Overview

overview

10

Static

static

3

2026-08-25...yn.exe

windows10-2004-x64

10

2026-08-25...yn.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    26/08/2026, 23:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-25_62b6f9d1f275c8677324d7b0c212b5eb_elex_icedid_njrat_stealc_swisyn.exe
  • Size 3.8MB
  • Sample260826-3f4ejacj71
  • SHA256 222d42eeea63a4214b13c981c6d1a12332e3646eb96b46153f1ba59583628a3a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 20 IoCs
  • Modifies system executable filetype association 2 TTPs 8 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 60 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 12 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-25_62b6f9d1f275c8677324d7b0c212b5eb_elex_icedid_njrat_stealc_swisyn.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-25_62b6f9d1f275c8677324d7b0c212b5eb_elex_icedid_njrat_stealc_swisyn.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3900
    • \??\c:\users\admin\appdata\local\temp\2026-08-25_62b6f9d1f275c8677324d7b0c212b5eb_elex_icedid_njrat_stealc_swisyn.exe 
      c:\users\admin\appdata\local\temp\2026-08-25_62b6f9d1f275c8677324d7b0c212b5eb_elex_icedid_njrat_stealc_swisyn.exe 
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2224
      • C:\Program Files\WinRAR\uninstall.exe
        "C:\Program Files\WinRAR\uninstall.exe" /setup
        3⤵
        • Executes dropped EXE
        • Modifies system executable filetype association
        • Drops file in Program Files directory
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4584
    • C:\Windows\Resources\Themes\icsys.icn.exe
      C:\Windows\Resources\Themes\icsys.icn.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2320
      • \??\c:\windows\resources\themes\explorer.exe
        c:\windows\resources\themes\explorer.exe
        3⤵
        • Modifies visibility of hidden/system files in Explorer
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3696
        • \??\c:\windows\resources\spoolsv.exe
          c:\windows\resources\spoolsv.exe SE
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:972
          • \??\c:\windows\resources\svchost.exe
            c:\windows\resources\svchost.exe
            5⤵
            • Modifies visibility of hidden/system files in Explorer
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4180
            • \??\c:\windows\resources\spoolsv.exe
              c:\windows\resources\spoolsv.exe PR
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:5056
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
    1⤵
      PID:4916
    • C:\Program Files\WinRAR\WinRAR.exe
      "C:\Program Files\WinRAR\WinRAR.exe"
      1⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      PID:1072
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
      1⤵
        PID:2836
      • C:\Program Files\WinRAR\WinRAR.exe
        "C:\Program Files\WinRAR\WinRAR.exe"
        1⤵
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        PID:3716
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
        1⤵
          PID:1288
        • C:\Program Files\WinRAR\WinRAR.exe
          "C:\Program Files\WinRAR\WinRAR.exe"
          1⤵
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious behavior: GetForegroundWindowSpam
          PID:5100
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
          1⤵
            PID:1236
          • C:\Program Files\WinRAR\WinRAR.exe
            "C:\Program Files\WinRAR\WinRAR.exe"
            1⤵
            • Executes dropped EXE
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            PID:4644
          • C:\Windows\system32\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
            1⤵
              PID:2580
            • C:\Program Files\WinRAR\WinRAR.exe
              "C:\Program Files\WinRAR\WinRAR.exe"
              1⤵
              • Executes dropped EXE
              PID:3608
            • C:\Windows\system32\NOTEPAD.EXE
              "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
              1⤵
                PID:4592
              • C:\Program Files\WinRAR\WinRAR.exe
                "C:\Program Files\WinRAR\WinRAR.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious behavior: GetForegroundWindowSpam
                PID:4148
              • C:\Windows\system32\NOTEPAD.EXE
                "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                1⤵
                  PID:4388
                • C:\Program Files\WinRAR\WinRAR.exe
                  "C:\Program Files\WinRAR\WinRAR.exe"
                  1⤵
                  • Executes dropped EXE
                  • Suspicious behavior: GetForegroundWindowSpam
                  PID:3780
                • C:\Windows\system32\NOTEPAD.EXE
                  "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                  1⤵
                    PID:3876
                  • C:\Program Files\WinRAR\WinRAR.exe
                    "C:\Program Files\WinRAR\WinRAR.exe"
                    1⤵
                    • Executes dropped EXE
                    • Modifies registry class
                    • Suspicious behavior: GetForegroundWindowSpam
                    PID:3624
                  • C:\Windows\system32\NOTEPAD.EXE
                    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                    1⤵
                      PID:4676
                    • C:\Program Files\WinRAR\WinRAR.exe
                      "C:\Program Files\WinRAR\WinRAR.exe"
                      1⤵
                      • Executes dropped EXE
                      PID:432
                    • C:\Windows\system32\NOTEPAD.EXE
                      "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                      1⤵
                        PID:1448
                      • C:\Program Files\WinRAR\WinRAR.exe
                        "C:\Program Files\WinRAR\WinRAR.exe"
                        1⤵
                        • Executes dropped EXE
                        • Suspicious behavior: GetForegroundWindowSpam
                        PID:3940
                      • C:\Windows\system32\NOTEPAD.EXE
                        "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                        1⤵
                          PID:4508
                        • C:\Program Files\WinRAR\WinRAR.exe
                          "C:\Program Files\WinRAR\WinRAR.exe"
                          1⤵
                          • Executes dropped EXE
                          PID:3532
                        • C:\Windows\system32\NOTEPAD.EXE
                          "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                          1⤵
                            PID:3232
                          • C:\Program Files\WinRAR\WinRAR.exe
                            "C:\Program Files\WinRAR\WinRAR.exe"
                            1⤵
                            • Executes dropped EXE
                            • Suspicious behavior: GetForegroundWindowSpam
                            PID:2724
                          • C:\Windows\system32\NOTEPAD.EXE
                            "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                            1⤵
                              PID:4800
                            • C:\Program Files\WinRAR\WinRAR.exe
                              "C:\Program Files\WinRAR\WinRAR.exe"
                              1⤵
                              • Executes dropped EXE
                              • Suspicious behavior: GetForegroundWindowSpam
                              PID:1876

                            Network

                                  MITRE ATT&CK Enterprise v16

                                  Reconnaissance

                                  Resource Development

                                  Initial Access

                                  Execution

                                  Persistence

                                  Boot or Logon Autostart Execution

                                  1
                                  T1547

                                  Registry Run Keys / Startup Folder

                                  1
                                  T1547.001

                                  Event Triggered Execution

                                  2
                                  T1546

                                  Change Default File Association

                                  1
                                  T1546.001

                                  Component Object Model Hijacking

                                  1
                                  T1546.015

                                  Privilege Escalation

                                  Boot or Logon Autostart Execution

                                  1
                                  T1547

                                  Registry Run Keys / Startup Folder

                                  1
                                  T1547.001

                                  Event Triggered Execution

                                  2
                                  T1546

                                  Change Default File Association

                                  1
                                  T1546.001

                                  Component Object Model Hijacking

                                  1
                                  T1546.015

                                  Defense Evasion

                                  Hide Artifacts

                                  1
                                  T1564

                                  Hidden Files and Directories

                                  1
                                  T1564.001

                                  Modify Registry

                                  3
                                  T1112

                                  Credential Access

                                  Discovery

                                  Query Registry

                                  2
                                  T1012

                                  System Information Discovery

                                  2
                                  T1082

                                  System Location Discovery

                                  1
                                  T1614

                                  System Language Discovery

                                  1
                                  T1614.001

                                  Lateral Movement

                                  Collection

                                  Command and Control

                                  Exfiltration

                                  Impact

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  Rar.exe
                                  • Path C:\Program Files\WinRAR\Rar.exe
                                  • Size 826KB
                                  • SHA256 1639bfccc19b6fdd9becffb154edca06f07d1f337cc61933273f5b30dfb91882
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Rar.txt
                                  • Path C:\Program Files\WinRAR\Rar.txt
                                  • Size 110KB
                                  • SHA256 626b437acc8c23be798b1f3233f5636e64245941fb931f322cd9e65cb8c56a1f
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  RarExtInstaller.exe
                                  • Path C:\Program Files\WinRAR\RarExtInstaller.exe
                                  • Size 229KB
                                  • SHA256 091f077e4a8ffdca19430e9775b97d3b448e0c8ffdda52fb93b98268d38356f5
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  UnRAR.exe
                                  • Path C:\Program Files\WinRAR\UnRAR.exe
                                  • Size 558KB
                                  • SHA256 806b42a2ae54eb8688841500aa70b3a3e4fcbe99059e612086cf9ccdc231b5ea
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Uninstall.exe
                                  • Path C:\Program Files\WinRAR\Uninstall.exe
                                  • Size 413KB
                                  • SHA256 c893bab6e0159ad6a3baea054f7341dd543ac0ca446671ce07aa93e97b540dc2
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  WhatsNew.txt
                                  • Path C:\Program Files\WinRAR\WhatsNew.txt
                                  • Size 64KB
                                  • SHA256 aadee800c40e3437867f644057dee828e67fcc6da65004b0a981c000a4e0a58d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  WinRAR.chm
                                  • Path C:\Program Files\WinRAR\WinRAR.chm
                                  • Size 320KB
                                  • SHA256 cb5edb04ac5e879243dae4f1f6d8253b8653dc6c57473bd0b3f3d23fd1861f61
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  WinRAR.exe
                                  • Path C:\Program Files\WinRAR\WinRAR.exe
                                  • Size 3.2MB
                                  • SHA256 ab727aec2418a942a1adf5295efb9c676eeba39d16f7c2443e3f873fe2dfca14
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  2026-08-25_62b6f9d1f275c8677324d7b0c212b5eb_elex_icedid_njrat_stealc_swisyn.exe 
                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-08-25_62b6f9d1f275c8677324d7b0c212b5eb_elex_icedid_njrat_stealc_swisyn.exe 
                                  • Size 3.7MB
                                  • SHA256 f435b24d4c2c5342c4f7c0143ef358f0f425b7b8a0972dd34d9dcf94789e9c4d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  version.dat
                                  • Path C:\Users\Admin\AppData\Roaming\WinRAR\version.dat
                                  • Size 12B
                                  • SHA256 878087df98bb04b7b9d8d501927771be778e5021064f7bd36653ba02ae5ff810
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  explorer.exe
                                  • Path C:\Windows\Resources\Themes\explorer.exe
                                  • Size 135KB
                                  • SHA256 52878bfcfef247b5daeaae91158d610004a77fef96e43938af008fffe4720be9
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  icsys.icn.exe
                                  • Path C:\Windows\Resources\Themes\icsys.icn.exe
                                  • Size 135KB
                                  • SHA256 566af9ec66eccc62f352947148a702ca056ff5870aa316300687662ba7478b9b
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  spoolsv.exe
                                  • Path C:\Windows\Resources\spoolsv.exe
                                  • Size 135KB
                                  • SHA256 516bc45817073d528341c9a198c330d0974521fb1683c88bdf82913bfadfab99
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  svchost.exe
                                  • Path C:\Windows\Resources\svchost.exe
                                  • Size 135KB
                                  • SHA256 6e69a544fc3ab34245274ea6cbdd6154aebc574b9eff002af9d462f905d2deb4
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  memory/972-46-0x0000000000400000-0x000000000041F000-memory.dmp
                                  Download

                                  memory/2320-47-0x0000000000400000-0x000000000041F000-memory.dmp
                                  Download

                                  memory/2320-12-0x0000000000400000-0x000000000041F000-memory.dmp
                                  Download

                                  memory/3696-145-0x0000000000400000-0x000000000041F000-memory.dmp
                                  Download

                                  memory/3900-48-0x0000000000400000-0x000000000041F000-memory.dmp
                                  Download

                                  memory/3900-0-0x0000000000400000-0x000000000041F000-memory.dmp
                                  Download

                                  memory/4180-146-0x0000000000400000-0x000000000041F000-memory.dmp
                                  Download

                                  memory/5056-45-0x0000000000400000-0x000000000041F000-memory.dmp
                                  Download