f4a5b3e2ab1bd5c474a112d8c11130f6f9a1d51462670540eb90951f2317952a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_4d6221acb4a6f3ade841c6d1b9ed45de_elex_icedid_njrat.exe
Size 1.0MB
Sample260722-wffvxa1bpg
SHA256 f4a5b3e2ab1bd5c474a112d8c11130f6f9a1d51462670540eb90951f2317952a
MD5 4d6221acb4a6f3ade841c6d1b9ed45de
SHA1 19fe194d125e7412310196e7f4c87eb7b9dc90af
SHA512 5655fa3f246b20c8309d77366fec98835509539ddc390c2746836898ebb8c82ff8331b52e022c3b1d2692c6504ad2e0586c316c7746572146b44375ac97ce4bf
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoN:jxPAPJmta
TLSH
T16235A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	wsgynslia.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	wakavl.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	wmrxmya.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	wrfnnmtcg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	2026-07-22_4d6221acb4a6f3ade841c6d1b9ed45de_elex_icedid_njrat.exe

Executes dropped EXE 5 IoCs

pid	Process
1664	wsgynslia.exe
3836	wakavl.exe
776	wmrxmya.exe
2752	wrfnnmtcg.exe
4776	wbttam.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wsgynslia.exe	2026-07-22_4d6221acb4a6f3ade841c6d1b9ed45de_elex_icedid_njrat.exe
File opened for modification	C:\Windows\SysWOW64\wsgynslia.exe	2026-07-22_4d6221acb4a6f3ade841c6d1b9ed45de_elex_icedid_njrat.exe
File created	C:\Windows\SysWOW64\wmrxmya.exe	wakavl.exe
File opened for modification	C:\Windows\SysWOW64\wmrxmya.exe	wakavl.exe
File created	C:\Windows\SysWOW64\wrfnnmtcg.exe	wmrxmya.exe
File opened for modification	C:\Windows\SysWOW64\wrfnnmtcg.exe	wmrxmya.exe
File created	C:\Windows\SysWOW64\wbttam.exe	wrfnnmtcg.exe
File opened for modification	C:\Windows\SysWOW64\wbttam.exe	wrfnnmtcg.exe
File created	C:\Windows\SysWOW64\wakavl.exe	wsgynslia.exe
File opened for modification	C:\Windows\SysWOW64\wakavl.exe	wsgynslia.exe
File created	C:\Windows\SysWOW64\weoyfebjr.exe	wbttam.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1160	3660	WerFault.exe	87
4912	3836	WerFault.exe	108
4556	2752	WerFault.exe	118

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_4d6221acb4a6f3ade841c6d1b9ed45de_elex_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wakavl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmrxmya.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrfnnmtcg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wsgynslia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wbttam.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 1664	3660	2026-07-22_4d6221acb4a6f3ade841c6d1b9ed45de_elex_icedid_njrat.exe	89
PID 3660 wrote to memory of 4424	3660	2026-07-22_4d6221acb4a6f3ade841c6d1b9ed45de_elex_icedid_njrat.exe	91
PID 1664 wrote to memory of 3836	1664	wsgynslia.exe	108
PID 1664 wrote to memory of 2420	1664	wsgynslia.exe	109
PID 3836 wrote to memory of 776	3836	wakavl.exe	112
PID 3836 wrote to memory of 2572	3836	wakavl.exe	113
PID 776 wrote to memory of 2752	776	wmrxmya.exe	118
PID 776 wrote to memory of 1244	776	wmrxmya.exe	119
PID 2752 wrote to memory of 4776	2752	wrfnnmtcg.exe	122
PID 2752 wrote to memory of 1952	2752	wrfnnmtcg.exe	123

C:\Users\Admin\AppData\Local\Temp\2026-07-22_4d6221acb4a6f3ade841c6d1b9ed45de_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_4d6221acb4a6f3ade841c6d1b9ed45de_elex_icedid_njrat.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Windows\SysWOW64\wsgynslia.exe
  "C:\Windows\system32\wsgynslia.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\SysWOW64\wakavl.exe
    "C:\Windows\system32\wakavl.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3836
  - - C:\Windows\SysWOW64\wmrxmya.exe
      "C:\Windows\system32\wmrxmya.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:776
    - - C:\Windows\SysWOW64\wrfnnmtcg.exe
        
        "C:\Windows\system32\wrfnnmtcg.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2752
      - C:\Windows\SysWOW64\wbttam.exe
        
        "C:\Windows\system32\wbttam.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4776
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wrfnnmtcg.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1952
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 1100
        6⤵
        Program crash
        
        PID:4556
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wmrxmya.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1244
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wakavl.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2572
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 1516
      4⤵
      Program crash
      PID:4912
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wsgynslia.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2420
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\2026-07-22_4d6221acb4a6f3ade841c6d1b9ed45de_elex_icedid_njrat.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3660 -s 1412
  2⤵
  - Program crash
  PID:1160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3660 -ip 3660
1⤵
PID:2844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3836 -ip 3836
1⤵
PID:3020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2752 -ip 2752
1⤵
PID:652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wakavl.exe

Path C:\Windows\SysWOW64\wakavl.exe
Size 1.0MB
SHA256 fcf44892008491bd8910e11d8583c4e49569008d1e20caa2842d73eb0e29d97c
MD5 4118a2206766557ee8f5a07a2f2a0a01
SHA1 da4ede744a52bc69ae80c6dc202d724124431bb3
SHA512 019cf3eb99672dd7f204a7a3ddd60e67e8db3feb735eb91bd8dbee2f52770bec9078e5df025585a67f645151c8d40706c01a67244176b12aa4c623c4423c50e3
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsot:jxPAPJmt6
TLSH
T17935A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbttam.exe

Path C:\Windows\SysWOW64\wbttam.exe
Size 1.0MB
SHA256 f62aacb117386e7be5208966f411dcd985105559cd68663ff46d116a2819d222
MD5 324a70034898cb17df2669050475deea
SHA1 e572c3a0a6343f97ab8b0bcae3f100e0433db3ce
SHA512 57aeabf4c045ea65cc186a433ded96ba795de48b8e51b4d554d4206da1f6399cd61908ee691811a02876839e5c722c5f8af7669f693fb715ea8096512547d883
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nso/:jxPAPJmtu
TLSH
T10035A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmrxmya.exe

Path C:\Windows\SysWOW64\wmrxmya.exe
Size 1.0MB
SHA256 b782b19f60d675415fdf1a97a7945809f7ec4687a56a54652f98725f78f57ead
MD5 4f20f354f9f21a4e183d10db4529a0c0
SHA1 e92e7c1fa55fd86a0d5685ecd98454c8eabb6808
SHA512 c0803d60f13f2965c687aeb8598d4266a8e25a18620264dd193121feaafaf5e546ecb3bbae053a27fccfe0da55f3b01912eed601b06dfbc526f0cbcfb000d469
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoA:jxPAPJmtl
TLSH
T14235A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrfnnmtcg.exe

Path C:\Windows\SysWOW64\wrfnnmtcg.exe
Size 1.0MB
SHA256 250c0f0d2bfe94d3eb858203366ad839cf236427497e8365c60b49341b902ae1
MD5 807ca5e2b98f1ae6007536a7687a493f
SHA1 9cf7ede67caf68b32776130648c76e305a4ee82d
SHA512 04ea832eb9430c1a1ce37750f182745deb3269815c1a82508b907c023cea1c813fe161cf843c63d6ff964975f75fb42b2d8780fa58375eb6668dcedbceabaf83
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoz:jxPAPJmt0
TLSH
T17C35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgynslia.exe

Path C:\Windows\SysWOW64\wsgynslia.exe
Size 1.0MB
SHA256 24b717012f2f6d99bb19ad17a318e949193946be6e713ec392dd7f12620fb8ba
MD5 107c31a0a4ff1b714b19a3440ad65efe
SHA1 f35d3874bde8630173182ab63829255b6e7be33b
SHA512 261d66120836ab876292babc7679f51e53ef967da8f06506ebc3734cea9236c4db903d42ec60ebc249c832afc3f769a97899e3b2bdfd81df5a22c901a557da40
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsor:jxPAPJmtO
TLSH
T1F235A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/776-50-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/776-37-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1664-26-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1664-13-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1664-15-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2752-49-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2752-62-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2752-51-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3660-0-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3660-12-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3660-1-0x0000000000414000-0x0000000000415000-memory.dmp

Download

memory/3660-14-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3836-38-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3836-25-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4776-61-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4776-63-0x0000000000400000-0x000000000050A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads