f1bed3960a604c012c43d38eaa49e73e314c6ce7b05f464ee18ee8b6b2f56b22

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 05:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_bbb61f9d36df0a92d731a67d1acc1271_elex_icedid_njrat.exe
Size 1.0MB
Sample260809-fnfxwatzdy
SHA256 f1bed3960a604c012c43d38eaa49e73e314c6ce7b05f464ee18ee8b6b2f56b22
MD5 bbb61f9d36df0a92d731a67d1acc1271
SHA1 74f4e3ee105f4c7c9fab41b681ea6c6b5e052b02
SHA512 f0db7d2529cb9dadbbd275f47198a6b8ba4498ce259ce04fa58c30b0d267955572b4619567f24a1e048d2c6009b0e641724bebd91ff54463ad240fe45ec0b745
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsof:jxPAPJmte
TLSH
T1A235A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
5092	wewwymua.exe
4312	wvu.exe
2616	wpkswxe.exe
2916	wlwmkr.exe
5524	webcfe.exe
3456	wafopj.exe
1492	wdaiyss.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wdaiyss.exe	wafopj.exe
File opened for modification	C:\Windows\SysWOW64\wpkswxe.exe	wvu.exe
File opened for modification	C:\Windows\SysWOW64\wlwmkr.exe	wpkswxe.exe
File created	C:\Windows\SysWOW64\webcfe.exe	wlwmkr.exe
File created	C:\Windows\SysWOW64\wjsefx.exe	wdaiyss.exe
File opened for modification	C:\Windows\SysWOW64\wewwymua.exe	2026-08-09_bbb61f9d36df0a92d731a67d1acc1271_elex_icedid_njrat.exe
File created	C:\Windows\SysWOW64\wlwmkr.exe	wpkswxe.exe
File created	C:\Windows\SysWOW64\wafopj.exe	webcfe.exe
File opened for modification	C:\Windows\SysWOW64\wafopj.exe	webcfe.exe
File created	C:\Windows\SysWOW64\wewwymua.exe	2026-08-09_bbb61f9d36df0a92d731a67d1acc1271_elex_icedid_njrat.exe
File opened for modification	C:\Windows\SysWOW64\wvu.exe	wewwymua.exe
File created	C:\Windows\SysWOW64\wpkswxe.exe	wvu.exe
File opened for modification	C:\Windows\SysWOW64\webcfe.exe	wlwmkr.exe
File created	C:\Windows\SysWOW64\wdaiyss.exe	wafopj.exe
File created	C:\Windows\SysWOW64\wvu.exe	wewwymua.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wpkswxe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	webcfe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wvu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wlwmkr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wewwymua.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wafopj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_bbb61f9d36df0a92d731a67d1acc1271_elex_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wdaiyss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 5092	3672	2026-08-09_bbb61f9d36df0a92d731a67d1acc1271_elex_icedid_njrat.exe	89
PID 3672 wrote to memory of 4568	3672	2026-08-09_bbb61f9d36df0a92d731a67d1acc1271_elex_icedid_njrat.exe	90
PID 5092 wrote to memory of 4312	5092	wewwymua.exe	92
PID 5092 wrote to memory of 3380	5092	wewwymua.exe	93
PID 4312 wrote to memory of 2616	4312	wvu.exe	96
PID 4312 wrote to memory of 3248	4312	wvu.exe	97
PID 2616 wrote to memory of 2916	2616	wpkswxe.exe	99
PID 2616 wrote to memory of 3956	2616	wpkswxe.exe	100
PID 2916 wrote to memory of 5524	2916	wlwmkr.exe	102
PID 2916 wrote to memory of 1308	2916	wlwmkr.exe	103
PID 5524 wrote to memory of 3456	5524	webcfe.exe	105
PID 5524 wrote to memory of 3300	5524	webcfe.exe	106
PID 3456 wrote to memory of 1492	3456	wafopj.exe	108
PID 3456 wrote to memory of 4336	3456	wafopj.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-09_bbb61f9d36df0a92d731a67d1acc1271_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_bbb61f9d36df0a92d731a67d1acc1271_elex_icedid_njrat.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Windows\SysWOW64\wewwymua.exe
  "C:\Windows\system32\wewwymua.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Windows\SysWOW64\wvu.exe
    "C:\Windows\system32\wvu.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4312
  - - C:\Windows\SysWOW64\wpkswxe.exe
      "C:\Windows\system32\wpkswxe.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2616
    - - C:\Windows\SysWOW64\wlwmkr.exe
        
        "C:\Windows\system32\wlwmkr.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2916
      - C:\Windows\SysWOW64\webcfe.exe
        
        "C:\Windows\system32\webcfe.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5524
        
        C:\Windows\SysWOW64\wafopj.exe
        
        "C:\Windows\system32\wafopj.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3456
        
        C:\Windows\SysWOW64\wdaiyss.exe
        
        "C:\Windows\system32\wdaiyss.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1492
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wafopj.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4336
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\webcfe.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3300
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wlwmkr.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1308
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wpkswxe.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3956
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wvu.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3248
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wewwymua.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3380
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\2026-08-09_bbb61f9d36df0a92d731a67d1acc1271_elex_icedid_njrat.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wafopj.exe

