ecceb7c94_elex_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wglsqog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wgsolvtd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wxqfmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 1344	4888	2026-07-17_81b13e1db97860d794772f0ecceb7c94_elex_icedid_njrat.exe	92
PID 4888 wrote to memory of 4400	4888	2026-07-17_81b13e1db97860d794772f0ecceb7c94_elex_icedid_njrat.exe	94
PID 1344 wrote to memory of 5116	1344	wqgn.exe	96
PID 1344 wrote to memory of 4700	1344	wqgn.exe	97
PID 5116 wrote to memory of 3356	5116	wxqfmk.exe	101
PID 5116 wrote to memory of 1464	5116	wxqfmk.exe	102
PID 3356 wrote to memory of 5012	3356	wglsqog.exe	104
PID 3356 wrote to memory of 4256	3356	wglsqog.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-07-17_81b13e1db97860d794772f0ecceb7c94_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_81b13e1db97860d794772f0ecceb7c94_elex_icedid_njrat.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\SysWOW64\wqgn.exe
  "C:\Windows\system32\wqgn.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Windows\SysWOW64\wxqfmk.exe
    "C:\Windows\system32\wxqfmk.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5116
  - - C:\Windows\SysWOW64\wglsqog.exe
      "C:\Windows\system32\wglsqog.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3356
    - - C:\Windows\SysWOW64\wgsolvtd.exe
        
        "C:\Windows\system32\wgsolvtd.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5012
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wglsqog.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4256
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxqfmk.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1464
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wqgn.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4700
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\2026-07-17_81b13e1db97860d794772f0ecceb7c94_elex_icedid_njrat.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wglsqog.exe

Path C:\Windows\SysWOW64\wglsqog.exe
Size 1.0MB
SHA256 c8104f7fa2920d6f2311dc1e70c49bbf8b03c29a243d5699368e5d89bf3984b0
MD5 b7fcc62881caad7b85ff2db108f6415b
SHA1 d8bfbd9c719888ede869db87bb88def4d011c3b5
SHA512 caf7dd9c56a4fcb27058ea3dd35fbff861741d55cc557dae5a411e5ae7089184f6f2236970d3ad374aad34447bb209849c9427b43d68ae607cdb85f39888e360
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsov:jxPAPJmtK
TLSH
T1D035A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wgsolvtd.exe

Path C:\Windows\SysWOW64\wgsolvtd.exe
Size 1.0MB
SHA256 65cf7d6ef9f4b8d6c1ddcbc1813bd22ac619388cf6eab107f4daef4c7114efa3
MD5 74078ef02a8cef6ddd9466825f88aaa9
SHA1 e2ca9885f37cf0abafe24b01b8470695ff5d0974
SHA512 5b91b4fba9d85c0870885ee23f3c123076b73d4a4bd08d94a58a2bf8707e3389688458186b4533eee62a4d62390c7b3905a64c58e8a28489ef1cc338ea33b4c2
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsox:jxPAPJmty
TLSH
T18635A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqgn.exe

Path C:\Windows\SysWOW64\wqgn.exe
Size 1.0MB
SHA256 51c8876d2bb478982f878fe5cff69351317442162b42a34e75dff820acade887
MD5 fa638e788eab7a9c3c24f69bbe05974a
SHA1 7ca8e855786ee0be93e53301b39f530fc6798d65
SHA512 fae5fae186ea52254d8b7cbde8ba45f8d59bb39774da34dbfbe09136da410976095d700db1e858240c0603ad06aa0b015628ec7c7d81f93d9bb2d21cb33ca996
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nso9:jxPAPJmtE
TLSH
T16235A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wxqfmk.exe

Path C:\Windows\SysWOW64\wxqfmk.exe
Size 1.0MB
SHA256 bcc80809779696827c4c1ba9af1a04242e99b1e041dddbd5252446e1fbbd63be
MD5 a24e04d4dddfc86a63cd4427e6cb06b8
SHA1 f501f8ec4d3eccbb5fa83a6f8974725a2dc6399d
SHA512 097797d557de8587e26a43b14dd9af8200200ecfbba61b99450dc54c643fca9f4a486e6c0714e5a2cf4b642b577104324024eafbfef9f32f5d2804962f0ff195
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nso3:jxPAPJmt0
TLSH
T13A35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1344-27-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1344-14-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3356-39-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3356-41-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3356-52-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4888-15-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4888-3-0x0000000000414000-0x0000000000415000-memory.dmp

Download

memory/4888-2-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4888-0-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4888-1-0x0000000000414000-0x0000000000415000-memory.dmp

Download

memory/5012-51-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5116-26-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5116-28-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5116-40-0x0000000000400000-0x000000000050A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads