63f78cc19f8aeace510ca3aecdd93591821b3cbf8a2e39d2e9d6e80f9d16b7f8

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 00:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_c3f1766e7876beb97b5cfc6c23f9d294_elex_icedid_njrat.exe
Size 1.0MB
Sample260817-asfvsagf67
SHA256 63f78cc19f8aeace510ca3aecdd93591821b3cbf8a2e39d2e9d6e80f9d16b7f8
MD5 c3f1766e7876beb97b5cfc6c23f9d294
SHA1 f4353eb060a2bfc1c3340b5476339267c8ccc851
SHA512 b5da4236e9f116f86ea927bc4172f6027e66bc1c74bd6b1ff28f4806c948c0f9c6d9820eeae092ae08713dbab7551ac874ccd0b14bfc82dcb34e71285b8e29e8
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nso+:jxPAPJmtL
TLSH
T10F35A117E3818AD5D7990932DE6481A0532AF02D6BFB16723A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
236	wlwpivje.exe
1092	wqupy.exe
1436	wqvig.exe
5716	wlkfxt.exe
3008	wlv.exe
2104	wdjtk.exe
1504	wqvrvnj.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wqvrvnj.exe	wdjtk.exe
File created	C:\Windows\SysWOW64\wlwpivje.exe	2026-08-16_c3f1766e7876beb97b5cfc6c23f9d294_elex_icedid_njrat.exe
File opened for modification	C:\Windows\SysWOW64\wlwpivje.exe	2026-08-16_c3f1766e7876beb97b5cfc6c23f9d294_elex_icedid_njrat.exe
File opened for modification	C:\Windows\SysWOW64\wqupy.exe	wlwpivje.exe
File created	C:\Windows\SysWOW64\wlv.exe	wlkfxt.exe
File opened for modification	C:\Windows\SysWOW64\wdjtk.exe	wlv.exe
File created	C:\Windows\SysWOW64\wqvrvnj.exe	wdjtk.exe
File created	C:\Windows\SysWOW64\whoxj.exe	wqvrvnj.exe
File created	C:\Windows\SysWOW64\wqupy.exe	wlwpivje.exe
File created	C:\Windows\SysWOW64\wqvig.exe	wqupy.exe
File opened for modification	C:\Windows\SysWOW64\wqvig.exe	wqupy.exe
File opened for modification	C:\Windows\SysWOW64\wlkfxt.exe	wqvig.exe
File created	C:\Windows\SysWOW64\wdjtk.exe	wlv.exe
File created	C:\Windows\SysWOW64\wlkfxt.exe	wqvig.exe
File opened for modification	C:\Windows\SysWOW64\wlv.exe	wlkfxt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1556	1092	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wlwpivje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqvig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wlkfxt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wdjtk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wlv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqvrvnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_c3f1766e7876beb97b5cfc6c23f9d294_elex_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqupy.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 236	2396	2026-08-16_c3f1766e7876beb97b5cfc6c23f9d294_elex_icedid_njrat.exe	89
PID 2396 wrote to memory of 6060	2396	2026-08-16_c3f1766e7876beb97b5cfc6c23f9d294_elex_icedid_njrat.exe	90
PID 236 wrote to memory of 1092	236	wlwpivje.exe	93
PID 236 wrote to memory of 2176	236	wlwpivje.exe	94
PID 1092 wrote to memory of 1436	1092	wqupy.exe	96
PID 1092 wrote to memory of 4688	1092	wqupy.exe	97
PID 1436 wrote to memory of 5716	1436	wqvig.exe	102
PID 1436 wrote to memory of 2024	1436	wqvig.exe	103
PID 5716 wrote to memory of 3008	5716	wlkfxt.exe	105
PID 5716 wrote to memory of 1984	5716	wlkfxt.exe	106
PID 3008 wrote to memory of 2104	3008	wlv.exe	108
PID 3008 wrote to memory of 5772	3008	wlv.exe	109
PID 2104 wrote to memory of 1504	2104	wdjtk.exe	111
PID 2104 wrote to memory of 1604	2104	wdjtk.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-16_c3f1766e7876beb97b5cfc6c23f9d294_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_c3f1766e7876beb97b5cfc6c23f9d294_elex_icedid_njrat.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\SysWOW64\wlwpivje.exe
  "C:\Windows\system32\wlwpivje.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:236
- - C:\Windows\SysWOW64\wqupy.exe
    "C:\Windows\system32\wqupy.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1092
  - - C:\Windows\SysWOW64\wqvig.exe
      "C:\Windows\system32\wqvig.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1436
    - - C:\Windows\SysWOW64\wlkfxt.exe
        
        "C:\Windows\system32\wlkfxt.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5716
      - C:\Windows\SysWOW64\wlv.exe
        
        "C:\Windows\system32\wlv.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3008
        
        C:\Windows\SysWOW64\wdjtk.exe
        
        "C:\Windows\system32\wdjtk.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2104
        
        C:\Windows\SysWOW64\wqvrvnj.exe
        
        "C:\Windows\system32\wqvrvnj.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1504
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wdjtk.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1604
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wlv.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5772
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wlkfxt.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1984
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wqvig.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2024
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wqupy.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4688
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 1540
      4⤵
      Program crash
      PID:1556
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wlwpivje.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2176
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\2026-08-16_c3f1766e7876beb97b5cfc6c23f9d294_elex_icedid_njrat.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1092 -ip 1092
1⤵
PID:4820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install[2].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6BBNO8US\install[2].htm
Size 1KB
SHA256 73f091e944f1a2133646754dd3e5a9480f941987498a5120579e2eb4b5b0d696
MD5 96a1a28fc6b2748c5825ecd901e4be3f
SHA1 a467fb3522cc2152b0cd4e39198f79f96e54c453
SHA512 c0aec69d9585741c0b0f7fa287bd47c8cb6660aaf700b5d70c77c2112c81ae2bf69be95315ba89ac1de4715c7f956db6c1d1a07e282353dfaaf3a2a6cf7bf5ec
TLSH
T1E411393707405415A861419C2DB1327DB44568DEFB2BCA71DF5FE3A14DD2FC149A5504
MD5 SHA1 SHA512 TLSH

Submit Download

wdjtk.exe

Path C:\Windows\SysWOW64\wdjtk.exe
Size 1.0MB
SHA256 8f476692c2154c009a0d34b0b73beffe8d4f0ae928aac74c52d6082823534b2c
MD5 8c5bc466ffd1edae407d68893849014f
SHA1 52d58442d33d94e9e592dff78585447120adb916
SHA512 d49b7b83f492a132c576f1b30032b4e13653f3774286cc8ac9d676817782007aeaafaee43cd8bb7cf334a7835adf7c1ab866d702df7b35bee98111433ac4b302
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsof:jxPAPJmtq
TLSH
T17C35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wlkfxt.exe

Path C:\Windows\SysWOW64\wlkfxt.exe
Size 1.0MB
SHA256 0868f33aaf9c531fb2d161414fc4b60fd8d1b7e0606b04adf6fc97f53c951a48
MD5 c90e6c9460710d65f167819379729945
SHA1 197d827383b9eef62c8b5401ce74bcede3f7021a
SHA512 131770eb4bd58a3ce90759e836e6d7b9ed4c6085c5a97cb0e6ccb6ed48fbfb5dc071bfc48ecad1f68750285b6035d566c2ba4793d13cddbd941de1b383481583
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nso4:jxPAPJmtF
TLSH
T16F35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wlv.exe

Path C:\Windows\SysWOW64\wlv.exe
Size 1.0MB
SHA256 ae51f90252d0f8edfdcf4139badf759764e2134c712a48526f66c0ffc3e2be79
MD5 225a1c75b151983fdc9e60ddbcda95a4
SHA1 6ab11625e10c9d5c2a83e24cc68f159fcde9156a
SHA512 87b260a02a032bb505a2bd0dee9735f77d7353e935a9dba7e8a2ec0f14fe600deafe2214722005d55ab180e25974b04e3582fa54aba20bb0bbe518215f15bed8
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoN:jxPAPJmtk
TLSH
T1D535A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wlwpivje.exe

Path C:\Windows\SysWOW64\wlwpivje.exe
Size 1.0MB
SHA256 aea228951a660de34b316b478cf36514bfb4672de5d79025309b8a7587c6a112
MD5 e8342dc82b5e2d2eab363e9efebc3873
SHA1 417d55c2fb61995d29e860b0ae5abcddfef3bc1d
SHA512 e149b10f046e8db7b7635bdf2e77f6c13674d512fb2d99171bff9f4bf559aef725e273cae633972aa8e6e470fe0ea511568a9632821bb437fc280b7825534368
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoD:jxPAPJmti
TLSH
T1F435A117E3818AD5D7990932DE6481A0532AF02D6BFB16723A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqupy.exe

Path C:\Windows\SysWOW64\wqupy.exe
Size 1.0MB
SHA256 77d48fd608849928209f664f257dbccd2c4c012ab8f8a69ec2f11eb9e1c97ee7
MD5 fad3c60e92ffe08f345e831cbd1e933a
SHA1 05cc146ce3edebd605b10911ac06879a22b5f7d9
SHA512 0099625a1059c75e297cc0a0969557ffc96cda0c5530f18214bb4ca6bb1576c9c0bd8a071618f722811a4d554d8e692097b5d7f95320c4c56335e3ac66fefa46
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoH:jxPAPJmte
TLSH
T1D935A117E3818AD5D7990932DE6481A0532AF02D6BFB16723A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqvig.exe

Path C:\Windows\SysWOW64\wqvig.exe
Size 1.0MB
SHA256 0bdda22d396833262ee2e4c9708ea89dd3389fd6dc21afdfce32f071c1abbcd2
MD5 7fa2cbce12c3dbd6872ef91baa6ee000
SHA1 32f37ea4fa1a71a0d53250499832887e99f9e9b9
SHA512 945c75ca087098446b7cc316d880f730398d2a9ac4c092b5c7ea5e20278b082ca2c3d4db730084d97b0503212961f5c61055d377fd4aa3afce377439d6146923
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoW:jxPAPJmtb
TLSH
T1BD35A113E3818AD5D7990932DE6481A0532AF02D6BFB16723A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqvrvnj.exe

Path C:\Windows\SysWOW64\wqvrvnj.exe
Size 1.0MB
SHA256 60dc3182854b0b8a05d3f8d794fa6ad52e343ad90fec5d02e6f44a1c13ee1469
MD5 0f271a0c45a0e8770a2e8a2dda808d20
SHA1 33c142ce90fa069d8ca7afc1a260c4b78b4c08d6
SHA512 08e6fdc4dd31120c0c8837ebfc46fd05d051c14889809780d11751a04047d874a848aaea90be7d9f9038586e7a7d0f1830741c4026777278524190feaa0ec787
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsob:jxPAPJmta
TLSH
T15035A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-13-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/236-15-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/236-28-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1092-27-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1092-49-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1436-54-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1436-39-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1504-95-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1504-93-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2104-94-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2104-79-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2396-0-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2396-14-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2396-1-0x0000000000414000-0x0000000000415000-memory.dmp

Download

memory/3008-68-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3008-81-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3008-66-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5716-67-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5716-55-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5716-52-0x0000000000400000-0x000000000050A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads