Overview

overview

10

Static

static

3

2026-07-08...yn.exe

windows10-2004-x64

10

2026-07-08...yn.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    38s
  • max time network
    163s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/07/2026, 06:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-08_0f911e86212c60bcf61af9ccb01c5269_elex_glassworm_icedid_luca-stealer_njrat_swisyn.exe
  • Size 35.3MB
  • Sample260708-g2ht3ab14t
  • SHA256 571790d54b6bcd82392cdfc948bd376b0b25739a87d16c623ce627078986db8e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoverypersistencepyinstallerspyware

Malware Config

Signatures

  • Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 19 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 35 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of FindShellTrayWindow 52 IoCs
  • Suspicious use of SendNotifyMessage 42 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_0f911e86212c60bcf61af9ccb01c5269_elex_glassworm_icedid_luca-stealer_njrat_swisyn.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-08_0f911e86212c60bcf61af9ccb01c5269_elex_glassworm_icedid_luca-stealer_njrat_swisyn.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4904
    • \??\c:\users\admin\appdata\local\temp\2026-07-08_0f911e86212c60bcf61af9ccb01c5269_elex_glassworm_icedid_luca-stealer_njrat_swisyn.exe 
      c:\users\admin\appdata\local\temp\2026-07-08_0f911e86212c60bcf61af9ccb01c5269_elex_glassworm_icedid_luca-stealer_njrat_swisyn.exe 
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:5708
      • \??\c:\users\admin\appdata\local\temp\2026-07-08_0f911e86212c60bcf61af9ccb01c5269_elex_glassworm_icedid_luca-stealer_njrat_swisyn.exe 
        c:\users\admin\appdata\local\temp\2026-07-08_0f911e86212c60bcf61af9ccb01c5269_elex_glassworm_icedid_luca-stealer_njrat_swisyn.exe 
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2072
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c title 101 SERVICES — Operator
          4⤵
            PID:5920
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c cls
            4⤵
              PID:5240
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c cls
              4⤵
                PID:4524
          • C:\Windows\Resources\Themes\icsys.icn.exe
            C:\Windows\Resources\Themes\icsys.icn.exe
            2⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3752
            • \??\c:\windows\resources\themes\explorer.exe
              c:\windows\resources\themes\explorer.exe
              3⤵
              • Modifies visibility of hidden/system files in Explorer
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in System32 directory
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1788
              • \??\c:\windows\resources\spoolsv.exe
                c:\windows\resources\spoolsv.exe SE
                4⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:2752
                • \??\c:\windows\resources\svchost.exe
                  c:\windows\resources\svchost.exe
                  5⤵
                  • Modifies visibility of hidden/system files in Explorer
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Drops file in System32 directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: GetForegroundWindowSpam
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:1220
                  • \??\c:\windows\resources\spoolsv.exe
                    c:\windows\resources\spoolsv.exe PR
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:5792
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:6052
          • C:\Windows\explorer.exe
            explorer.exe /LOADSAVEDWINDOWS
            2⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Enumerates connected drives
            • Checks SCSI registry key(s)
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            PID:556
        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:3972
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:2452

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              prep_Activatable Class_Hermes_perf.cache
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
              • Size 599B
              • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              2026-07-08_0f911e86212c60bcf61af9ccb01c5269_elex_glassworm_icedid_luca-stealer_njrat_swisyn.exe 
              • Path C:\Users\Admin\AppData\Local\Temp\2026-07-08_0f911e86212c60bcf61af9ccb01c5269_elex_glassworm_icedid_luca-stealer_njrat_swisyn.exe 
              • Size 35.1MB
              • SHA256 b8c8f51cfc31483d297c5ded2170bcfec93b15a6c1d0f1a8b2a48a942a680c4d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VCRUNTIME140.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\VCRUNTIME140.dll
              • Size 117KB
              • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VCRUNTIME140_1.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\VCRUNTIME140_1.dll
              • Size 48KB
              • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _bz2.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\_bz2.pyd
              • Size 85KB
              • SHA256 33641a8ad0403473d678c7435197d49550fc5185ba7979fb16ab80256b1f9072
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _ctypes.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\_ctypes.pyd
              • Size 139KB
              • SHA256 79967d8614f735cc62b81649641fd8d0414ca66d3d6656fa7788334bbdbbd35b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _hashlib.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\_hashlib.pyd
              • Size 67KB
              • SHA256 58c5c9ff93f989e2a233b8c5e06420ea73dd6c013e1f08d996fb0f2828eba0aa
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _lzma.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\_lzma.pyd
              • Size 157KB
              • SHA256 a01f1927adaa60adcfbe3b0314205a528cb9dd5a93b7e61cb284eddee9b0b347
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _queue.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\_queue.pyd
              • Size 35KB
              • SHA256 2a7bb0a53e86ae4982a6f64e2570137829a0be66537bb1c166913af273edbf0c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _socket.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\_socket.pyd
              • Size 85KB
              • SHA256 435a86973131c5d5dc90f828e72d7bb0607578a48ab5bc5377f4a280a6beb8f7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _ssl.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\_ssl.pyd
              • Size 180KB
              • SHA256 06f51fbe150c831af619890eea2d9fca9ce8b49758bfe3f382883551c592e6b3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _wmi.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\_wmi.pyd
              • Size 39KB
              • SHA256 eccb72a070d63f0ddde054c7a15d375b11b1dfc3362452c55ccabb487dee87fc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _zstd.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\_zstd.pyd
              • Size 491KB
              • SHA256 e5924e2985186797668dd3b2e1efeb9313459258a4564dbf5499935c7ebd44e7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              base_library.zip
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\base_library.zip
              • Size 1.3MB
              • SHA256 d6fac3c2c34d920bedc4f7024a411a129c544adb9fcd7d84c54f033a7cbcb67c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libcrypto-3.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\libcrypto-3.dll
              • Size 5.0MB
              • SHA256 eaf6d613b95b61a39558d84c50e72630a66c99914292df88e7b54ebd60c5bd34
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libffi-8.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\libffi-8.dll
              • Size 38KB
              • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libssl-3.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\libssl-3.dll
              • Size 776KB
              • SHA256 cf1a5fdcefa3daf69041f31f98ece1d7911ca4fcb8e9f1043b4d0f459ae4c936
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              python3.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\python3.dll
              • Size 72KB
              • SHA256 1dd696f02326e32e67b52c25b249b3acce3238176212d16e8fb1a050a1455ae9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              python314.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\python314.dll
              • Size 6.5MB
              • SHA256 a07f7d09c3121492bb066535c6d0811df5fbc2090cbca7031a97bb47ce1480c9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Lorem ipsum.txt
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
              • Size 1KB
              • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ucrtbase.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\ucrtbase.dll
              • Size 1.1MB
              • SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              unicodedata.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\unicodedata.pyd
              • Size 740KB
              • SHA256 58013696b4f08717aee2885aefa24031f4b18b3e62faa8125248cc3e0a86af2a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              explorer.exe
              • Path C:\Windows\Resources\Themes\explorer.exe
              • Size 135KB
              • SHA256 351b1efa8c3997729788834ed87fd301e1d5ca050ec84e7ebcd95b62ef0ad45e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              icsys.icn.exe
              • Path C:\Windows\Resources\Themes\icsys.icn.exe
              • Size 135KB
              • SHA256 d6103e0c9c75e47441c10faf363a3ba8bcaafe98ffd70e83de34ea003694454d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              svchost.exe
              • Path C:\Windows\Resources\svchost.exe
              • Size 135KB
              • SHA256 e81f2026b51d01fb3339f2e2bf12fce5f4be11f39abc0b0b0b78b90c9c01f816
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              spoolsv.exe
              • Path \??\c:\windows\resources\spoolsv.exe
              • Size 135KB
              • SHA256 27830ff49e402b9a6fd6ee9be74e83adc355505ae18beeb7a2ef8beb56f4afc1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/1220-487-0x0000000000400000-0x000000000041F000-memory.dmp
              Download

              memory/1788-486-0x0000000000400000-0x000000000041F000-memory.dmp
              Download

              memory/2752-296-0x0000000000400000-0x000000000041F000-memory.dmp
              Download

              memory/3752-299-0x0000000000400000-0x000000000041F000-memory.dmp
              Download

              memory/3972-332-0x0000020981ED0000-0x0000020981FD0000-memory.dmp
              Download

              memory/3972-324-0x00000209801E0000-0x00000209802E0000-memory.dmp
              Download

              memory/3972-369-0x0000020984950000-0x0000020984970000-memory.dmp
              Download

              memory/3972-355-0x0000020981E70000-0x0000020981E90000-memory.dmp
              Download

              memory/3972-322-0x00000209801E0000-0x00000209802E0000-memory.dmp
              Download

              memory/3972-331-0x0000020981BF0000-0x0000020981C10000-memory.dmp
              Download

              memory/4904-0-0x0000000000400000-0x000000000041F000-memory.dmp
              Download

              memory/4904-300-0x0000000000400000-0x000000000041F000-memory.dmp
              Download

              memory/5792-295-0x0000000000400000-0x000000000041F000-memory.dmp
              Download