01768fa95e9bd67026d3a8f27e9d42427a65203608d3947cbbc63cb06edad129

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 18:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_81b13e1db97860d794772f0ecceb7c94_elex_icedid_njrat.exe
Size 1.0MB
Sample260717-xjc4vsft21
SHA256 01768fa95e9bd67026d3a8f27e9d42427a65203608d3947cbbc63cb06edad129
MD5 81b13e1db97860d794772f0ecceb7c94
SHA1 31ddf9883db5a0550c424e94011ddacecaf532f4
SHA512 f66ccb88c69aacf8a79de1c126879889df61d9aa22b37eb88a89cfb2ab455507f90be2aa00ec88f3e4716bf21c2af6c145549436230c14624812e9f0f36485e1
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nso4:jxPAPJmtD
TLSH
T12835A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
5092	wupn.exe
2988	whimx.exe
836	welrnuhy.exe
516	whksqh.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wupn.exe	2026-07-17_81b13e1db97860d794772f0ecceb7c94_elex_icedid_njrat.exe
File opened for modification	C:\Windows\SysWOW64\wupn.exe	2026-07-17_81b13e1db97860d794772f0ecceb7c94_elex_icedid_njrat.exe
File opened for modification	C:\Windows\SysWOW64\whimx.exe	wupn.exe
File opened for modification	C:\Windows\SysWOW64\welrnuhy.exe	whimx.exe
File created	C:\Windows\SysWOW64\whksqh.exe	welrnuhy.exe
File created	C:\Windows\SysWOW64\whimx.exe	wupn.exe
File created	C:\Windows\SysWOW64\welrnuhy.exe	whimx.exe
File opened for modification	C:\Windows\SysWOW64\whksqh.exe	welrnuhy.exe
File created	C:\Windows\SysWOW64\wjrjauw.exe	whksqh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5632	2988	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_81b13e1db97860d794772f0ecceb7c94_elex_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	whimx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	welrnuhy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	whksqh.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5644 wrote to memory of 5092	5644	2026-07-17_81b13e1db97860d794772f0ecceb7c94_elex_icedid_njrat.exe	88
PID 5644 wrote to memory of 1080	5644	2026-07-17_81b13e1db97860d794772f0ecceb7c94_elex_icedid_njrat.exe	89
PID 5092 wrote to memory of 2988	5092	wupn.exe	92
PID 5092 wrote to memory of 2596	5092	wupn.exe	93
PID 2988 wrote to memory of 836	2988	whimx.exe	95
PID 2988 wrote to memory of 3812	2988	whimx.exe	96
PID 836 wrote to memory of 516	836	welrnuhy.exe	101
PID 836 wrote to memory of 2948	836	welrnuhy.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-07-17_81b13e1db97860d794772f0ecceb7c94_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_81b13e1db97860d794772f0ecceb7c94_elex_icedid_njrat.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5644
- C:\Windows\SysWOW64\wupn.exe
  "C:\Windows\system32\wupn.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Windows\SysWOW64\whimx.exe
    "C:\Windows\system32\whimx.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2988
  - - C:\Windows\SysWOW64\welrnuhy.exe
      "C:\Windows\system32\welrnuhy.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:836
    - - C:\Windows\SysWOW64\whksqh.exe
        
        "C:\Windows\system32\whksqh.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:516
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\welrnuhy.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2948
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\whimx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3812
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 1660
      4⤵
      Program crash
      PID:5632
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wupn.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2596
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\2026-07-17_81b13e1db97860d794772f0ecceb7c94_elex_icedid_njrat.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2988 -ip 2988
1⤵
PID:4180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

welrnuhy.exe

Path C:\Windows\SysWOW64\welrnuhy.exe
Size 1.0MB
SHA256 fe8a288257434dab19bd94a84b4d23f84ae9b05ba75b2384c17958001828a9ad
MD5 dc667ff860ce2ea2491a1d6599b8a0d3
SHA1 601d06a78e5ebce8c3b7abce1564e1f386f72f2e
SHA512 a152f633ed9f407091ba1613035e2d7261c92a07aedf22d7ac6a532a4c2a98c11581a56e82f577fd72f572dd2178ade224e3ffb7b8f041f2e5f4f69b2e079e94
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoB:jxPAPJmt4
TLSH
T17535A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

whimx.exe

Path C:\Windows\SysWOW64\whimx.exe
Size 1.0MB
SHA256 0ac7e68b8ee6e9edd771fd794681ea48a64cf91b2f7ff679ed0725ca0722f3f8
MD5 7344386fc0114ab621d118dd58b6727b
SHA1 55906c2736c6346d6ee756e4ba3d2183af8eaeb8
SHA512 ac63a39abc3c7cc93a80171874039e1d7245f281593743a8ab73d02ab1448166c53240cea7974f28750843f1298f5d734a0101c43d61932e6c2d19264d2927b4
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsog:jxPAPJmtD
TLSH
T12835A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

whksqh.exe

Path C:\Windows\SysWOW64\whksqh.exe
Size 1.0MB
SHA256 02b9c9fc01d0e1d220903172ffe787fea52f410c505e8fcefc9602c77f37a0d8
MD5 d8a67c62df9f7eecfa8b70eb8de3c10b
SHA1 8699f4d966d9a54c5a85d4f952ddd96805f0241b
SHA512 6840ffe8e973f326f9abccb8faf1dfaa3f051520d0574615890d9a0dc91eb3f8f365f2bf65e35842a1197147025fbc79918a7f7a168018e4895440b4b36a41a3
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoE:jxPAPJmtf
TLSH
T18E35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wupn.exe

Path C:\Windows\SysWOW64\wupn.exe
Size 1.0MB
SHA256 e11557a1dbcbe7cccf0430ad35a114205a81e80f4b507431a203f1dda0a0c8bb
MD5 a1cab1fd8d0994a6d3e1fb41178a3b18
SHA1 caea7d714c05cbd372ba369de7d6aac19f8b6e7a
SHA512 5ff582bd78bbe37ac527726a578a888983d6673e2a92141c40ce1851bdf036ee40a15cfd34433e44473778c906651e53850e17895ee6c557cfe5f6737c930817
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsop:jxPAPJmt8
TLSH
T1E035A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/516-54-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/516-52-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/836-39-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/836-53-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/836-41-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2988-26-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2988-29-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5092-28-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5092-15-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5092-12-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5644-0-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5644-14-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5644-1-0x0000000000414000-0x0000000000415000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads