fa9766582f95a0af0925b3dbab83e13c18dd8caa2728e6448f7e04c84e1ccddc

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 18:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_19483167900de274a8077304ca1609a0_elex_icedid_njrat.exe
Size 1.0MB
Sample260810-xmw15swbmd
SHA256 fa9766582f95a0af0925b3dbab83e13c18dd8caa2728e6448f7e04c84e1ccddc
MD5 19483167900de274a8077304ca1609a0
SHA1 2568f8a523ff79d747e6d7dac461ca7077432a16
SHA512 18adada8ecea02d065d7e8add222184c30e0a3c55f8d07e0166e0f17e7a22c70d9e528c132d91917086591fa2af2569089a31adbd978ebc7a6834b307856d57d
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsok:jxPAPJmtt
TLSH
T1F435A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
5800	wwouxlny.exe
2228	wwpfqdu.exe
4116	wqvqfkya.exe
2796	wsdw.exe
4060	wcgyuqbn.exe
3660	wftg.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wftg.exe	wcgyuqbn.exe
File opened for modification	C:\Windows\SysWOW64\wftg.exe	wcgyuqbn.exe
File created	C:\Windows\SysWOW64\wgoi.exe	wftg.exe
File created	C:\Windows\SysWOW64\wwouxlny.exe	2026-08-10_19483167900de274a8077304ca1609a0_elex_icedid_njrat.exe
File opened for modification	C:\Windows\SysWOW64\wwouxlny.exe	2026-08-10_19483167900de274a8077304ca1609a0_elex_icedid_njrat.exe
File created	C:\Windows\SysWOW64\wwpfqdu.exe	wwouxlny.exe
File opened for modification	C:\Windows\SysWOW64\wwpfqdu.exe	wwouxlny.exe
File created	C:\Windows\SysWOW64\wqvqfkya.exe	wwpfqdu.exe
File opened for modification	C:\Windows\SysWOW64\wqvqfkya.exe	wwpfqdu.exe
File created	C:\Windows\SysWOW64\wsdw.exe	wqvqfkya.exe
File opened for modification	C:\Windows\SysWOW64\wsdw.exe	wqvqfkya.exe
File created	C:\Windows\SysWOW64\wcgyuqbn.exe	wsdw.exe
File opened for modification	C:\Windows\SysWOW64\wcgyuqbn.exe	wsdw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_19483167900de274a8077304ca1609a0_elex_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wwouxlny.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wwpfqdu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqvqfkya.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcgyuqbn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wftg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wsdw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 5800	4256	2026-08-10_19483167900de274a8077304ca1609a0_elex_icedid_njrat.exe	89
PID 4256 wrote to memory of 2588	4256	2026-08-10_19483167900de274a8077304ca1609a0_elex_icedid_njrat.exe	90
PID 5800 wrote to memory of 2228	5800	wwouxlny.exe	92
PID 5800 wrote to memory of 3144	5800	wwouxlny.exe	93
PID 2228 wrote to memory of 4116	2228	wwpfqdu.exe	96
PID 2228 wrote to memory of 2424	2228	wwpfqdu.exe	97
PID 4116 wrote to memory of 2796	4116	wqvqfkya.exe	99
PID 4116 wrote to memory of 4312	4116	wqvqfkya.exe	100
PID 2796 wrote to memory of 4060	2796	wsdw.exe	102
PID 2796 wrote to memory of 1848	2796	wsdw.exe	103
PID 4060 wrote to memory of 3660	4060	wcgyuqbn.exe	105
PID 4060 wrote to memory of 5328	4060	wcgyuqbn.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-10_19483167900de274a8077304ca1609a0_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_19483167900de274a8077304ca1609a0_elex_icedid_njrat.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\SysWOW64\wwouxlny.exe
  "C:\Windows\system32\wwouxlny.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5800
- - C:\Windows\SysWOW64\wwpfqdu.exe
    "C:\Windows\system32\wwpfqdu.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\Windows\SysWOW64\wqvqfkya.exe
      "C:\Windows\system32\wqvqfkya.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4116
    - - C:\Windows\SysWOW64\wsdw.exe
        
        "C:\Windows\system32\wsdw.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2796
      - C:\Windows\SysWOW64\wcgyuqbn.exe
        
        "C:\Windows\system32\wcgyuqbn.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4060
        
        C:\Windows\SysWOW64\wftg.exe
        
        "C:\Windows\system32\wftg.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3660
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wcgyuqbn.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5328
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wsdw.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1848
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wqvqfkya.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4312
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wwpfqdu.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2424
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wwouxlny.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3144
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\2026-08-10_19483167900de274a8077304ca1609a0_elex_icedid_njrat.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wcgyuqbn.exe

Path C:\Windows\SysWOW64\wcgyuqbn.exe
Size 1.0MB
SHA256 a820aa8a2e0a34f13c8d6fd0d81fd773102fa602dfb2296030ac61caf7db590a
MD5 bdec4bd3a254eb19d54bb7700a366ddf
SHA1 4a89dbd5f5d0bbadc5bd9fbb331f32dd6157bece
SHA512 0aa6f8cafabfb8c9b30669cd5c2fa174b2abefe6d13e5bf0a9c977918a2a550bcb4a5dab2941ac6eb3559e749f61c211f15c06aadbca7132e3b70eef6e754fc5
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoM:jxPAPJmtB
TLSH
T14D35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wftg.exe

Path C:\Windows\SysWOW64\wftg.exe
Size 1.0MB
SHA256 5c1774debeb42cc489c06e0a0501d1f9e6caff4ade0745ea13ba3f1d46c90849
MD5 16e139d36b15de37e5c2d95cd83da8d5
SHA1 3410ccb7dadf6a7d7bc3573c9d9267f82c29910e
SHA512 b46b5c889c7d57cb9a87dab4061c98028902b717056a18b64ad26a58bed5bb51fcbfbb1d8326f679af8a6e43e773238fb68ce5305a11a91a359ff193155e84b6
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsog:jxPAPJmtF
TLSH
T1AF35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqvqfkya.exe

Path C:\Windows\SysWOW64\wqvqfkya.exe
Size 1.0MB
SHA256 ea8eeea74ec8bc8bc344f26fd0d1189978cb46ac221348e940473d8050a87b82
MD5 c244855422e32a5da7b8df1462fc740b
SHA1 0ab6f56a0763ee80db88384a914dc093fdfddb92
SHA512 b4982d7a2a92f7658e65da8b4d889adfeecb3eacd96e70a0b6fef2cf053d23d096ea75519fb7151ba651a4b2580fb2b779ace1f02e3a951c6a69e972d017e240
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nson:jxPAPJmtA
TLSH
T1AA35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsdw.exe

Path C:\Windows\SysWOW64\wsdw.exe
Size 1.0MB
SHA256 64665d3d6e2c884cb0dbf51a86e3a51ca8f313003f958ae478cd7c4f626154ac
MD5 85e7b7c98599db5f1a0d1ee6d62020a5
SHA1 da5cb0a94ab3d382041cadb0e5f9ae4e11c0233b
SHA512 02e1f0f83bb8ccd9e3e771379338b19decbc1f024a8a443e6e9b02f12fa89d01767cdf204c7f8d7ad09dce029330a37aa9e6100d3c8ee48c6b4064de070a949b
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoj:jxPAPJmtS
TLSH
T1B135A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wwouxlny.exe

Path C:\Windows\SysWOW64\wwouxlny.exe
Size 1.0MB
SHA256 9feb86804581b834d1baa4e05d2c083da11bf39860e7be9e03b9eeb6d6e1ba27
MD5 5fb3588b8b9dba5c1b1619007b5d4c36
SHA1 6c8c1bb6b7f897ccad8182c67f2f310ca77f189b
SHA512 066414c9258df626a695f34f851dab80c32a8d816c952ca7622a5529ea6a8c10d30a0687e692368f41b8213ca217110beddaaf1daeab21ddeadab2190186ee59
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoy:jxPAPJmtd
TLSH
T10C35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wwpfqdu.exe

Path C:\Windows\SysWOW64\wwpfqdu.exe
Size 1.0MB
SHA256 bf50c66d54e4880b4a39b33f63ceed6ed85f261807ceb945733d385509e98d01
MD5 94a150969534d7a1224e1ace58812536
SHA1 cd998f1e8a14ca9f81c163094165584a2e8793fa
SHA512 509bb36a1bec50e417a0b0f90a3fdbd7bcdc3781c5ddf12625a3c57e69a5d60904f172c752ceb03ea943db8d1013e4912046654083fa5a452ef0aa9af98a15b9
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsok:jxPAPJmtV
TLSH
T1B035A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2228-26-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2228-40-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2228-28-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2796-67-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2796-51-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2796-54-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3660-81-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3660-78-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4060-68-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4060-65-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4060-80-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4116-41-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4116-39-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4116-53-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4256-14-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4256-1-0x0000000000414000-0x0000000000415000-memory.dmp

Download

memory/4256-0-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5800-13-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5800-27-0x0000000000400000-0x000000000050A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads