Overview

overview

10

Static

static

3

2026-08-09...yn.exe

windows10-2004-x64

10

2026-08-09...yn.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    124s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 02:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_5899416916bc2d0ff496a3f616797af0_elex_glassworm_icedid_luca-stealer_njrat_swisyn.exe
  • Size 13.5MB
  • Sample260809-daefsayfkh
  • SHA256 d4a7aad7f2c253fdf1b0fc229cbe263ba5e73489a22064fb928095c65215ae46
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionpersistencepyinstaller

Malware Config

Signatures

  • Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 16 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Network Service Discovery 1 TTPs 34 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 5 IoCs
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Runs ping.exe 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_5899416916bc2d0ff496a3f616797af0_elex_glassworm_icedid_luca-stealer_njrat_swisyn.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_5899416916bc2d0ff496a3f616797af0_elex_glassworm_icedid_luca-stealer_njrat_swisyn.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4892
    • \??\c:\users\admin\appdata\local\temp\2026-08-09_5899416916bc2d0ff496a3f616797af0_elex_glassworm_icedid_luca-stealer_njrat_swisyn.exe 
      c:\users\admin\appdata\local\temp\2026-08-09_5899416916bc2d0ff496a3f616797af0_elex_glassworm_icedid_luca-stealer_njrat_swisyn.exe 
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:5688
      • \??\c:\users\admin\appdata\local\temp\2026-08-09_5899416916bc2d0ff496a3f616797af0_elex_glassworm_icedid_luca-stealer_njrat_swisyn.exe 
        c:\users\admin\appdata\local\temp\2026-08-09_5899416916bc2d0ff496a3f616797af0_elex_glassworm_icedid_luca-stealer_njrat_swisyn.exe 
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:3472
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "ver"
          4⤵
          • Executes a command shell one-liner
          PID:5932
        • C:\Windows\SYSTEM32\route.exe
          route print
          4⤵
            PID:1496
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.219
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:5396
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.166
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:3108
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.208
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:576
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.124
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:5824
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.227
            4⤵
            • Runs ping.exe
            PID:5904
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.119
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:4932
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.135
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:5556
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.99
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:2648
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.176
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:1412
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.225
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:3100
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.63
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:1124
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.69
            4⤵
            • Runs ping.exe
            PID:4936
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.158
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:2956
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.83
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:5008
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.100
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:1240
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.150
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:1704
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.192
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:6040
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.217
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:760
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.198
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:864
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.228
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:1152
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.121
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:1420
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.202
            4⤵
            • Runs ping.exe
            PID:1008
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.222
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:5160
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.139
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:5104
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.104
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:2336
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.141
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:2352
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.94
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:4488
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.108
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:1576
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.65
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:5116
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.216
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:1960
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.205
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:4904
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.77
            4⤵
            • Runs ping.exe
            PID:5280
          • C:\Windows\SYSTEM32\arp.exe
            arp -a
            4⤵
            • Network Service Discovery
            PID:3248
          • C:\Windows\SYSTEM32\arp.exe
            arp -a
            4⤵
            • Network Service Discovery
            PID:5704
          • C:\Windows\SYSTEM32\arp.exe
            arp -a
            4⤵
            • Network Service Discovery
            PID:3204
          • C:\Windows\SYSTEM32\arp.exe
            arp -a
            4⤵
            • Network Service Discovery
            PID:5840
          • C:\Windows\SYSTEM32\arp.exe
            arp -a
            4⤵
            • Network Service Discovery
            PID:3788
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.118
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:4704
          • C:\Windows\SYSTEM32\arp.exe
            arp -a
            4⤵
            • Network Service Discovery
            PID:3796
          • C:\Windows\SYSTEM32\arp.exe
            arp -a
            4⤵
            • Network Service Discovery
            PID:1820
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.147
            4⤵
            • Runs ping.exe
            PID:2284
          • C:\Windows\SYSTEM32\arp.exe
            arp -a
            4⤵
            • Network Service Discovery
            PID:2832
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 500 10.127.1.121
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:4524
          • C:\Windows\SYSTEM32\arp.exe
            arp -a
            4⤵
            • Network Service Discovery
            PID:3328
          • C:\Windows\SYSTEM32\arp.exe
            arp -a
            4⤵
            • Network Service Discovery
            PID:1944
          • C:\Windows\SYSTEM32\arp.exe
            arp -a
            4⤵
            • Network Service Discovery
            PID:4500
          • C:\Windows\SYSTEM32\arp.exe
            arp -a
            4⤵
            • Network Service Discovery
            PID:2496
          • C:\Windows\SYSTEM32\arp.exe
            arp -a
            4⤵
            • Network Service Discovery
            PID:2720
          • C:\Windows\SYSTEM32\arp.exe
            arp -a
            4⤵
            • Network Service Discovery
            PID:3236
          • C:\Windows\SYSTEM32\arp.exe
            arp -a
            4⤵
            • Network Service Discovery
            PID:5948
          • C:\Windows\SYSTEM32\arp.exe
            arp -a
            4⤵
            • Network Service Discovery
            PID:4384
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.67
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:4852
          • C:\Windows\SYSTEM32\arp.exe
            arp -a
            4⤵
            • Network Service Discovery
            PID:5380
          • C:\Windows\SYSTEM32\arp.exe
            arp -a
            4⤵
            • Network Service Discovery
            PID:5388
          • C:\Windows\SYSTEM32\arp.exe
            arp -a
            4⤵
            • Network Service Discovery
            PID:5616
          • C:\Windows\SYSTEM32\arp.exe
            arp -a
            4⤵
            • Network Service Discovery
            PID:5956
          • C:\Windows\SYSTEM32\arp.exe
            arp -a
            4⤵
            • Network Service Discovery
            PID:5936
          • C:\Windows\SYSTEM32\arp.exe
            arp -a
            4⤵
            • Network Service Discovery
            PID:4520
          • C:\Windows\SYSTEM32\arp.exe
            arp -a
            4⤵
            • Network Service Discovery
            PID:712
          • C:\Windows\SYSTEM32\arp.exe
            arp -a
            4⤵
            • Network Service Discovery
            PID:4588
          • C:\Windows\SYSTEM32\arp.exe
            arp -a
            4⤵
            • Network Service Discovery
            PID:2644
          • C:\Windows\SYSTEM32\arp.exe
            arp -a
            4⤵
            • Network Service Discovery
            PID:4728
          • C:\Windows\SYSTEM32\arp.exe
            arp -a
            4⤵
            • Network Service Discovery
            PID:5992
          • C:\Windows\SYSTEM32\arp.exe
            arp -a
            4⤵
            • Network Service Discovery
            PID:1548
          • C:\Windows\SYSTEM32\arp.exe
            arp -a
            4⤵
            • Network Service Discovery
            PID:2612
          • C:\Windows\SYSTEM32\arp.exe
            arp -a
            4⤵
            • Network Service Discovery
            PID:1176
          • C:\Windows\SYSTEM32\arp.exe
            arp -a
            4⤵
            • Network Service Discovery
            PID:1912
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 500 10.127.1.83
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:3380
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.148
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:4056
          • C:\Windows\SYSTEM32\arp.exe
            arp -a
            4⤵
            • Network Service Discovery
            PID:3360
          • C:\Windows\SYSTEM32\arp.exe
            arp -a
            4⤵
            • Network Service Discovery
            PID:1148
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.171
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:2960
          • C:\Windows\SYSTEM32\arp.exe
            arp -a
            4⤵
            • Network Service Discovery
            PID:2192
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.116
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:4636
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 500 10.127.1.216
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:4484
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.174
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:5016
          • C:\Windows\SYSTEM32\ping.exe
            ping -n 1 -w 200 10.127.1.196
            4⤵
              PID:4552
            • C:\Windows\SYSTEM32\ping.exe
              ping -n 1 -w 200 10.127.1.112
              4⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:2304
            • C:\Windows\SYSTEM32\ping.exe
              ping -n 1 -w 200 10.127.1.220
              4⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:1796
            • C:\Windows\SYSTEM32\ping.exe
              ping -n 1 -w 200 10.127.1.149
              4⤵
              • Runs ping.exe
              PID:4548
            • C:\Windows\SYSTEM32\ping.exe
              ping -n 1 -w 200 10.127.1.175
              4⤵
              • Runs ping.exe
              PID:5560
            • C:\Windows\SYSTEM32\ping.exe
              ping -n 1 -w 500 10.127.1.158
              4⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:2108
            • C:\Windows\SYSTEM32\ping.exe
              ping -n 1 -w 500 10.127.1.147
              4⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:2920
            • C:\Windows\SYSTEM32\ping.exe
              ping -n 1 -w 500 10.127.1.176
              4⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:1044
            • C:\Windows\SYSTEM32\ping.exe
              ping -n 1 -w 500 10.127.1.65
              4⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:6084
            • C:\Windows\SYSTEM32\ping.exe
              ping -n 1 -w 500 10.127.1.124
              4⤵
                PID:5240
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 500 10.127.1.139
                4⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:1676
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 500 10.127.1.202
                4⤵
                • Runs ping.exe
                PID:1972
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 500 10.127.1.108
                4⤵
                • Runs ping.exe
                PID:5336
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 500 10.127.1.219
                4⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:5912
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 500 10.127.1.150
                4⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                PID:1364
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 500 10.127.1.135
                4⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:4508
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 500 10.127.1.227
                4⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:2492
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 500 10.127.1.100
                4⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:3824
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 500 10.127.1.63
                4⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                PID:1032
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 500 10.127.1.118
                4⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                PID:4684
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 500 10.127.1.77
                4⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:2724
              • C:\Windows\SYSTEM32\ping.exe
                ping -n 1 -w 500 10.127.1.99
                4⤵
                  PID:4336
                • C:\Windows\SYSTEM32\ping.exe
                  ping -n 1 -w 500 10.127.1.192
                  4⤵
                  • Runs ping.exe
                  PID:3512
                • C:\Windows\SYSTEM32\ping.exe
                  ping -n 1 -w 500 10.127.1.198
                  4⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:1580
                • C:\Windows\SYSTEM32\ping.exe
                  ping -n 1 -w 500 10.127.1.69
                  4⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:1692
                • C:\Windows\SYSTEM32\ping.exe
                  ping -n 1 -w 500 10.127.1.222
                  4⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:4208
                • C:\Windows\SYSTEM32\ping.exe
                  ping -n 1 -w 500 10.127.1.119
                  4⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  PID:2504
                • C:\Windows\SYSTEM32\ping.exe
                  ping -n 1 -w 500 10.127.1.228
                  4⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:1264
                • C:\Windows\SYSTEM32\ping.exe
                  ping -n 1 -w 500 10.127.1.94
                  4⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:4828
                • C:\Windows\SYSTEM32\ping.exe
                  ping -n 1 -w 500 10.127.1.166
                  4⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:2604
                • C:\Windows\SYSTEM32\ping.exe
                  ping -n 1 -w 500 10.127.1.141
                  4⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  PID:2320
                • C:\Windows\SYSTEM32\ping.exe
                  ping -n 1 -w 500 10.127.1.217
                  4⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:5660
                • C:\Windows\SYSTEM32\ping.exe
                  ping -n 1 -w 500 10.127.1.205
                  4⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:3160
                • C:\Windows\SYSTEM32\ping.exe
                  ping -n 1 -w 500 10.127.1.208
                  4⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:5224
                • C:\Windows\SYSTEM32\ping.exe
                  ping -n 1 -w 500 10.127.1.225
                  4⤵
                    PID:6012
                  • C:\Windows\SYSTEM32\ping.exe
                    ping -n 1 -w 500 10.127.1.104
                    4⤵
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Runs ping.exe
                    PID:5680
              • C:\Windows\Resources\Themes\icsys.icn.exe
                C:\Windows\Resources\Themes\icsys.icn.exe
                2⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:4196
                • \??\c:\windows\resources\themes\explorer.exe
                  c:\windows\resources\themes\explorer.exe
                  3⤵
                  • Modifies visibility of hidden/system files in Explorer
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: GetForegroundWindowSpam
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:3212
                  • \??\c:\windows\resources\spoolsv.exe
                    c:\windows\resources\spoolsv.exe SE
                    4⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:4292
                    • \??\c:\windows\resources\svchost.exe
                      c:\windows\resources\svchost.exe
                      5⤵
                      • Modifies visibility of hidden/system files in Explorer
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Drops file in System32 directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: GetForegroundWindowSpam
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:4760
                      • \??\c:\windows\resources\spoolsv.exe
                        c:\windows\resources\spoolsv.exe PR
                        6⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        PID:3408

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  2026-08-09_5899416916bc2d0ff496a3f616797af0_elex_glassworm_icedid_luca-stealer_njrat_swisyn.exe 
                  • Path C:\Users\Admin\AppData\Local\Temp\2026-08-09_5899416916bc2d0ff496a3f616797af0_elex_glassworm_icedid_luca-stealer_njrat_swisyn.exe 
                  • Size 13.4MB
                  • SHA256 8c858709b7aa1db974abe6ed0fd52e869409cc1c6a0b315078f190d5a4519774
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  VCRUNTIME140.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI56882\VCRUNTIME140.dll
                  • Size 117KB
                  • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  VCRUNTIME140_1.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI56882\VCRUNTIME140_1.dll
                  • Size 48KB
                  • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _bz2.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI56882\_bz2.pyd
                  • Size 85KB
                  • SHA256 082a761a280b08afecf6fb0509050ffbf7e87d1638ca49466b8b3eb4c85009b4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _ctypes.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI56882\_ctypes.pyd
                  • Size 139KB
                  • SHA256 a11d680d89f054584e6a5b2a03103d8731def86e367aff2f70cce8c6367f9025
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _hashlib.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI56882\_hashlib.pyd
                  • Size 67KB
                  • SHA256 0c11671a2c572b4c016be263789f238125419df5711e281acdce8da50d9badda
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _lzma.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI56882\_lzma.pyd
                  • Size 157KB
                  • SHA256 2376cd374ce8c2c5ecf573226e563a96975599533f86a5f5eba5bdb705e341bb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _queue.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI56882\_queue.pyd
                  • Size 35KB
                  • SHA256 8e75c8667f938c3e9b2e9739c09b08517b487437757f125ac400c70c7eadf270
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _socket.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI56882\_socket.pyd
                  • Size 85KB
                  • SHA256 42b84410269af5a5578679a3fe7b17d75d28f77a0c3c09d589adadd9d2d3e5f6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _ssl.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI56882\_ssl.pyd
                  • Size 180KB
                  • SHA256 bc17486f149f7311839c70b1cda5a22e4546a9670d3136d665df95ff3cc43abd
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _wmi.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI56882\_wmi.pyd
                  • Size 39KB
                  • SHA256 a299a6caf7241cebb0081c3ed9e98f815c61feee3e4813c1fd32369bd3fe6f5e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _zstd.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI56882\_zstd.pyd
                  • Size 491KB
                  • SHA256 8f04a54778d4f21202f1bb9cfd5d080c5c5022158016dcaaf5908f7e2350270c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  base_library.zip
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI56882\base_library.zip
                  • Size 1.3MB
                  • SHA256 ba29a36738017b5ee734287773d9e9540063defd7f80ca03fbfa211c328a74ad
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libcrypto-3.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI56882\libcrypto-3.dll
                  • Size 5.0MB
                  • SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libffi-8.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI56882\libffi-8.dll
                  • Size 38KB
                  • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libssl-3.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI56882\libssl-3.dll
                  • Size 776KB
                  • SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  python314.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI56882\python314.dll
                  • Size 6.4MB
                  • SHA256 7ffe3ab11342db03cc18b026f27485c0f74f5bf10f239f1f6573394900596394
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Lorem ipsum.txt
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI56882\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
                  • Size 1KB
                  • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  unicodedata.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI56882\unicodedata.pyd
                  • Size 740KB
                  • SHA256 64844c24f67e7eafb77142b4cbe4a430f4db3b16f59191586ba6596ca19fc775
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  explorer.exe
                  • Path C:\Windows\Resources\Themes\explorer.exe
                  • Size 135KB
                  • SHA256 d2a4c39a30936343cf9136fad263db394835070a43f7f14586ec52083ef9d2b4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  icsys.icn.exe
                  • Path C:\Windows\Resources\Themes\icsys.icn.exe
                  • Size 135KB
                  • SHA256 9fdba09f12d177d042a83f73fa01ff0608a37f079934e59422e741918e3374d5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  spoolsv.exe
                  • Path C:\Windows\Resources\spoolsv.exe
                  • Size 135KB
                  • SHA256 3709ccf2e0e55c8f887d3f8e059d73b690c1250d670ef039fbab325fa7b77ddf
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  svchost.exe
                  • Path \??\c:\windows\resources\svchost.exe
                  • Size 135KB
                  • SHA256 a94b0e53b59152ecef892f4b27804a59b2105f04f66e5e4b925c52ca695439eb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/3212-117-0x0000000000400000-0x000000000041F000-memory.dmp
                  Download

                  memory/3408-111-0x0000000000400000-0x000000000041F000-memory.dmp
                  Download

                  memory/4196-113-0x0000000000400000-0x000000000041F000-memory.dmp
                  Download

                  memory/4292-112-0x0000000000400000-0x000000000041F000-memory.dmp
                  Download

                  memory/4760-118-0x0000000000400000-0x000000000041F000-memory.dmp
                  Download

                  memory/4892-114-0x0000000000400000-0x000000000041F000-memory.dmp
                  Download

                  memory/4892-0-0x0000000000400000-0x000000000041F000-memory.dmp
                  Download