b0bc61d4fe5a61450012969d7f9795ed17b4bf705adfe05756b7d3b72f0648aa

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_f03865e8495540993b8a2725212dad5a_agent-tesla_backswap_darkgate_datper_elex_gcleaner_glassworm_stop.exe
Size 3.6MB
Sample260814-pbnavsseqg
SHA256 b0bc61d4fe5a61450012969d7f9795ed17b4bf705adfe05756b7d3b72f0648aa
MD5 f03865e8495540993b8a2725212dad5a
SHA1 ee9c8d1237f42ef0cdc53db97068f632f4adb6a4
SHA512 77d7eb99bbba67634fb5c0eb959ea26a0fca93de964a3bd4396d0641333332f1d3a78ef2a5ca28ee08c5d271d438d9e765839f88c3a7c6b34fb2f3a64c8a7c88
SSDEEP 49152:Vu/dUpCw4SIjcP0idTfTXE5JJ7g97R1vJj7rQCcfo:Vg4midTSJ01vJjxx
TLSH
T196067D23BAC4543AC0AB163A847BA7589D3F7A612716CD8F57F0185C8E361807E3A75F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\wininit.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\wininit.exe"	icsys.ico.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\wininit.exe"	wininit.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	wininit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

UAC bypass 3 TTPs 18 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	icsys.ico.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-08-14_f03865e8495540993b8a2725212dad5a_agent-tesla_backswap_darkgate_datper_elex_gcleaner_glassworm_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-08-14_f03865e8495540993b8a2725212dad5a_agent-tesla_backswap_darkgate_datper_elex_gcleaner_glassworm_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-08-14_f03865e8495540993b8a2725212dad5a_agent-tesla_backswap_darkgate_datper_elex_gcleaner_glassworm_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	icsys.ico.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	icsys.ico.exe

Executes dropped EXE 9 IoCs

pid	Process
4504	icsys.ico.exe
4436	2026-08-14_f03865e8495540993b8a2725212dad5a_agent-tesla_backswap_darkgate_datper_elex_gcleaner_glassworm_stop.exe
3528	wininit.exe
2896	spoolsv.exe
6124	wininit.exe
3424	spoolsv.exe
4308	svchost.exe
5840	spoolsv.exe
4540	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Wininit = "c:\\windows\\wininit.exe"	icsys.ico.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Svchost = "c:\\windows\\svchost.exe"	icsys.ico.exe

Checks whether UAC is enabled 1 TTPs 12 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svchost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-14_f03865e8495540993b8a2725212dad5a_agent-tesla_backswap_darkgate_datper_elex_gcleaner_glassworm_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-08-14_f03865e8495540993b8a2725212dad5a_agent-tesla_backswap_darkgate_datper_elex_gcleaner_glassworm_stop.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	icsys.ico.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	icsys.ico.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\svchost.exe	svchost.exe
File opened for modification	C:\Windows\Wininit	2026-08-14_f03865e8495540993b8a2725212dad5a_agent-tesla_backswap_darkgate_datper_elex_gcleaner_glassworm_stop.exe
File opened for modification	C:\Windows\Wininit	icsys.ico.exe
File created	\??\c:\windows\wininit.exe	icsys.ico.exe
File opened for modification	\??\c:\windows\wininit.exe	icsys.ico.exe
File opened for modification	\??\c:\windows\wininit.exe	wininit.exe
File created	\??\c:\windows\svchost.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_f03865e8495540993b8a2725212dad5a_agent-tesla_backswap_darkgate_datper_elex_gcleaner_glassworm_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.ico.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wininit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_f03865e8495540993b8a2725212dad5a_agent-tesla_backswap_darkgate_datper_elex_gcleaner_glassworm_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wininit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4504	icsys.ico.exe
4504	icsys.ico.exe
4436	2026-08-14_f03865e8495540993b8a2725212dad5a_agent-tesla_backswap_darkgate_datper_elex_gcleaner_glassworm_stop.exe
4436	2026-08-14_f03865e8495540993b8a2725212dad5a_agent-tesla_backswap_darkgate_datper_elex_gcleaner_glassworm_stop.exe
3528	wininit.exe
3528	wininit.exe
2896	spoolsv.exe
2896	spoolsv.exe
3528	wininit.exe
3528	wininit.exe
3528	wininit.exe
3528	wininit.exe
3528	wininit.exe
3528	wininit.exe
4308	svchost.exe
4308	svchost.exe
4308	svchost.exe
3528	wininit.exe
4308	svchost.exe
3528	wininit.exe
3528	wininit.exe
3528	wininit.exe
4308	svchost.exe
4308	svchost.exe
4308	svchost.exe
3528	wininit.exe
3528	wininit.exe
4308	svchost.exe
4308	svchost.exe
3528	wininit.exe
3528	wininit.exe
4308	svchost.exe
3528	wininit.exe
4308	svchost.exe
3528	wininit.exe
4308	svchost.exe
4308	svchost.exe
3528	wininit.exe
3528	wininit.exe
4308	svchost.exe
4308	svchost.exe
3528	wininit.exe
4308	svchost.exe
3528	wininit.exe
3528	wininit.exe
4308	svchost.exe
3528	wininit.exe
4308	svchost.exe
3528	wininit.exe
4308	svchost.exe
3528	wininit.exe
4308	svchost.exe
4308	svchost.exe
3528	wininit.exe
3528	wininit.exe
4308	svchost.exe
4308	svchost.exe
3528	wininit.exe
3528	wininit.exe
4308	svchost.exe
4308	svchost.exe
3528	wininit.exe
3528	wininit.exe
4308	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
4436	2026-08-14_f03865e8495540993b8a2725212dad5a_agent-tesla_backswap_darkgate_datper_elex_gcleaner_glassworm_stop.exe
3528	wininit.exe
4308	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 4504	1444	2026-08-14_f03865e8495540993b8a2725212dad5a_agent-tesla_backswap_darkgate_datper_elex_gcleaner_glassworm_stop.exe	89
PID 1444 wrote to memory of 4436	1444	2026-08-14_f03865e8495540993b8a2725212dad5a_agent-tesla_backswap_darkgate_datper_elex_gcleaner_glassworm_stop.exe	90
PID 4504 wrote to memory of 3528	4504	icsys.ico.exe	91
PID 3528 wrote to memory of 2896	3528	wininit.exe	95
PID 3528 wrote to memory of 3424	3528	wininit.exe	97
PID 2896 wrote to memory of 4308	2896	spoolsv.exe	98
PID 3528 wrote to memory of 5840	3528	wininit.exe	99
PID 5840 wrote to memory of 4540	5840	spoolsv.exe	100

System policy modification 1 TTPs 18 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	icsys.ico.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	icsys.ico.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-08-14_f03865e8495540993b8a2725212dad5a_agent-tesla_backswap_darkgate_datper_elex_gcleaner_glassworm_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-08-14_f03865e8495540993b8a2725212dad5a_agent-tesla_backswap_darkgate_datper_elex_gcleaner_glassworm_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-08-14_f03865e8495540993b8a2725212dad5a_agent-tesla_backswap_darkgate_datper_elex_gcleaner_glassworm_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	icsys.ico.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-14_f03865e8495540993b8a2725212dad5a_agent-tesla_backswap_darkgate_datper_elex_gcleaner_glassworm_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_f03865e8495540993b8a2725212dad5a_agent-tesla_backswap_darkgate_datper_elex_gcleaner_glassworm_stop.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1444
- C:\Users\Admin\AppData\Roaming\icsys.ico.exe
  C:\Users\Admin\AppData\Roaming\icsys.ico.exe
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4504
- - C:\windows\wininit.exe
    "C:\windows\wininit.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visibility of hidden/system files in Explorer
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:3528
  - - C:\Users\Admin\appdata\roaming\spoolsv.exe
      "C:\Users\Admin\appdata\roaming\spoolsv.exe" /SE
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2896
    - - C:\windows\svchost.exe
        
        "C:\windows\svchost.exe"
        5⤵
        Modifies WinLogon for persistence
        Modifies visibility of hidden/system files in Explorer
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        System policy modification
        
        PID:4308
  - - C:\Users\Admin\appdata\roaming\spoolsv.exe
      "C:\Users\Admin\appdata\roaming\spoolsv.exe" /SE
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3424
  - - C:\Users\Admin\appdata\roaming\spoolsv.exe
      "C:\Users\Admin\appdata\roaming\spoolsv.exe" /SE
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:5840
    - - C:\windows\svchost.exe
        
        "C:\windows\svchost.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4540
- \??\c:\users\admin\appdata\local\temp\2026-08-14_f03865e8495540993b8a2725212dad5a_agent-tesla_backswap_darkgate_datper_elex_gcleaner_glassworm_stop.exe
  c:\users\admin\appdata\local\temp\2026-08-14_f03865e8495540993b8a2725212dad5a_agent-tesla_backswap_darkgate_datper_elex_gcleaner_glassworm_stop.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4436

\??\c:\windows\wininit.exe
c:\windows\wininit.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-08-14_f03865e8495540993b8a2725212dad5a_agent-tesla_backswap_darkgate_datper_elex_gcleaner_glassworm_stop.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_f03865e8495540993b8a2725212dad5a_agent-tesla_backswap_darkgate_datper_elex_gcleaner_glassworm_stop.exe
Size 751KB
SHA256 7d8f35945c17c54056d4aaca05c14bd45640a8c9d1d38f646ae06a8b9cb0c117
MD5 77ffa8c7af0df18f0285f11b490d726f
SHA1 d2b13b47eeab95a98ba93fa2bd86419029f2c5b1
SHA512 be4d58e08ee73ea021c5d70be533eb2323fe55d0c1e34b186040316ce108e40a5a7165dd469645a2e7779fbb75c82ea0f44710f9ae45e6ef7dae7267ce6a0daf
SSDEEP 12288:YaWzgMg7v3qnCi3ErQohh0F4wCJ8lnyrQELlmo/4jSO9fg4:PaHMv6CzrjInyrQELX/eB9fj
TLSH
T150F4BF12B7C680B6D99379B1197BE327EB3579194323D487A7E03F728E311409B3A3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-14_f03865e8495540993b8a2725212dad5a_agent-tesla_backswap_darkgate_datper_elex_gcleaner_glassworm_stop.exe .ini

Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_f03865e8495540993b8a2725212dad5a_agent-tesla_backswap_darkgate_datper_elex_gcleaner_glassworm_stop.exe .ini
Size 2KB
SHA256 5810de53b25c31506b0ac30d4a6111576e791bbf6080e0ed186afd341fa55d8d
MD5 bf1f00d58a3d0dfa5dd68ef9506d3679
SHA1 0ac984f2a65f0967f24e7b28ba1fa494c8900396
SHA512 3e62472da19544ae81320091193d8f2add0112f15e893108034ebc419a5b87a68f2ddf42190112c7e4babcf14aacdbd393c6b30d918aac0c12416d92a6b8bf43
TLSH
T1365149060AE55115E6F2BB50FE784B320B367D929C7CD94D0EC81D8D1AE2A10D466FFB
MD5 SHA1 SHA512 TLSH

Submit Download

rnrykvds.tmp

Path C:\Users\Admin\AppData\Local\Temp\rnrykvds.tmp
Size 24KB
SHA256 25c2327760cb20441b8523033b5aae914d76efebddb78798b80bea5f6ee97f41
MD5 f571a0f2baa5fbe8fd82c5efe455100b
SHA1 f8b1e1964d6708a8b508d947e5a68ac1d8cb6e22
SHA512 1c4dfec982ee0a1bcea4bc66e0da51e2481b4f8ade453409ef60276b9eac1fa45c789333670497102e67a4d4dabed9c60e472eacf7097be894bf8544718b4dc1
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

icsys.ico.exe

Path C:\Users\Admin\AppData\Roaming\icsys.ico.exe
Size 2.9MB
SHA256 b73c5e4f463cce5ae058ae17b5d7871b2ba86994fb4af2dd5aafea33f903b6e1
MD5 96983f87698c1bb82f7491f873020496
SHA1 001095bddbed4f4b34f462c4d61e50aaafe2d2e7
SHA512 93b67207a5f4faed9cebfc9c8e8089d60ab0c03d24f2db16584d6f69125bfe142ce039e7a041ea869a4db756c14f4dc6cd61e99ce19df5d281a20b6f067defda
SSDEEP 24576:a2Fu/HGcDdQwWH+7aU2E0lFgG9XqcSUXI+SwBeSwtPpoc+yu0cjZxY6jRt5oHkvr:Vu/dUpCw4SIjcP0idTfTXE5JJ7g97h
TLSH
T1D4D55C23BAC4243AC0AB163A8477A7589D3F76613B56CD9F57F0484C8E361807E3A65F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wininit

Path C:\Windows\Wininit
Size 17B
SHA256 764df4d37a31be29b4d87041c66c520cf72260d05b22c92df5f61e1eb67ef728
MD5 dc88c4aa03f5180bbece1abdfec93e70
SHA1 59662d61697f32a522dc6cfeb67202803b311788
SHA512 f3b434bfa1767976744b80abe90c4d9614aecbacca889571ba90e8c848808bed73d37b21eb56afa51234481c36ba74348bb791f43655be4f0ee9bca8df89ae49
MD5 SHA1 SHA512

Submit Download

memory/1444-1-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/1444-0-0x00000000006F0000-0x00000000006F2000-memory.dmp

Download

memory/1444-39-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2896-98-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/3424-96-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/3528-103-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/3528-121-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/3528-131-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/3528-129-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/3528-127-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/3528-125-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/3528-123-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/3528-114-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/3528-105-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/3528-119-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/3528-108-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/3528-117-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/3528-110-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/3528-112-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4308-109-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4308-116-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4308-106-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4308-104-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4504-11-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4504-13-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4504-21-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4540-102-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/5840-101-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/6124-95-0x0000000000400000-0x0000000000768000-memory.dmp

Download