f4a5b3e2ab1bd5c474a112d8c11130f6f9a1d51462670540eb90951f2317952a

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_4d6221acb4a6f3ade841c6d1b9ed45de_elex_icedid_njrat.exe
Size 1.0MB
Sample260722-wffvxa1bpg
SHA256 f4a5b3e2ab1bd5c474a112d8c11130f6f9a1d51462670540eb90951f2317952a
MD5 4d6221acb4a6f3ade841c6d1b9ed45de
SHA1 19fe194d125e7412310196e7f4c87eb7b9dc90af
SHA512 5655fa3f246b20c8309d77366fec98835509539ddc390c2746836898ebb8c82ff8331b52e022c3b1d2692c6504ad2e0586c316c7746572146b44375ac97ce4bf
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoN:jxPAPJmta
TLSH
T16235A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
6100	wkagrsjnk.exe
2680	wjcs.exe
1836	wqohdxp.exe
4656	wovel.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wkagrsjnk.exe	2026-07-22_4d6221acb4a6f3ade841c6d1b9ed45de_elex_icedid_njrat.exe
File opened for modification	C:\Windows\SysWOW64\wkagrsjnk.exe	2026-07-22_4d6221acb4a6f3ade841c6d1b9ed45de_elex_icedid_njrat.exe
File created	C:\Windows\SysWOW64\wjcs.exe	wkagrsjnk.exe
File opened for modification	C:\Windows\SysWOW64\wjcs.exe	wkagrsjnk.exe
File created	C:\Windows\SysWOW64\wqohdxp.exe	wjcs.exe
File created	C:\Windows\SysWOW64\wovel.exe	wqohdxp.exe
File opened for modification	C:\Windows\SysWOW64\wovel.exe	wqohdxp.exe
File opened for modification	C:\Windows\SysWOW64\wqohdxp.exe	wjcs.exe
File created	C:\Windows\SysWOW64\wjhrk.exe	wovel.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wovel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_4d6221acb4a6f3ade841c6d1b9ed45de_elex_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wkagrsjnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wjcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqohdxp.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 6100	1012	2026-07-22_4d6221acb4a6f3ade841c6d1b9ed45de_elex_icedid_njrat.exe	89
PID 1012 wrote to memory of 4280	1012	2026-07-22_4d6221acb4a6f3ade841c6d1b9ed45de_elex_icedid_njrat.exe	90
PID 6100 wrote to memory of 2680	6100	wkagrsjnk.exe	92
PID 6100 wrote to memory of 2232	6100	wkagrsjnk.exe	93
PID 2680 wrote to memory of 1836	2680	wjcs.exe	95
PID 2680 wrote to memory of 2316	2680	wjcs.exe	96
PID 1836 wrote to memory of 4656	1836	wqohdxp.exe	98
PID 1836 wrote to memory of 1476	1836	wqohdxp.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-07-22_4d6221acb4a6f3ade841c6d1b9ed45de_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_4d6221acb4a6f3ade841c6d1b9ed45de_elex_icedid_njrat.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Windows\SysWOW64\wkagrsjnk.exe
  "C:\Windows\system32\wkagrsjnk.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6100
- - C:\Windows\SysWOW64\wjcs.exe
    "C:\Windows\system32\wjcs.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\Windows\SysWOW64\wqohdxp.exe
      "C:\Windows\system32\wqohdxp.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1836
    - - C:\Windows\SysWOW64\wovel.exe
        
        "C:\Windows\system32\wovel.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4656
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wqohdxp.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1476
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjcs.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2316
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkagrsjnk.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2232
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\2026-07-22_4d6221acb4a6f3ade841c6d1b9ed45de_elex_icedid_njrat.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wjcs.exe

Path C:\Windows\SysWOW64\wjcs.exe
Size 1.0MB
SHA256 cd4195642cde380295f31aee746ba79f3173b96200150e402dab43c5acca8e1d
MD5 a5bde28fdd27604591ea0f16ce8f996c
SHA1 15664abdfc776996e3a422a14c35aa85b48da180
SHA512 ae214ba5dfa66fb612c7e721db9b6a81c499a9e6a42c8e648e0050a09b2b5fdf208e7ef70930f40562bd412a8b6c1ddc4bcf0b61e0c0e2e7729faf242462b4ad
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoR:jxPAPJmtK
TLSH
T1C835A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wkagrsjnk.exe

Path C:\Windows\SysWOW64\wkagrsjnk.exe
Size 1.0MB
SHA256 8056409140f88a6df9f501b0031918096bef36e607f5c1956ea82549b96c1289
MD5 c5d23931de5e7fa84bfc1c3805f6115b
SHA1 541ef8bafe4f9460eeb99a2dc3cd9d85334cc1ac
SHA512 074cea1edb32c728a846726cf7df8553785d2933b46103247aa096a35de2dcfe88f5afa46ca8e1ca737590254b1579c45c904b4f2e231dcbee6beca181920dad
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoX:jxPAPJmtW
TLSH
T12A35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wovel.exe

Path C:\Windows\SysWOW64\wovel.exe
Size 1.0MB
SHA256 89a252b26c602131a0ed6624c3a1a9a8b7a6bcef2c15cf212dfe1a322022f251
MD5 4e2eccea7e3f04538828b54e8edfe0d3
SHA1 8b563b225000f9cbde5b6029c3f4d5caf5d5ba2c
SHA512 e020d368f77d2a779a4211993905550de3cdcc95a042ff8e6f13fb9360bdfef099390665f64b531ba48b260f5a1563857e617b003aee7ddf7d9b490b5aafa99a
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nson:jxPAPJmtk
TLSH
T17435A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqohdxp.exe

Path C:\Windows\SysWOW64\wqohdxp.exe
Size 1.0MB
SHA256 8613e0abe11c16964334d59cc5c57131d02fce2e877e32352fa3efc3917bca7b
MD5 ed622570cc01484aab16d4e15037f376
SHA1 43e6c29051982a4d58e47cf76b0c1497857395b8
SHA512 0c79b3ac08b89da0e041fff00a49e3fd4b462befc8c7a75f1793e8342351e4befb1019018b7fefc143aae15956663d6a930f848c3a290b603a146e55b90e9d73
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoV:jxPAPJmts
TLSH
T1A435A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1012-3-0x0000000000414000-0x0000000000415000-memory.dmp

Download

memory/1012-0-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1012-16-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1012-1-0x0000000000414000-0x0000000000415000-memory.dmp

Download

memory/1012-2-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1836-56-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1836-41-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2680-30-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2680-27-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2680-43-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4656-54-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4656-57-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/6100-29-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/6100-17-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/6100-15-0x0000000000400000-0x000000000050A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads