Overview

overview

10

Static

static

3

2026-08-09...yn.exe

windows10-2004-x64

10

2026-08-09...yn.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/08/2026, 02:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_5899416916bc2d0ff496a3f616797af0_elex_glassworm_icedid_luca-stealer_njrat_swisyn.exe
  • Size 13.5MB
  • Sample260809-daefsayfkh
  • SHA256 d4a7aad7f2c253fdf1b0fc229cbe263ba5e73489a22064fb928095c65215ae46
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverypersistencepyinstaller

Malware Config

Signatures

  • Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 16 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Network Service Discovery 1 TTPs 45 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 5 IoCs
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Runs ping.exe 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_5899416916bc2d0ff496a3f616797af0_elex_glassworm_icedid_luca-stealer_njrat_swisyn.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_5899416916bc2d0ff496a3f616797af0_elex_glassworm_icedid_luca-stealer_njrat_swisyn.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4864
    • \??\c:\users\admin\appdata\local\temp\2026-08-09_5899416916bc2d0ff496a3f616797af0_elex_glassworm_icedid_luca-stealer_njrat_swisyn.exe 
      c:\users\admin\appdata\local\temp\2026-08-09_5899416916bc2d0ff496a3f616797af0_elex_glassworm_icedid_luca-stealer_njrat_swisyn.exe 
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:560
      • \??\c:\users\admin\appdata\local\temp\2026-08-09_5899416916bc2d0ff496a3f616797af0_elex_glassworm_icedid_luca-stealer_njrat_swisyn.exe 
        c:\users\admin\appdata\local\temp\2026-08-09_5899416916bc2d0ff496a3f616797af0_elex_glassworm_icedid_luca-stealer_njrat_swisyn.exe 
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2272
        • C:\Windows\SYSTEM32\route.exe
          route print
          4⤵
            PID:3864
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.96
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:552
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.60
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:4076
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.101
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:3080
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.89
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:1488
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.120
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:4792
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.147
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:1780
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.205
            4⤵
            • Runs ping.exe
            PID:3740
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.138
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:180
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.99
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:4824
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.166
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:2532
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.239
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:1456
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.143
            4⤵
            • Runs ping.exe
            PID:3144
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.132
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:2420
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.83
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:992
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.227
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:1700
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.228
            4⤵
              PID:2332
            • C:\Windows\SYSTEM32\ping.exe
              ping -n 1 -w 200 10.127.1.66
              4⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:3280
            • C:\Windows\SYSTEM32\ping.exe
              ping -n 1 -w 200 10.127.1.146
              4⤵
              • Runs ping.exe
              PID:3180
            • C:\Windows\SYSTEM32\ping.exe
              ping -n 1 -w 200 10.127.1.68
              4⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:2488
            • C:\Windows\SYSTEM32\ping.exe
              ping -n 1 -w 200 10.127.1.222
              4⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:1072
            • C:\Windows\SYSTEM32\ping.exe
              ping -n 1 -w 200 10.127.1.142
              4⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:1620
            • C:\Windows\SYSTEM32\ping.exe
              ping -n 1 -w 200 10.127.1.75
              4⤵
                PID:1748
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 200 10.127.1.106
                4⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                PID:3808
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 200 10.127.1.183
                4⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:4468
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 200 10.127.1.92
                4⤵
                • Runs ping.exe
                PID:3188
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 200 10.127.1.73
                4⤵
                • Runs ping.exe
                PID:2364
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 200 10.127.1.133
                4⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:972
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 200 10.127.1.123
                4⤵
                • Runs ping.exe
                PID:3192
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 200 10.127.1.145
                4⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:3404
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 200 10.127.1.240
                4⤵
                • Runs ping.exe
                PID:4908
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 200 10.127.1.109
                4⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                PID:2816
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 200 10.127.1.98
                4⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:4388
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 200 10.127.1.124
                4⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:2668
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 200 10.127.1.188
                4⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:1584
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 200 10.127.1.167
                4⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:3968
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 200 10.127.1.119
                4⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:2932
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 200 10.127.1.110
                4⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:1536
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 200 10.127.1.117
                4⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                PID:4356
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 200 10.127.1.128
                4⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                PID:4264
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 200 10.127.1.70
                4⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:1936
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 200 10.127.1.230
                4⤵
                • Runs ping.exe
                PID:1788
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 200 10.127.1.61
                4⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:1580
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 200 10.127.1.164
                4⤵
                • Runs ping.exe
                PID:2376
              • C:\Windows\SYSTEM32\arp.exe
                arp -a
                4⤵
                • Network Service Discovery
                PID:4748
              • C:\Windows\SYSTEM32\arp.exe
                arp -a
                4⤵
                • Network Service Discovery
                PID:2104
              • C:\Windows\SYSTEM32\arp.exe
                arp -a
                4⤵
                • Network Service Discovery
                PID:4940
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 200 10.127.1.208
                4⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                PID:3512
              • C:\Windows\SYSTEM32\arp.exe
                arp -a
                4⤵
                • Network Service Discovery
                PID:3616
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 200 10.127.1.79
                4⤵
                  PID:1676
                • C:\Windows\SYSTEM32\arp.exe
                  arp -a
                  4⤵
                  • Network Service Discovery
                  PID:5008
                • C:\Windows\SYSTEM32\arp.exe
                  arp -a
                  4⤵
                  • Network Service Discovery
                  PID:4692
                • C:\Windows\SYSTEM32\ping.exe
                  ping -n 1 -w 500 10.127.1.96
                  4⤵
                  • Runs ping.exe
                  PID:1564
                • C:\Windows\SYSTEM32\arp.exe
                  arp -a
                  4⤵
                  • Network Service Discovery
                  PID:4280
                • C:\Windows\SYSTEM32\arp.exe
                  arp -a
                  4⤵
                  • Network Service Discovery
                  PID:1628
                • C:\Windows\SYSTEM32\arp.exe
                  arp -a
                  4⤵
                  • Network Service Discovery
                  PID:4772
                • C:\Windows\SYSTEM32\ping.exe
                  ping -n 1 -w 500 10.127.1.60
                  4⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:616
                • C:\Windows\SYSTEM32\ping.exe
                  ping -n 1 -w 200 10.127.1.192
                  4⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:1020
                • C:\Windows\SYSTEM32\arp.exe
                  arp -a
                  4⤵
                  • Network Service Discovery
                  PID:5056
                • C:\Windows\SYSTEM32\arp.exe
                  arp -a
                  4⤵
                  • Network Service Discovery
                  PID:4616
                • C:\Windows\SYSTEM32\ping.exe
                  ping -n 1 -w 500 10.127.1.101
                  4⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  PID:4904
                • C:\Windows\SYSTEM32\arp.exe
                  arp -a
                  4⤵
                  • Network Service Discovery
                  PID:1292
                • C:\Windows\SYSTEM32\ping.exe
                  ping -n 1 -w 500 10.127.1.89
                  4⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:4676
                • C:\Windows\SYSTEM32\ping.exe
                  ping -n 1 -w 500 10.127.1.99
                  4⤵
                  • Runs ping.exe
                  PID:2180
                • C:\Windows\SYSTEM32\ping.exe
                  ping -n 1 -w 500 10.127.1.120
                  4⤵
                    PID:2348
                  • C:\Windows\SYSTEM32\ping.exe
                    ping -n 1 -w 500 10.127.1.147
                    4⤵
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Runs ping.exe
                    PID:4064
                  • C:\Windows\SYSTEM32\ping.exe
                    ping -n 1 -w 200 10.127.1.95
                    4⤵
                    • Runs ping.exe
                    PID:3912
                  • C:\Windows\SYSTEM32\arp.exe
                    arp -a
                    4⤵
                    • Network Service Discovery
                    PID:884
                  • C:\Windows\SYSTEM32\arp.exe
                    arp -a
                    4⤵
                    • Network Service Discovery
                    PID:4032
                  • C:\Windows\SYSTEM32\arp.exe
                    arp -a
                    4⤵
                    • Network Service Discovery
                    PID:836
                  • C:\Windows\SYSTEM32\ping.exe
                    ping -n 1 -w 500 10.127.1.239
                    4⤵
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Runs ping.exe
                    PID:3224
                  • C:\Windows\SYSTEM32\arp.exe
                    arp -a
                    4⤵
                    • Network Service Discovery
                    PID:1948
                  • C:\Windows\SYSTEM32\ping.exe
                    ping -n 1 -w 500 10.127.1.138
                    4⤵
                    • Runs ping.exe
                    PID:4892
                  • C:\Windows\SYSTEM32\arp.exe
                    arp -a
                    4⤵
                    • Network Service Discovery
                    PID:3944
                  • C:\Windows\SYSTEM32\arp.exe
                    arp -a
                    4⤵
                    • Network Service Discovery
                    PID:3176
                  • C:\Windows\SYSTEM32\arp.exe
                    arp -a
                    4⤵
                    • Network Service Discovery
                    PID:4544
                  • C:\Windows\SYSTEM32\ping.exe
                    ping -n 1 -w 500 10.127.1.166
                    4⤵
                    • System Network Configuration Discovery: Internet Connection Discovery
                    PID:2508
                  • C:\Windows\SYSTEM32\ping.exe
                    ping -n 1 -w 500 10.127.1.143
                    4⤵
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Runs ping.exe
                    PID:4008
                  • C:\Windows\SYSTEM32\ping.exe
                    ping -n 1 -w 500 10.127.1.205
                    4⤵
                    • Runs ping.exe
                    PID:944
                  • C:\Windows\SYSTEM32\arp.exe
                    arp -a
                    4⤵
                    • Network Service Discovery
                    PID:60
                  • C:\Windows\SYSTEM32\ping.exe
                    ping -n 1 -w 200 10.127.1.170
                    4⤵
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Runs ping.exe
                    PID:4924
                  • C:\Windows\SYSTEM32\arp.exe
                    arp -a
                    4⤵
                    • Network Service Discovery
                    PID:536
                  • C:\Windows\SYSTEM32\arp.exe
                    arp -a
                    4⤵
                    • Network Service Discovery
                    PID:404
                  • C:\Windows\SYSTEM32\ping.exe
                    ping -n 1 -w 500 10.127.1.227
                    4⤵
                    • Runs ping.exe
                    PID:1572
                  • C:\Windows\SYSTEM32\ping.exe
                    ping -n 1 -w 500 10.127.1.132
                    4⤵
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Runs ping.exe
                    PID:456
                  • C:\Windows\SYSTEM32\ping.exe
                    ping -n 1 -w 500 10.127.1.83
                    4⤵
                    • Runs ping.exe
                    PID:2280
                  • C:\Windows\SYSTEM32\ping.exe
                    ping -n 1 -w 200 10.127.1.118
                    4⤵
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Runs ping.exe
                    PID:904
                  • C:\Windows\SYSTEM32\arp.exe
                    arp -a
                    4⤵
                    • Network Service Discovery
                    PID:1972
                  • C:\Windows\SYSTEM32\ping.exe
                    ping -n 1 -w 500 10.127.1.146
                    4⤵
                      PID:1996
                    • C:\Windows\SYSTEM32\arp.exe
                      arp -a
                      4⤵
                      • Network Service Discovery
                      PID:2080
                    • C:\Windows\SYSTEM32\ping.exe
                      ping -n 1 -w 500 10.127.1.75
                      4⤵
                        PID:2552
                      • C:\Windows\SYSTEM32\ping.exe
                        ping -n 1 -w 500 10.127.1.66
                        4⤵
                        • Runs ping.exe
                        PID:3152
                      • C:\Windows\SYSTEM32\arp.exe
                        arp -a
                        4⤵
                        • Network Service Discovery
                        PID:3352
                      • C:\Windows\SYSTEM32\arp.exe
                        arp -a
                        4⤵
                        • Network Service Discovery
                        PID:3816
                      • C:\Windows\SYSTEM32\arp.exe
                        arp -a
                        4⤵
                        • Network Service Discovery
                        PID:816
                      • C:\Windows\SYSTEM32\arp.exe
                        arp -a
                        4⤵
                        • Network Service Discovery
                        PID:4132
                      • C:\Windows\SYSTEM32\arp.exe
                        arp -a
                        4⤵
                        • Network Service Discovery
                        PID:4116
                      • C:\Windows\SYSTEM32\arp.exe
                        arp -a
                        4⤵
                        • Network Service Discovery
                        PID:2516
                      • C:\Windows\SYSTEM32\ping.exe
                        ping -n 1 -w 500 10.127.1.228
                        4⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Runs ping.exe
                        PID:1308
                      • C:\Windows\SYSTEM32\ping.exe
                        ping -n 1 -w 500 10.127.1.142
                        4⤵
                          PID:1560
                        • C:\Windows\SYSTEM32\ping.exe
                          ping -n 1 -w 500 10.127.1.222
                          4⤵
                          • System Network Configuration Discovery: Internet Connection Discovery
                          PID:1944
                        • C:\Windows\SYSTEM32\arp.exe
                          arp -a
                          4⤵
                          • Network Service Discovery
                          PID:2672
                        • C:\Windows\SYSTEM32\arp.exe
                          arp -a
                          4⤵
                          • Network Service Discovery
                          PID:3688
                        • C:\Windows\SYSTEM32\ping.exe
                          ping -n 1 -w 500 10.127.1.73
                          4⤵
                            PID:5052
                          • C:\Windows\SYSTEM32\ping.exe
                            ping -n 1 -w 500 10.127.1.106
                            4⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            PID:1836
                          • C:\Windows\SYSTEM32\arp.exe
                            arp -a
                            4⤵
                            • Network Service Discovery
                            PID:4024
                          • C:\Windows\SYSTEM32\arp.exe
                            arp -a
                            4⤵
                            • Network Service Discovery
                            PID:4012
                          • C:\Windows\SYSTEM32\arp.exe
                            arp -a
                            4⤵
                            • Network Service Discovery
                            PID:2176
                          • C:\Windows\SYSTEM32\ping.exe
                            ping -n 1 -w 500 10.127.1.68
                            4⤵
                            • Runs ping.exe
                            PID:4988
                          • C:\Windows\SYSTEM32\arp.exe
                            arp -a
                            4⤵
                            • Network Service Discovery
                            PID:4252
                          • C:\Windows\SYSTEM32\arp.exe
                            arp -a
                            4⤵
                            • Network Service Discovery
                            PID:752
                          • C:\Windows\SYSTEM32\arp.exe
                            arp -a
                            4⤵
                            • Network Service Discovery
                            PID:3932
                          • C:\Windows\SYSTEM32\arp.exe
                            arp -a
                            4⤵
                            • Network Service Discovery
                            PID:4652
                          • C:\Windows\SYSTEM32\ping.exe
                            ping -n 1 -w 500 10.127.1.119
                            4⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            PID:2032
                          • C:\Windows\SYSTEM32\ping.exe
                            ping -n 1 -w 500 10.127.1.240
                            4⤵
                            • Runs ping.exe
                            PID:2360
                          • C:\Windows\SYSTEM32\ping.exe
                            ping -n 1 -w 500 10.127.1.117
                            4⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            • Runs ping.exe
                            PID:3844
                          • C:\Windows\SYSTEM32\arp.exe
                            arp -a
                            4⤵
                            • Network Service Discovery
                            PID:4276
                          • C:\Windows\SYSTEM32\arp.exe
                            arp -a
                            4⤵
                            • Network Service Discovery
                            PID:2624
                          • C:\Windows\SYSTEM32\ping.exe
                            ping -n 1 -w 200 10.127.1.173
                            4⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            PID:4916
                          • C:\Windows\SYSTEM32\arp.exe
                            arp -a
                            4⤵
                            • Network Service Discovery
                            PID:700
                          • C:\Windows\SYSTEM32\ping.exe
                            ping -n 1 -w 500 10.127.1.92
                            4⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            PID:4564
                          • C:\Windows\SYSTEM32\ping.exe
                            ping -n 1 -w 500 10.127.1.208
                            4⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            PID:1656
                          • C:\Windows\SYSTEM32\ping.exe
                            ping -n 1 -w 500 10.127.1.183
                            4⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            • Runs ping.exe
                            PID:1084
                          • C:\Windows\SYSTEM32\arp.exe
                            arp -a
                            4⤵
                            • Network Service Discovery
                            PID:4272
                          • C:\Windows\SYSTEM32\arp.exe
                            arp -a
                            4⤵
                            • Network Service Discovery
                            PID:3372
                          • C:\Windows\SYSTEM32\arp.exe
                            arp -a
                            4⤵
                            • Network Service Discovery
                            PID:4500
                          • C:\Windows\SYSTEM32\ping.exe
                            ping -n 1 -w 500 10.127.1.61
                            4⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            • Runs ping.exe
                            PID:3600
                          • C:\Windows\SYSTEM32\ping.exe
                            ping -n 1 -w 500 10.127.1.110
                            4⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            PID:4524
                          • C:\Windows\SYSTEM32\ping.exe
                            ping -n 1 -w 500 10.127.1.70
                            4⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            PID:2044
                          • C:\Windows\SYSTEM32\ping.exe
                            ping -n 1 -w 500 10.127.1.145
                            4⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            PID:2168
                          • C:\Windows\SYSTEM32\ping.exe
                            ping -n 1 -w 500 10.127.1.230
                            4⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            • Runs ping.exe
                            PID:4508
                          • C:\Windows\SYSTEM32\ping.exe
                            ping -n 1 -w 500 10.127.1.133
                            4⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            • Runs ping.exe
                            PID:2356
                          • C:\Windows\SYSTEM32\ping.exe
                            ping -n 1 -w 500 10.127.1.123
                            4⤵
                            • Runs ping.exe
                            PID:1120
                          • C:\Windows\SYSTEM32\ping.exe
                            ping -n 1 -w 500 10.127.1.128
                            4⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            PID:2200
                          • C:\Windows\SYSTEM32\ping.exe
                            ping -n 1 -w 500 10.127.1.109
                            4⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            • Runs ping.exe
                            PID:1032
                          • C:\Windows\SYSTEM32\ping.exe
                            ping -n 1 -w 500 10.127.1.188
                            4⤵
                            • Runs ping.exe
                            PID:1404
                          • C:\Windows\SYSTEM32\ping.exe
                            ping -n 1 -w 500 10.127.1.98
                            4⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            PID:4852
                          • C:\Windows\SYSTEM32\ping.exe
                            ping -n 1 -w 500 10.127.1.124
                            4⤵
                            • Runs ping.exe
                            PID:1764
                          • C:\Windows\SYSTEM32\ping.exe
                            ping -n 1 -w 500 10.127.1.164
                            4⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            PID:1200
                          • C:\Windows\SYSTEM32\ping.exe
                            ping -n 1 -w 500 10.127.1.167
                            4⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            PID:1108
                          • C:\Windows\SYSTEM32\ping.exe
                            ping -n 1 -w 500 10.127.1.79
                            4⤵
                            • Runs ping.exe
                            PID:644
                      • C:\Windows\Resources\Themes\icsys.icn.exe
                        C:\Windows\Resources\Themes\icsys.icn.exe
                        2⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:1512
                        • \??\c:\windows\resources\themes\explorer.exe
                          c:\windows\resources\themes\explorer.exe
                          3⤵
                          • Modifies visibility of hidden/system files in Explorer
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Drops file in System32 directory
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: GetForegroundWindowSpam
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:2632
                          • \??\c:\windows\resources\spoolsv.exe
                            c:\windows\resources\spoolsv.exe SE
                            4⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            • Suspicious use of WriteProcessMemory
                            PID:452
                            • \??\c:\windows\resources\svchost.exe
                              c:\windows\resources\svchost.exe
                              5⤵
                              • Modifies visibility of hidden/system files in Explorer
                              • Executes dropped EXE
                              • Adds Run key to start application
                              • Drops file in System32 directory
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: GetForegroundWindowSpam
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:3680
                              • \??\c:\windows\resources\spoolsv.exe
                                c:\windows\resources\spoolsv.exe PR
                                6⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of SetWindowsHookEx
                                PID:1648

                    Network

                          MITRE ATT&CK Enterprise v16

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          2026-08-09_5899416916bc2d0ff496a3f616797af0_elex_glassworm_icedid_luca-stealer_njrat_swisyn.exe 
                          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-09_5899416916bc2d0ff496a3f616797af0_elex_glassworm_icedid_luca-stealer_njrat_swisyn.exe 
                          • Size 13.4MB
                          • SHA256 8c858709b7aa1db974abe6ed0fd52e869409cc1c6a0b315078f190d5a4519774
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          VCRUNTIME140.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI5602\VCRUNTIME140.dll
                          • Size 117KB
                          • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          VCRUNTIME140_1.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI5602\VCRUNTIME140_1.dll
                          • Size 48KB
                          • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _asyncio.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI5602\_asyncio.pyd
                          • Size 76KB
                          • SHA256 f9dc3b563e0b313e3fa5364c2f14b1fe08d004d70126a6de5d78826db77c6318
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _bz2.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI5602\_bz2.pyd
                          • Size 85KB
                          • SHA256 082a761a280b08afecf6fb0509050ffbf7e87d1638ca49466b8b3eb4c85009b4
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _ctypes.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI5602\_ctypes.pyd
                          • Size 139KB
                          • SHA256 a11d680d89f054584e6a5b2a03103d8731def86e367aff2f70cce8c6367f9025
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _decimal.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI5602\_decimal.pyd
                          • Size 283KB
                          • SHA256 dcc9555eaf911af7997777b94beea78f802a10f1e4f3c3d4df2f254d44c71797
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _hashlib.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI5602\_hashlib.pyd
                          • Size 67KB
                          • SHA256 0c11671a2c572b4c016be263789f238125419df5711e281acdce8da50d9badda
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _lzma.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI5602\_lzma.pyd
                          • Size 157KB
                          • SHA256 2376cd374ce8c2c5ecf573226e563a96975599533f86a5f5eba5bdb705e341bb
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _multiprocessing.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI5602\_multiprocessing.pyd
                          • Size 37KB
                          • SHA256 95d858739bfff9b9116cc790596be9774b5c2c7ae509a0fc3e235a5d370b06ab
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _overlapped.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI5602\_overlapped.pyd
                          • Size 56KB
                          • SHA256 03b191b897be7f98e177a8ccffd5df76305720d3ce16a979abfca3f6223f4d13
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _queue.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI5602\_queue.pyd
                          • Size 35KB
                          • SHA256 8e75c8667f938c3e9b2e9739c09b08517b487437757f125ac400c70c7eadf270
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _socket.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI5602\_socket.pyd
                          • Size 85KB
                          • SHA256 42b84410269af5a5578679a3fe7b17d75d28f77a0c3c09d589adadd9d2d3e5f6
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _ssl.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI5602\_ssl.pyd
                          • Size 180KB
                          • SHA256 bc17486f149f7311839c70b1cda5a22e4546a9670d3136d665df95ff3cc43abd
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _wmi.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI5602\_wmi.pyd
                          • Size 39KB
                          • SHA256 a299a6caf7241cebb0081c3ed9e98f815c61feee3e4813c1fd32369bd3fe6f5e
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _zstd.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI5602\_zstd.pyd
                          • Size 491KB
                          • SHA256 8f04a54778d4f21202f1bb9cfd5d080c5c5022158016dcaaf5908f7e2350270c
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          base_library.zip
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI5602\base_library.zip
                          • Size 1.3MB
                          • SHA256 ba29a36738017b5ee734287773d9e9540063defd7f80ca03fbfa211c328a74ad
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          libcrypto-3.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI5602\libcrypto-3.dll
                          • Size 5.0MB
                          • SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          libffi-8.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI5602\libffi-8.dll
                          • Size 38KB
                          • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          libssl-3.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI5602\libssl-3.dll
                          • Size 776KB
                          • SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          pyexpat.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI5602\pyexpat.pyd
                          • Size 214KB
                          • SHA256 85673f29fa2f16e70fb95c1da0e53e819033a19b43964662d1e487b307d8c400
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          python314.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI5602\python314.dll
                          • Size 6.4MB
                          • SHA256 7ffe3ab11342db03cc18b026f27485c0f74f5bf10f239f1f6573394900596394
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          select.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI5602\select.pyd
                          • Size 32KB
                          • SHA256 a0f7b2e00144794e497d11fffc14e7a968f59e207c702ca7b262b7037065b5ba
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Lorem ipsum.txt
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI5602\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
                          • Size 1KB
                          • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          unicodedata.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI5602\unicodedata.pyd
                          • Size 740KB
                          • SHA256 64844c24f67e7eafb77142b4cbe4a430f4db3b16f59191586ba6596ca19fc775
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          explorer.exe
                          • Path C:\Windows\Resources\Themes\explorer.exe
                          • Size 135KB
                          • SHA256 467c9c1064f2c205a920c992c8ac9db0c496fb27d50ac194571da657b03b8d38
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          icsys.icn.exe
                          • Path C:\Windows\Resources\Themes\icsys.icn.exe
                          • Size 135KB
                          • SHA256 9fdba09f12d177d042a83f73fa01ff0608a37f079934e59422e741918e3374d5
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          spoolsv.exe
                          • Path \??\c:\windows\resources\spoolsv.exe
                          • Size 135KB
                          • SHA256 1cce13b8b8fe028674ed043153a02a6dfb76bc3e9393a6960b0531e7cd39c304
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          svchost.exe
                          • Path \??\c:\windows\resources\svchost.exe
                          • Size 135KB
                          • SHA256 824686b387a2b2457fd452e074dbe1d987085a176b3dfab3470197b232dfe315
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          memory/452-117-0x0000000000400000-0x000000000041F000-memory.dmp
                          Download

                          memory/452-61-0x0000000000400000-0x000000000041F000-memory.dmp
                          Download

                          memory/1512-118-0x0000000000400000-0x000000000041F000-memory.dmp
                          Download

                          memory/1648-116-0x0000000000400000-0x000000000041F000-memory.dmp
                          Download

                          memory/1648-109-0x0000000000400000-0x000000000041F000-memory.dmp
                          Download

                          memory/2632-121-0x0000000000400000-0x000000000041F000-memory.dmp
                          Download

                          memory/3680-79-0x0000000000400000-0x000000000041F000-memory.dmp
                          Download

                          memory/3680-122-0x0000000000400000-0x000000000041F000-memory.dmp
                          Download

                          memory/4864-119-0x0000000000400000-0x000000000041F000-memory.dmp
                          Download

                          memory/4864-0-0x0000000000400000-0x000000000041F000-memory.dmp
                          Download