Path C:\Windows\SysWOW64\wafopj.exe
Size 1.0MB
SHA256 a458ff6ce3704941b66560a9f43c05fb450681225dde2741df6ac14a91bb8fe3
MD5 5d2abc4f2b2b49e2ed73101a34631dc2
SHA1 16555edd1871484aabb591735e25d14b9cf1adff
SHA512 0e737c1f2d8c5e8830b28d0354cd92337013058a45f0ce12c1431265a4bcb0da0e87946dce1a5b1efe255b93d5cd0c3ad75ffecd8471463034ab1bc47685a76a
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsom:jxPAPJmtb
TLSH
T17035A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wdaiyss.exe

Path C:\Windows\SysWOW64\wdaiyss.exe
Size 1.0MB
SHA256 1f4a82360d023105c319e87c3610c3cdddccf1acf20a8a41affcf16605901329
MD5 f0b048f9a58bd50ef6929952651f8589
SHA1 ee959345408c1b307c9297a01bb18df0106f797f
SHA512 5dea26baf6ca1b8714eb096d3237461251e1b39aa578bdebe474ba60640f4b3f63c71dadaf01946a0ba51fbc507f7596521ac7b65128321d4f2a7edba9d0261c
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsot:jxPAPJmtc
TLSH
T10E35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webcfe.exe

Path C:\Windows\SysWOW64\webcfe.exe
Size 1.0MB
SHA256 d2fb4328381a7d147b6719093bd78c1c7ecdfc38b53c791167cccd283d28f710
MD5 5fcca872a3f916cf071e0f12bce84496
SHA1 079faf9706b5470bf069e5f03e4bf74cd63628c6
SHA512 4809fde5396e9f0d6ff58b203425804168df5414ecf3c579fa3de168608166c595fba12fdc64836042803ab7ee2a91aabc274ffdad15f98828bb6caa3e586628
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsol:jxPAPJmtg
TLSH
T15935A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wewwymua.exe

Path C:\Windows\SysWOW64\wewwymua.exe
Size 1.0MB
SHA256 9c0190a54d3fb9aa0091a875f354253e88d5ad9fcd852693dab18defcb054a74
MD5 f6804a3ef9248a710d0edcafcf715574
SHA1 4c2c74b32ef280364aab9fe3a028c2215a496f0d
SHA512 6a78a0419463c494945bd3b35d44642068390b79a763da3542091d2dda89dace6161b441e3987aab65ef1abe2db8d592109922ee738000be52338541daa5b65b
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoF:jxPAPJmtw
TLSH
T1E735A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wlwmkr.exe

Path C:\Windows\SysWOW64\wlwmkr.exe
Size 1.0MB
SHA256 8f01f8878e536cacf012e7921b99b3b83c423ac2474e2fa83ff68691b17298bd
MD5 fb8679be32be04720ef11d714646f14f
SHA1 45cc25e3c221012d0632dae987190c10d52eeb83
SHA512 ecc21d49f6237393260333917837944c75b8fe66e42791525daa486084aebdf8053f9b304385cc1cafd743ab7ed89266daa28e2e5cba278ba2e3dbe335b18e9a
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoR:jxPAPJmtU
TLSH
T19635A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpkswxe.exe

Path C:\Windows\SysWOW64\wpkswxe.exe
Size 1.0MB
SHA256 391fe78284acd76080e169de36c2926c9836c4ee2f97af1b2b14eef53de2aa4f
MD5 a4e6bfccb8eb7526144cfea4857b1287
SHA1 194f33ad8e82f06ca7b8f12ba71fa7d14af591b8
SHA512 607dc4f928c9a462d7d1d5a3c1a941b57299ebf14c8f7210b3c8721dd6c7e68c94cb787c24e9a191b1248e66f51ad7bdd99c010503f25ea1428af1c55942860c
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoi:jxPAPJmt7
TLSH
T10135A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wvu.exe

Path C:\Windows\SysWOW64\wvu.exe
Size 1.0MB
SHA256 bd7f2b3731f01c23f9d0aa8ea749348a226dd8a35a9dced2fbc1e261d181a999
MD5 593e41a72fe1647b7b37b50401a8993f
SHA1 52185e8f56e41a8811fced3b566d21d33f1f51a2
SHA512 984168b8d0d3b0f8e2dd7dae39925fb43e0396a7725ae4d767510e10acb7c858e02193f05ca5cc2bf2ab04e6264dd42f83b96a231c66a2fe06e46eba5a8c5a8d
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoM:jxPAPJmtB
TLSH
T1A935A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1492-91-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1492-94-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2616-53-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2616-39-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2916-66-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2916-51-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3456-78-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3456-81-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3456-93-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3672-1-0x0000000000414000-0x0000000000415000-memory.dmp

Download

memory/3672-14-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3672-0-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4312-28-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4312-26-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4312-40-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5092-15-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5092-13-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5092-27-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5524-80-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5524-67-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5524-64-0x0000000000400000-0x000000000050A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads