fba44f4ea2f5d6802fa0f082ed228605a90126dc26a07738d68268d508e9874b

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_8935ee68df4f1e4b7e3df855cc26647d_elex_icedid_njrat.exe
Size 1.0MB
Sample260728-e94qdsywh1
SHA256 fba44f4ea2f5d6802fa0f082ed228605a90126dc26a07738d68268d508e9874b
MD5 8935ee68df4f1e4b7e3df855cc26647d
SHA1 b96a228aa5e6d04a300546b94ca87d2c23dce96f
SHA512 d1d285317613516ab6b4318682ff3548b9a8bc52f83c6829905ccbddb8a9e919513275d779236350aaa1f0204411b8a2323ca06585888bcbb3b1414bcd7f60f3
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoK:jxPAPJmtN
TLSH
T14B35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3412	wuqqcooo.exe
5632	wuuqhe.exe
5620	wqbhga.exe
5736	wes.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wes.exe	wqbhga.exe
File created	C:\Windows\SysWOW64\wgmu.exe	wes.exe
File opened for modification	C:\Windows\SysWOW64\wuqqcooo.exe	2026-07-28_8935ee68df4f1e4b7e3df855cc26647d_elex_icedid_njrat.exe
File opened for modification	C:\Windows\SysWOW64\wuuqhe.exe	wuqqcooo.exe
File created	C:\Windows\SysWOW64\wes.exe	wqbhga.exe
File created	C:\Windows\SysWOW64\wuqqcooo.exe	2026-07-28_8935ee68df4f1e4b7e3df855cc26647d_elex_icedid_njrat.exe
File created	C:\Windows\SysWOW64\wuuqhe.exe	wuqqcooo.exe
File created	C:\Windows\SysWOW64\wqbhga.exe	wuuqhe.exe
File opened for modification	C:\Windows\SysWOW64\wqbhga.exe	wuuqhe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuuqhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_8935ee68df4f1e4b7e3df855cc26647d_elex_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuqqcooo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqbhga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wes.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 3412	4380	2026-07-28_8935ee68df4f1e4b7e3df855cc26647d_elex_icedid_njrat.exe	89
PID 4380 wrote to memory of 3332	4380	2026-07-28_8935ee68df4f1e4b7e3df855cc26647d_elex_icedid_njrat.exe	90
PID 3412 wrote to memory of 5632	3412	wuqqcooo.exe	93
PID 3412 wrote to memory of 4656	3412	wuqqcooo.exe	94
PID 5632 wrote to memory of 5620	5632	wuuqhe.exe	96
PID 5632 wrote to memory of 2352	5632	wuuqhe.exe	97
PID 5620 wrote to memory of 5736	5620	wqbhga.exe	99
PID 5620 wrote to memory of 3504	5620	wqbhga.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-07-28_8935ee68df4f1e4b7e3df855cc26647d_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_8935ee68df4f1e4b7e3df855cc26647d_elex_icedid_njrat.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Windows\SysWOW64\wuqqcooo.exe
  "C:\Windows\system32\wuqqcooo.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3412
- - C:\Windows\SysWOW64\wuuqhe.exe
    "C:\Windows\system32\wuuqhe.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5632
  - - C:\Windows\SysWOW64\wqbhga.exe
      "C:\Windows\system32\wqbhga.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5620
    - - C:\Windows\SysWOW64\wes.exe
        
        "C:\Windows\system32\wes.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5736
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wqbhga.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3504
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wuuqhe.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2352
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wuqqcooo.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4656
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\2026-07-28_8935ee68df4f1e4b7e3df855cc26647d_elex_icedid_njrat.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wes.exe

Path C:\Windows\SysWOW64\wes.exe
Size 1.0MB
SHA256 f439c47e7f1b85ede4d9be7b209b3e4168968e24353bb4a5a0c65bcee6fd2057
MD5 a0c66f9ca0e4ec86bf1ed6edfb787fff
SHA1 49a01802df3151a47fc4766b699cc91302df4805
SHA512 f3db00ab1f5002d24cf10a884e45c3f6fa50fec9dfdcfbb936651577670354002778b1aaf7cfc2866944c8e81a9e348e303af73c755004bcf684567e8c9a3611
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsok:jxPAPJmtb
TLSH
T14D35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqbhga.exe

Path C:\Windows\SysWOW64\wqbhga.exe
Size 1.0MB
SHA256 148cf2ef84134f432fa01742582a28fe4fdcc70f6b7de3d10e0b217252cd8949
MD5 cd5d93a8ddf900eac3d612d25b740534
SHA1 ba5ba4a0c073f204827dbbd64c7ae5874dc317fe
SHA512 109caff128978c5378e4ee8cb6ae0a0f02b9501ea13b364425057e8d9db1f6fb7eaddb0299b9f1ae682fb11744ea67252bcda2e2af1b7bf5ff99fe172d6f17f5
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoV:jxPAPJmtG
TLSH
T15E35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuqqcooo.exe

Path C:\Windows\SysWOW64\wuqqcooo.exe
Size 1.0MB
SHA256 68695e4be88b08a72afdd83d12aff44fb72c572f8e131fda5ce5d95ca472db48
MD5 0f4c0eb4ca7c37b6dedb741aa33bcbb5
SHA1 7d93aa720cd407a4d59379969fc9b64cc3693bd3
SHA512 2395e45a50e3c5a97a9a8743d322fb678cd1f92193643770532bba849032edc8df19956e864ef6fa086822866dc135e28c1a277f505c411a44d807f1bd985e0b
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoJ:jxPAPJmt+
TLSH
T17735A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuuqhe.exe

Path C:\Windows\SysWOW64\wuuqhe.exe
Size 1.0MB
SHA256 9ab128faf91f0d6a1547a4c0bdb66aa0d34a627ffdcd80ca10e96bd260028bd0
MD5 33892fa9de170959d324bb6547d75ec0
SHA1 2ad27d670937bdd5f0fb393231a248d6ff25d4ff
SHA512 4ec60f7c0887410004791dcf5602a01d7b1d46e3ea35eba958865dbf3f5f1f8be18c46a484001ad5e3beecd4905d0b3e18ab0bc3df9c2e203a46c462a1abaef3
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nso3:jxPAPJmtQ
TLSH
T1C135A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3412-28-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3412-16-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3412-14-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4380-15-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4380-3-0x0000000000414000-0x0000000000415000-memory.dmp

Download

memory/4380-0-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4380-2-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4380-1-0x0000000000414000-0x0000000000415000-memory.dmp

Download

memory/5620-42-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5620-55-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5620-39-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5632-29-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5632-41-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5632-27-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5736-54-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5736-56-0x0000000000400000-0x000000000050A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads