d12ee4b0d1b89b59cdb35d0206e82cb7def7064092f1cadffadf6e9ac4384571

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_44a23d0b6655a71ce09ac87f066e184c_elex_icedid_njrat.exe
Size 1.0MB
Sample260814-e81bksvwcs
SHA256 d12ee4b0d1b89b59cdb35d0206e82cb7def7064092f1cadffadf6e9ac4384571
MD5 44a23d0b6655a71ce09ac87f066e184c
SHA1 99dcb5fdbd366cf7ba2544116fa1552e479e16ba
SHA512 a4d97569797cdde07eaa4328e7eaa99d2826b0fc55ea02a531e03f374947526421b9e2c7318eb50f3565402ac747744b9dd19a355b7d218bc1d90e5a85ea8c84
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nso+:jxPAPJmtH
TLSH
T12335A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	2026-08-14_44a23d0b6655a71ce09ac87f066e184c_elex_icedid_njrat.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	wvaevgbj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	wekbqba.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	wswvt.exe

Executes dropped EXE 4 IoCs

pid	Process
748	wvaevgbj.exe
1920	wekbqba.exe
2868	wswvt.exe
4588	wmja.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wvaevgbj.exe	2026-08-14_44a23d0b6655a71ce09ac87f066e184c_elex_icedid_njrat.exe
File opened for modification	C:\Windows\SysWOW64\wekbqba.exe	wvaevgbj.exe
File created	C:\Windows\SysWOW64\wmja.exe	wswvt.exe
File created	C:\Windows\SysWOW64\wtiyiuv.exe	wmja.exe
File created	C:\Windows\SysWOW64\wvaevgbj.exe	2026-08-14_44a23d0b6655a71ce09ac87f066e184c_elex_icedid_njrat.exe
File created	C:\Windows\SysWOW64\wekbqba.exe	wvaevgbj.exe
File created	C:\Windows\SysWOW64\wswvt.exe	wekbqba.exe
File opened for modification	C:\Windows\SysWOW64\wswvt.exe	wekbqba.exe
File opened for modification	C:\Windows\SysWOW64\wmja.exe	wswvt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1160	1920	WerFault.exe	97
964	2868	WerFault.exe	104

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_44a23d0b6655a71ce09ac87f066e184c_elex_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wekbqba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wswvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wvaevgbj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 748	3900	2026-08-14_44a23d0b6655a71ce09ac87f066e184c_elex_icedid_njrat.exe	90
PID 3900 wrote to memory of 2468	3900	2026-08-14_44a23d0b6655a71ce09ac87f066e184c_elex_icedid_njrat.exe	92
PID 748 wrote to memory of 1920	748	wvaevgbj.exe	97
PID 748 wrote to memory of 4764	748	wvaevgbj.exe	98
PID 1920 wrote to memory of 2868	1920	wekbqba.exe	104
PID 1920 wrote to memory of 640	1920	wekbqba.exe	105
PID 2868 wrote to memory of 4588	2868	wswvt.exe	110
PID 2868 wrote to memory of 2648	2868	wswvt.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-14_44a23d0b6655a71ce09ac87f066e184c_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_44a23d0b6655a71ce09ac87f066e184c_elex_icedid_njrat.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Windows\SysWOW64\wvaevgbj.exe
  "C:\Windows\system32\wvaevgbj.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:748
- - C:\Windows\SysWOW64\wekbqba.exe
    "C:\Windows\system32\wekbqba.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\Windows\SysWOW64\wswvt.exe
      "C:\Windows\system32\wswvt.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2868
    - - C:\Windows\SysWOW64\wmja.exe
        
        "C:\Windows\system32\wmja.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4588
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wswvt.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2648
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 1376
        5⤵
        Program crash
        
        PID:964
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wekbqba.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:640
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 1096
      4⤵
      Program crash
      PID:1160
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wvaevgbj.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4764
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\2026-08-14_44a23d0b6655a71ce09ac87f066e184c_elex_icedid_njrat.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1920 -ip 1920
1⤵
PID:1472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2868 -ip 2868
1⤵
PID:2508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wekbqba.exe

Path C:\Windows\SysWOW64\wekbqba.exe
Size 1.0MB
SHA256 df76e41fc8fba320ebc74eba3bcb52343251a6cb6e3ba3ca50150d881e0e9410
MD5 730682e24d6a99f65489f98ac2e7e6b9
SHA1 dd762743953d927e9ef10495f3775e3b0317395b
SHA512 ce354dcd7b544e8e37ea158a82e406d815def467e60df43285a109f990d6723e110d476a3c33e6c28c653346790b214b1730f91f2ec66d16e2d9f0bd7abb17fd
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoe:jxPAPJmtT
TLSH
T1B135A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmja.exe

Path C:\Windows\SysWOW64\wmja.exe
Size 1.0MB
SHA256 2eab25805dd3496ac951b1f6741b775e3ba7ae1e5eafad682c84989076862966
MD5 669bfc176d07b8b73000aa7e1d813dd7
SHA1 3a23541f7eb3651dc1e850bf8b1199532361a56f
SHA512 fd57a3afeb372d0c7f498d30d5ddca2026a289b9af02b55ef4fa9ca5ddfc4e30b7c76bc277df380b3017d83e260e1cf62d916cb72f8920f482c368ab3948aefe
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoG:jxPAPJmtX
TLSH
T1E935A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wswvt.exe

Path C:\Windows\SysWOW64\wswvt.exe
Size 1.0MB
SHA256 35f017d76cb9c7abaa6cc58651b6056fd5b78a12c9a58b2122f2770b27791fa6
MD5 97718ff2c4b30a4462af447ac5a56533
SHA1 c874c54e7afdab7b4b3002e49e1c473b115b8d4d
SHA512 e81a86a305a83015e35bf2eb9efb0960afb18af8f6faf5b02c702da61551b02e76cb7a0acc94d201d6e092ee4d4d7042bbbc99a49cd86a3e02e0258309f7618d
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoj:jxPAPJmte
TLSH
T18435A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wvaevgbj.exe

Path C:\Windows\SysWOW64\wvaevgbj.exe
Size 1.0MB
SHA256 426fa8714e8dfc6856e4b7e05c8baa66f7cc000753d717e6ea31c2ef5b34e644
MD5 943bb460c4a9471d0e273b697ec02818
SHA1 8a01d2bbf35887ff43550921f8c6b01e149a5a71
SHA512 bc770c6b3e472a7937c0c4cca72695e08ee698576e95eece2298457479e41743a280d0360947c936bb38f8db55a1099ef3f800f06ef20569572e62c1bb67a525
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsou:jxPAPJmtr
TLSH
T1CD35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/748-15-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/748-13-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/748-26-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1920-27-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1920-25-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1920-38-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2868-37-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2868-39-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3900-2-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3900-14-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3900-3-0x0000000000414000-0x0000000000415000-memory.dmp

Download

memory/3900-0-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3900-1-0x0000000000414000-0x0000000000415000-memory.dmp

Download

memory/4588-49-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4588-50-0x0000000000400000-0x000000000050A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads