Overview

overview

10

Static

static

3

2026-08-25...yn.exe

windows10-2004-x64

10

2026-08-25...yn.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    26/08/2026, 23:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-25_62b6f9d1f275c8677324d7b0c212b5eb_elex_icedid_njrat_stealc_swisyn.exe
  • Size 3.8MB
  • Sample260826-3f4ejacj71
  • SHA256 222d42eeea63a4214b13c981c6d1a12332e3646eb96b46153f1ba59583628a3a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 24 IoCs
  • Modifies system executable filetype association 2 TTPs 4 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 60 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 14 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-25_62b6f9d1f275c8677324d7b0c212b5eb_elex_icedid_njrat_stealc_swisyn.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-25_62b6f9d1f275c8677324d7b0c212b5eb_elex_icedid_njrat_stealc_swisyn.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5108
    • \??\c:\users\admin\appdata\local\temp\2026-08-25_62b6f9d1f275c8677324d7b0c212b5eb_elex_icedid_njrat_stealc_swisyn.exe 
      c:\users\admin\appdata\local\temp\2026-08-25_62b6f9d1f275c8677324d7b0c212b5eb_elex_icedid_njrat_stealc_swisyn.exe 
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1388
      • C:\Program Files\WinRAR\uninstall.exe
        "C:\Program Files\WinRAR\uninstall.exe" /setup
        3⤵
        • Executes dropped EXE
        • Modifies system executable filetype association
        • Drops file in Program Files directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2524
        • C:\Program Files\WinRAR\RarExtInstaller.exe
          "C:\Program Files\WinRAR\RarExtInstaller.exe" -install
          4⤵
          • Executes dropped EXE
          PID:2412
    • C:\Windows\Resources\Themes\icsys.icn.exe
      C:\Windows\Resources\Themes\icsys.icn.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3712
      • \??\c:\windows\resources\themes\explorer.exe
        c:\windows\resources\themes\explorer.exe
        3⤵
        • Modifies visibility of hidden/system files in Explorer
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4464
        • \??\c:\windows\resources\spoolsv.exe
          c:\windows\resources\spoolsv.exe SE
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2380
          • \??\c:\windows\resources\svchost.exe
            c:\windows\resources\svchost.exe
            5⤵
            • Modifies visibility of hidden/system files in Explorer
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:5824
            • \??\c:\windows\resources\spoolsv.exe
              c:\windows\resources\spoolsv.exe PR
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:1796
  • C:\Program Files\WinRAR\RarExtInstaller.exe
    "C:\Program Files\WinRAR\RarExtInstaller.exe" /install /local
    1⤵
    • Executes dropped EXE
    PID:3360
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
    1⤵
      PID:6012
    • C:\Program Files\WinRAR\WinRAR.exe
      "C:\Program Files\WinRAR\WinRAR.exe"
      1⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of WriteProcessMemory
      PID:4572
      • C:\Program Files\WinRAR\RarExtInstaller.exe
        "C:\Program Files\WinRAR\RarExtInstaller.exe" -install
        2⤵
        • Executes dropped EXE
        PID:860
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
      1⤵
        PID:4180
      • C:\Program Files\WinRAR\WinRAR.exe
        "C:\Program Files\WinRAR\WinRAR.exe"
        1⤵
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        PID:4540
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
        1⤵
          PID:4516
        • C:\Program Files\WinRAR\WinRAR.exe
          "C:\Program Files\WinRAR\WinRAR.exe"
          1⤵
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious behavior: GetForegroundWindowSpam
          PID:840
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
          1⤵
            PID:3484
          • C:\Program Files\WinRAR\WinRAR.exe
            "C:\Program Files\WinRAR\WinRAR.exe"
            1⤵
            • Executes dropped EXE
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            PID:5412
          • C:\Windows\system32\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
            1⤵
              PID:5440
            • C:\Program Files\WinRAR\WinRAR.exe
              "C:\Program Files\WinRAR\WinRAR.exe"
              1⤵
              • Executes dropped EXE
              • Modifies registry class
              PID:3700
            • C:\Windows\system32\NOTEPAD.EXE
              "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
              1⤵
                PID:4484
              • C:\Program Files\WinRAR\WinRAR.exe
                "C:\Program Files\WinRAR\WinRAR.exe"
                1⤵
                • Executes dropped EXE
                • Modifies registry class
                • Suspicious behavior: GetForegroundWindowSpam
                PID:2008
              • C:\Windows\system32\NOTEPAD.EXE
                "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                1⤵
                  PID:608
                • C:\Program Files\WinRAR\WinRAR.exe
                  "C:\Program Files\WinRAR\WinRAR.exe"
                  1⤵
                  • Executes dropped EXE
                  • Modifies registry class
                  • Suspicious behavior: GetForegroundWindowSpam
                  PID:5972
                • C:\Windows\system32\NOTEPAD.EXE
                  "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                  1⤵
                    PID:2160
                  • C:\Program Files\WinRAR\WinRAR.exe
                    "C:\Program Files\WinRAR\WinRAR.exe"
                    1⤵
                    • Executes dropped EXE
                    • Modifies registry class
                    • Suspicious behavior: GetForegroundWindowSpam
                    PID:5552
                  • C:\Windows\system32\NOTEPAD.EXE
                    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                    1⤵
                      PID:4568
                    • C:\Program Files\WinRAR\WinRAR.exe
                      "C:\Program Files\WinRAR\WinRAR.exe"
                      1⤵
                      • Executes dropped EXE
                      • Modifies registry class
                      PID:5512
                    • C:\Windows\system32\NOTEPAD.EXE
                      "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                      1⤵
                        PID:1536
                      • C:\Program Files\WinRAR\WinRAR.exe
                        "C:\Program Files\WinRAR\WinRAR.exe"
                        1⤵
                        • Executes dropped EXE
                        • Modifies registry class
                        • Suspicious behavior: GetForegroundWindowSpam
                        PID:5792
                      • C:\Windows\system32\NOTEPAD.EXE
                        "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                        1⤵
                          PID:5376
                        • C:\Program Files\WinRAR\WinRAR.exe
                          "C:\Program Files\WinRAR\WinRAR.exe"
                          1⤵
                          • Executes dropped EXE
                          • Modifies registry class
                          • Suspicious behavior: GetForegroundWindowSpam
                          PID:1436
                        • C:\Windows\system32\NOTEPAD.EXE
                          "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                          1⤵
                            PID:2828
                          • C:\Program Files\WinRAR\WinRAR.exe
                            "C:\Program Files\WinRAR\WinRAR.exe"
                            1⤵
                            • Executes dropped EXE
                            • Modifies registry class
                            • Suspicious behavior: GetForegroundWindowSpam
                            PID:5576
                          • C:\Windows\system32\NOTEPAD.EXE
                            "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                            1⤵
                              PID:1804
                            • C:\Program Files\WinRAR\WinRAR.exe
                              "C:\Program Files\WinRAR\WinRAR.exe"
                              1⤵
                              • Executes dropped EXE
                              • Modifies registry class
                              • Suspicious behavior: GetForegroundWindowSpam
                              PID:5324
                            • C:\Windows\system32\NOTEPAD.EXE
                              "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                              1⤵
                                PID:5836
                              • C:\Program Files\WinRAR\WinRAR.exe
                                "C:\Program Files\WinRAR\WinRAR.exe"
                                1⤵
                                • Executes dropped EXE
                                • Modifies registry class
                                • Suspicious behavior: GetForegroundWindowSpam
                                PID:2576

                              Network

                                    MITRE ATT&CK Enterprise v16

                                    Reconnaissance

                                    Resource Development

                                    Initial Access

                                    Execution

                                    Persistence

                                    Boot or Logon Autostart Execution

                                    1
                                    T1547

                                    Registry Run Keys / Startup Folder

                                    1
                                    T1547.001

                                    Event Triggered Execution

                                    2
                                    T1546

                                    Change Default File Association

                                    1
                                    T1546.001

                                    Component Object Model Hijacking

                                    1
                                    T1546.015

                                    Privilege Escalation

                                    Boot or Logon Autostart Execution

                                    1
                                    T1547

                                    Registry Run Keys / Startup Folder

                                    1
                                    T1547.001

                                    Event Triggered Execution

                                    2
                                    T1546

                                    Change Default File Association

                                    1
                                    T1546.001

                                    Component Object Model Hijacking

                                    1
                                    T1546.015

                                    Defense Evasion

                                    Hide Artifacts

                                    1
                                    T1564

                                    Hidden Files and Directories

                                    1
                                    T1564.001

                                    Modify Registry

                                    3
                                    T1112

                                    Credential Access

                                    Discovery

                                    Query Registry

                                    1
                                    T1012

                                    System Information Discovery

                                    1
                                    T1082

                                    System Location Discovery

                                    1
                                    T1614

                                    System Language Discovery

                                    1
                                    T1614.001

                                    Lateral Movement

                                    Collection

                                    Command and Control

                                    Exfiltration

                                    Impact

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    Rar.exe
                                    • Path C:\Program Files\WinRAR\Rar.exe
                                    • Size 826KB
                                    • SHA256 1639bfccc19b6fdd9becffb154edca06f07d1f337cc61933273f5b30dfb91882
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    Rar.txt
                                    • Path C:\Program Files\WinRAR\Rar.txt
                                    • Size 110KB
                                    • SHA256 626b437acc8c23be798b1f3233f5636e64245941fb931f322cd9e65cb8c56a1f
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    RarExtInstaller.exe
                                    • Path C:\Program Files\WinRAR\RarExtInstaller.exe
                                    • Size 229KB
                                    • SHA256 091f077e4a8ffdca19430e9775b97d3b448e0c8ffdda52fb93b98268d38356f5
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    RarExtPackage.msix
                                    • Path C:\Program Files\WinRAR\RarExtPackage.msix
                                    • Size 23KB
                                    • SHA256 9bd99b011fc9053589e97a4845ba2951d334fa6412190cd0d5f78d6a3e4d3d3d
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    UnRAR.exe
                                    • Path C:\Program Files\WinRAR\UnRAR.exe
                                    • Size 558KB
                                    • SHA256 806b42a2ae54eb8688841500aa70b3a3e4fcbe99059e612086cf9ccdc231b5ea
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    Uninstall.exe
                                    • Path C:\Program Files\WinRAR\Uninstall.exe
                                    • Size 413KB
                                    • SHA256 c893bab6e0159ad6a3baea054f7341dd543ac0ca446671ce07aa93e97b540dc2
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    WhatsNew.txt
                                    • Path C:\Program Files\WinRAR\WhatsNew.txt
                                    • Size 64KB
                                    • SHA256 aadee800c40e3437867f644057dee828e67fcc6da65004b0a981c000a4e0a58d
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    WinRAR.chm
                                    • Path C:\Program Files\WinRAR\WinRAR.chm
                                    • Size 320KB
                                    • SHA256 cb5edb04ac5e879243dae4f1f6d8253b8653dc6c57473bd0b3f3d23fd1861f61
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    WinRAR.exe
                                    • Path C:\Program Files\WinRAR\WinRAR.exe
                                    • Size 3.2MB
                                    • SHA256 ab727aec2418a942a1adf5295efb9c676eeba39d16f7c2443e3f873fe2dfca14
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    8EC9B1D0ABBD7F98B401D425828828CE_D96A4C3B75E862E237A6B89F58F74354
                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_D96A4C3B75E862E237A6B89F58F74354
                                    • Size 727B
                                    • SHA256 bedde560d7a82e40efc77800e50324918d0c19d4ed4cb94e3a89bd4d3b28f6e1
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                    • Size 727B
                                    • SHA256 1f5ee77c64261bf5b920cbdf6cac5d2c23fb36c5e194f4737d0c5909e74152bd
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    8EC9B1D0ABBD7F98B401D425828828CE_D96A4C3B75E862E237A6B89F58F74354
                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_D96A4C3B75E862E237A6B89F58F74354
                                    • Size 404B
                                    • SHA256 27185a38fbed8e2828cd09f0493743fe0c881a00ba42c0d3a9203c2f9676ef00
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                    • Size 412B
                                    • SHA256 6e54b2214d6c0db33bd9396fc888cf048f37dd386e44e1d5f40232b23e63f71c
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    2026-08-25_62b6f9d1f275c8677324d7b0c212b5eb_elex_icedid_njrat_stealc_swisyn.exe 
                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-08-25_62b6f9d1f275c8677324d7b0c212b5eb_elex_icedid_njrat_stealc_swisyn.exe 
                                    • Size 3.7MB
                                    • SHA256 f435b24d4c2c5342c4f7c0143ef358f0f425b7b8a0972dd34d9dcf94789e9c4d
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    version.dat
                                    • Path C:\Users\Admin\AppData\Roaming\WinRAR\version.dat
                                    • Size 12B
                                    • SHA256 f3d84cb5a95b8e2e48fab0c4b45982a61885275be52b571a42f0b70e5536a997
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    explorer.exe
                                    • Path C:\Windows\Resources\Themes\explorer.exe
                                    • Size 135KB
                                    • SHA256 eee84a7f58e90dbcb69cfb67267bd42aa2adedaa0aa5f5c06bfe0347acce7935
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    icsys.icn.exe
                                    • Path C:\Windows\Resources\Themes\icsys.icn.exe
                                    • Size 135KB
                                    • SHA256 566af9ec66eccc62f352947148a702ca056ff5870aa316300687662ba7478b9b
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    spoolsv.exe
                                    • Path C:\Windows\Resources\spoolsv.exe
                                    • Size 135KB
                                    • SHA256 3731419bce991eac19651b3537804b3b496b5e4128f02b25e35c68a61db370d1
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    svchost.exe
                                    • Path C:\Windows\Resources\svchost.exe
                                    • Size 135KB
                                    • SHA256 6244dccf50a7dbb30b4fb51ea032ee3f68d322a1bf8a990699255e69a4a3ebd9
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    memory/1796-49-0x0000000000400000-0x000000000041F000-memory.dmp
                                    Download

                                    memory/2380-50-0x0000000000400000-0x000000000041F000-memory.dmp
                                    Download

                                    memory/3712-52-0x0000000000400000-0x000000000041F000-memory.dmp
                                    Download

                                    memory/4464-169-0x0000000000400000-0x000000000041F000-memory.dmp
                                    Download

                                    memory/5108-0-0x0000000000400000-0x000000000041F000-memory.dmp
                                    Download

                                    memory/5108-51-0x0000000000400000-0x000000000041F000-memory.dmp
                                    Download

                                    memory/5824-172-0x0000000000400000-0x000000000041F000-memory.dmp
                                    Download