8c9de79523eba37f2e8816a41d1f4d325dc8a451523dad05df8f676bd57b5f5d

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 13:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_c27ea9bfcf2656c14960fe3f218ddb37_elex_icedid_njrat.exe
Size 1.0MB
Sample260731-q2stpsgr91
SHA256 8c9de79523eba37f2e8816a41d1f4d325dc8a451523dad05df8f676bd57b5f5d
MD5 c27ea9bfcf2656c14960fe3f218ddb37
SHA1 c8d9628e2a7b84e0dbbe02de1d533d71bec12e15
SHA512 08d4577e5136f76e4caaa488d11217fa55384e5d7bc2e0b7385c2f8e7c850e6300cb1d00d46a342d02844e7ad828b8e11264e53cb0ce40129ad75c1dda2ccbd5
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoI:jxPAPJmt1
TLSH
T1A735A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
4440	wqgow.exe
3668	wwvm.exe
1296	wplc.exe
3940	wwqcc.exe
2748	wktxfog.exe
6056	wmbmnbrb.exe
2044	wvolmd.exe
4752	wtt.exe
5536	wmmxeont.exe
3468	wvglj.exe
2500	wmuljdcnm.exe
4484	wlqii.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 25 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wwqcc.exe	wplc.exe
File created	C:\Windows\SysWOW64\wvolmd.exe	wmbmnbrb.exe
File opened for modification	C:\Windows\SysWOW64\wvolmd.exe	wmbmnbrb.exe
File opened for modification	C:\Windows\SysWOW64\wmmxeont.exe	wtt.exe
File opened for modification	C:\Windows\SysWOW64\wvglj.exe	wmmxeont.exe
File created	C:\Windows\SysWOW64\wmuljdcnm.exe	wvglj.exe
File opened for modification	C:\Windows\SysWOW64\wqgow.exe	2026-07-31_c27ea9bfcf2656c14960fe3f218ddb37_elex_icedid_njrat.exe
File opened for modification	C:\Windows\SysWOW64\wktxfog.exe	wwqcc.exe
File opened for modification	C:\Windows\SysWOW64\wmbmnbrb.exe	wktxfog.exe
File created	C:\Windows\SysWOW64\wmmxeont.exe	wtt.exe
File created	C:\Windows\SysWOW64\wvglj.exe	wmmxeont.exe
File opened for modification	C:\Windows\SysWOW64\wmuljdcnm.exe	wvglj.exe
File created	C:\Windows\SysWOW64\wxlvto.exe	wlqii.exe
File created	C:\Windows\SysWOW64\wwvm.exe	wqgow.exe
File created	C:\Windows\SysWOW64\wktxfog.exe	wwqcc.exe
File opened for modification	C:\Windows\SysWOW64\wtt.exe	wvolmd.exe
File created	C:\Windows\SysWOW64\wlqii.exe	wmuljdcnm.exe
File created	C:\Windows\SysWOW64\wqgow.exe	2026-07-31_c27ea9bfcf2656c14960fe3f218ddb37_elex_icedid_njrat.exe
File created	C:\Windows\SysWOW64\wplc.exe	wwvm.exe
File opened for modification	C:\Windows\SysWOW64\wplc.exe	wwvm.exe
File opened for modification	C:\Windows\SysWOW64\wwqcc.exe	wplc.exe
File created	C:\Windows\SysWOW64\wmbmnbrb.exe	wktxfog.exe
File created	C:\Windows\SysWOW64\wtt.exe	wvolmd.exe
File opened for modification	C:\Windows\SysWOW64\wlqii.exe	wmuljdcnm.exe
File opened for modification	C:\Windows\SysWOW64\wwvm.exe	wqgow.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqgow.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wwqcc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmmxeont.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wvglj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmuljdcnm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wplc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wktxfog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wlqii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wwvm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmbmnbrb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wvolmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_c27ea9bfcf2656c14960fe3f218ddb37_elex_icedid_njrat.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 4440	4684	2026-07-31_c27ea9bfcf2656c14960fe3f218ddb37_elex_icedid_njrat.exe	89
PID 4684 wrote to memory of 4072	4684	2026-07-31_c27ea9bfcf2656c14960fe3f218ddb37_elex_icedid_njrat.exe	90
PID 4440 wrote to memory of 3668	4440	wqgow.exe	93
PID 4440 wrote to memory of 940	4440	wqgow.exe	94
PID 3668 wrote to memory of 1296	3668	wwvm.exe	96
PID 3668 wrote to memory of 4900	3668	wwvm.exe	97
PID 1296 wrote to memory of 3940	1296	wplc.exe	99
PID 1296 wrote to memory of 6016	1296	wplc.exe	100
PID 3940 wrote to memory of 2748	3940	wwqcc.exe	102
PID 3940 wrote to memory of 2980	3940	wwqcc.exe	103
PID 2748 wrote to memory of 6056	2748	wktxfog.exe	105
PID 2748 wrote to memory of 6084	2748	wktxfog.exe	106
PID 6056 wrote to memory of 2044	6056	wmbmnbrb.exe	108
PID 6056 wrote to memory of 5472	6056	wmbmnbrb.exe	109
PID 2044 wrote to memory of 4752	2044	wvolmd.exe	111
PID 2044 wrote to memory of 3860	2044	wvolmd.exe	112
PID 4752 wrote to memory of 5536	4752	wtt.exe	114
PID 4752 wrote to memory of 524	4752	wtt.exe	115
PID 5536 wrote to memory of 3468	5536	wmmxeont.exe	117
PID 5536 wrote to memory of 5932	5536	wmmxeont.exe	118
PID 3468 wrote to memory of 2500	3468	wvglj.exe	120
PID 3468 wrote to memory of 6036	3468	wvglj.exe	121
PID 2500 wrote to memory of 4484	2500	wmuljdcnm.exe	123
PID 2500 wrote to memory of 3800	2500	wmuljdcnm.exe	124

C:\Users\Admin\AppData\Local\Temp\2026-07-31_c27ea9bfcf2656c14960fe3f218ddb37_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_c27ea9bfcf2656c14960fe3f218ddb37_elex_icedid_njrat.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\SysWOW64\wqgow.exe
  "C:\Windows\system32\wqgow.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Windows\SysWOW64\wwvm.exe
    "C:\Windows\system32\wwvm.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3668
  - - C:\Windows\SysWOW64\wplc.exe
      "C:\Windows\system32\wplc.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1296
    - - C:\Windows\SysWOW64\wwqcc.exe
        
        "C:\Windows\system32\wwqcc.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3940
      - C:\Windows\SysWOW64\wktxfog.exe
        
        "C:\Windows\system32\wktxfog.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2748
        
        C:\Windows\SysWOW64\wmbmnbrb.exe
        
        "C:\Windows\system32\wmbmnbrb.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6056
        
        C:\Windows\SysWOW64\wvolmd.exe
        
        "C:\Windows\system32\wvolmd.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2044
        
        C:\Windows\SysWOW64\wtt.exe
        
        "C:\Windows\system32\wtt.exe"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Windows\SysWOW64\wmmxeont.exe
        
        "C:\Windows\system32\wmmxeont.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5536
        
        C:\Windows\SysWOW64\wvglj.exe
        
        "C:\Windows\system32\wvglj.exe"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3468
        
        C:\Windows\SysWOW64\wmuljdcnm.exe
        
        "C:\Windows\system32\wmuljdcnm.exe"
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2500
        
        C:\Windows\SysWOW64\wlqii.exe
        
        "C:\Windows\system32\wlqii.exe"
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4484
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wmuljdcnm.exe"
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:3800
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wvglj.exe"
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:6036
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wmmxeont.exe"
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:5932
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtt.exe"
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:524
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wvolmd.exe"
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3860
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wmbmnbrb.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5472
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wktxfog.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6084
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wwqcc.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2980
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wplc.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6016
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wwvm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4900
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wqgow.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:940
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\2026-07-31_c27ea9bfcf2656c14960fe3f218ddb37_elex_icedid_njrat.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install[2].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6BBNO8US\install[2].htm
Size 1KB
SHA256 73f091e944f1a2133646754dd3e5a9480f941987498a5120579e2eb4b5b0d696
MD5 96a1a28fc6b2748c5825ecd901e4be3f
SHA1 a467fb3522cc2152b0cd4e39198f79f96e54c453
SHA512 c0aec69d9585741c0b0f7fa287bd47c8cb6660aaf700b5d70c77c2112c81ae2bf69be95315ba89ac1de4715c7f956db6c1d1a07e282353dfaaf3a2a6cf7bf5ec
TLSH
T1E411393707405415A861419C2DB1327DB44568DEFB2BCA71DF5FE3A14DD2FC149A5504
MD5 SHA1 SHA512 TLSH

Submit Download

wktxfog.exe

Path C:\Windows\SysWOW64\wktxfog.exe
Size 1.0MB
SHA256 cfacb4290c068a807038983a6c46746c491d0ffb0d9ba4430bf2a675756d4600
MD5 2889063bf9fd10a6cff17a5a45f05ba3
SHA1 c983f4e03441c740ddedeef5d3eaf74f15c34fef
SHA512 dd7372fd2c42ee17c29eb34552b4ede8d36aa75f5f1d526acbf54418a4b452a4adf3ab8b5567e12f98c0785fda054927424343f994d1cad269e2171f9bb266a2
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsow:jxPAPJmtr
TLSH
T1FE35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wlqii.exe

Path C:\Windows\SysWOW64\wlqii.exe
Size 1.0MB
SHA256 e16db66324aba97c8fab715acefc9728bca0e6bd648d7d4fddf414631280a8d9
MD5 6ad08ee33b84aa883f518962b339b741
SHA1 d7c4fe8674cd02ef7b71abfb6a3181bf162551c0
SHA512 695d3452e0f763d8c41023ed6b225d416c102e9fd0a04afcb85ae81fd4d2ef5c6104b603b07282decebe7eded154930e8318b11635c82331f179c21b2b20f8e3
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoC:jxPAPJmtn
TLSH
T1CC35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmbmnbrb.exe

Path C:\Windows\SysWOW64\wmbmnbrb.exe
Size 1.0MB
SHA256 ede7e22dc42f52e6e35e80b38bfa12030dbacfa04e561d847144d25cd19dca41
MD5 0ff24f0d7f3cdbc56bcaea0eb8ab284a
SHA1 7a91c093a1cc9873a353e1dd7d273d448b88e3a9
SHA512 a7611d8d9819de1c2fce7bf3cdb77b21258d6afba16822344bbbfe55f97fe5f84608e4ae39803adcd06c0116c08c4ba05428a3e1162ccfbb963081c596c403ec
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoi:jxPAPJmtb
TLSH
T1E435A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmmxeont.exe

Path C:\Windows\SysWOW64\wmmxeont.exe
Size 1.0MB
SHA256 1cd3fbc412b016087e2f86ea5b0167937212d67efdf66265837cc25bc220e841
MD5 48165910768ce921294fd4ff3ac61299
SHA1 9f277fff019468a46847146aca22e057fdc116dd
SHA512 c1ee90a3c44fe96fc71f25d57f46562155f9a25095dd757a03c3a369adf141404b4f056094bd9985c6a7045d7658275d39a47ecbf57075c0c1fc3ce522794fe2
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nso3:jxPAPJmtw
TLSH
T1E435A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmuljdcnm.exe

Path C:\Windows\SysWOW64\wmuljdcnm.exe
Size 1.0MB
SHA256 f03e27023bf301112550fb251d5d7e5413b623fefa4eb3137628755287727636
MD5 d166fb4bf87a54516c991d50fc9ec8ba
SHA1 63a0a86d425223e14c55e5f5ecbb421e005b3dad
SHA512 c2bfa584552af2cb5859c8391049ced3a52eba38ef6d503aa576251982872315d45ce446330f2bc737de609d458256834049bbece22caa09fb7f3992e178bb80
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nso/:jxPAPJmt8
TLSH
T14835A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wplc.exe

Path C:\Windows\SysWOW64\wplc.exe
Size 1.0MB
SHA256 c1357276906064189499db04809aa2e6c423b790cb836482731f334e86772de4
MD5 ea1088c9ed08b22862a286d3cb79cb4c
SHA1 94d1d0aa08cb318e119b2e5deae4da113a8d9bd0
SHA512 1c07ad799e31c977d83e09552d2905bb9f6b170212a9dcb04b28957e2da2a0c4f80cd4ceced5239e1a8f0b738ae582c4a5aa3a40e15a218ea7c16f8b0ec471f3
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoD:jxPAPJmtY
TLSH
T13835A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqgow.exe

Path C:\Windows\SysWOW64\wqgow.exe
Size 1.0MB
SHA256 36a20b2e96ec4939bbd86e9868cf751f806df904b8909311a710e5f2fcaa21ee
MD5 73fa328b17be174fb8f54b515249a937
SHA1 70bfee0668d4ffebce2929a9a0ccce0d722eda5c
SHA512 ceae761137d3c248513fa02b668879599a55da79e972cf4cc741c48c3ee838086ad921d4f0775e23e39fe0e40bf3e2ef1d1fd1027997e83526d1448a848b309b
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoh:jxPAPJmt2
TLSH
T12C35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtt.exe

Path C:\Windows\SysWOW64\wtt.exe
Size 1.0MB
SHA256 237268a969394e8a22f9cd8110fede02eeeeb0b26527e5da743f0e3c311f656f
MD5 0a4fe53a1d32cd0f6db4b8b1214536e2
SHA1 61d73f239617e2cf54b276c1798869fffd3e19e1
SHA512 2a9e09e792faa42615780f02cadac8cc990f255a43ef4d65e50c1393c6ebf1c4337f833b29363ae8af74c64c8fac591e563327cb81ec3a59f18a2b7f1d65e109
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoh:jxPAPJmt0
TLSH
T13B35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wvglj.exe

Path C:\Windows\SysWOW64\wvglj.exe
Size 1.0MB
SHA256 d5d34c10090eac776e32aca403327d03e188759566a36684f6174e26268953a5
MD5 adafdfbfdbcb1dc7dc5e1d43135195b2
SHA1 a3f3c9fb8a784b7d684223138c4f5c29f850bf4b
SHA512 50bbc16508678ab1316e8a5593ad953ae04dd0f8d4389dfd0b41dac729a6dc1187810a3c8cce9d38c2c4e00b9b60571032e05a060d2d1ad9914a64af8bd2e931
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoA:jxPAPJmtZ
TLSH
T10A35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wvolmd.exe

Path C:\Windows\SysWOW64\wvolmd.exe
Size 1.0MB
SHA256 fb3705eade22e296ed5a28b416aa6b7db80438cdd13622f64ab097b9a6abd6dc
MD5 25a97581b663602409c4baf1589a948a
SHA1 0252b063fb733c3182bdbf7db4e6ecafef62d213
SHA512 46d2c8da02cb1c90a05362b6255076f5dee4e3747969f1ad5d0f138010b253d7ea0d6ebe8e904f659e0d7d3acb5507ed4ec3ba1b671ac7e38079c4f8456727b5
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsov:jxPAPJmt4
TLSH
T16F35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wwqcc.exe

Path C:\Windows\SysWOW64\wwqcc.exe
Size 1.0MB
SHA256 073687c9d97c6f7b443bc0715a6fc8e6f1a139b3fa6aa31b92004e118e6881ee
MD5 e37a928713c4b64bca7953ba5558bb2d
SHA1 b9a07d2485f1a223d93f9224266b454837b05054
SHA512 3efac580c564c54fe30a75c7f361b1b1f7e03ec2550f6516d5dde658d0a45ad11a103cf7a2da4bc23fe84bc465c8231f80f2d650dd874b5583bae3f636b26e39
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsot:jxPAPJmtg
TLSH
T1A535A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wwvm.exe

Path C:\Windows\SysWOW64\wwvm.exe
Size 1.0MB
SHA256 6c1dbb47394b432b590aefdca0ce9d88244242caa8ea2179b6bde2e6d35d4cfb
MD5 0fffa7059f4169bfc865b6643e2e9745
SHA1 c3742c2cff6af123d1b4244fd0c75269e8424e82
SHA512 28c47dcc2da5051228f2c7f91b211d28de0eca5c83d0c918f9f11a8f00890d4780a5fc0d476ab008c08a1912201c234d20e9dbbbe13b0d4ba6811e09d0b7b671
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nso6:jxPAPJmtH
TLSH
T1EB35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1296-40-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1296-55-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2044-93-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2044-107-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2500-145-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2500-159-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2500-147-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2748-66-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2748-81-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3468-146-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3468-131-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3668-29-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3668-26-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3668-42-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3940-68-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3940-53-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3940-56-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4440-28-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4440-15-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4440-13-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4484-157-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4484-160-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4684-0-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4684-14-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4684-1-0x0000000000414000-0x0000000000415000-memory.dmp

Download

memory/4752-106-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4752-120-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5536-133-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5536-119-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/6056-94-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/6056-80-0x0000000000400000-0x000000000050A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads