meshagent | 6a14715f11200fd974c719ee344d07d49fdb3e036cec1e721bacb89edb19aaec

Analysis

max time kernel
149s
max time network
143s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/05/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-19_453f8664f1e8db926c5e2da7ab388b0f_coinminer_glassworm_icedid_njrat_ryuk_sliver.exe
Size 3.3MB
Sample260519-xd2v2adv5k
SHA256 6a14715f11200fd974c719ee344d07d49fdb3e036cec1e721bacb89edb19aaec
MD5 453f8664f1e8db926c5e2da7ab388b0f
SHA1 e6897e61b8f8dbf6d1b2025e7a2974f672077e9c
SHA512 aa834c1a6d483b40f0ac07fd39cf517da031d8e94e3bd2fab7faebbd35567488d7536d77e890aad437c8ad1e5e631b2344064baf17a1c27245f48d11348c040b
SSDEEP 49152:jdZEy2B6vflQf6X8uZQoy3vR6QVQy5Z+bm4M/HMFvfGW0/7Z7Ib3jxw5bs:hHvfGfZvZj1/N/z/owJs
TLSH
T105F58DD2A3A600E8E9B7F23C85568517E7F1B81753709BCF16A44A761F236D12B3E702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor general discovery execution meshagent persistence rat trojan

Malware Config

Extracted

Family

meshagent

Version

Botnet

General

http://meshcentral.pc-support.uk.com:443/agent.ashx

Attributes

mesh_id
0xB0724AD90704F5230F861E7154054FC8E1F9964BAFC493E72479342566E5BE30D22B541D3A0C8C353522D345F1E442C8
server_id
C3AADD3ACAA7DED6272E3EF1BAF3ED864EA8ACB903B81D7D1EF3C8CC141B70B0B3470CE90FA63A65BB195ADFAF0A9765
wss
wss://meshcentral.pc-support.uk.com:443/agent.ashx

Signatures

Family: MeshAgent
MeshAgent is an open source remote access trojan written in C++.
rat trojan backdoor meshagent

Detects MeshAgent payload 1 IoCs

resource	yara_rule
behavioral2/files/0x001a00000002b4a5-1.dat	family_meshagent

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MeshAgent\ImagePath = "\"C:\\Program Files\\MeshAgent\\MeshAgent.exe\" --meshServiceName=\"MeshAgent\""	2026-05-19_453f8664f1e8db926c5e2da7ab388b0f_coinminer_glassworm_icedid_njrat_ryuk_sliver.exe

Executes dropped EXE 3 IoCs

pid	Process
3672	MeshAgent.exe
2500	MeshAgent.exe
2160	MeshAgent.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\win32u.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\exe\MeshService64.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\combase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DLL\kernel32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\rpcrt4.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\shell32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\Kernel.Appcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ncrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\Kernel.Appcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\kernelbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\DLL\dbgcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\kernelbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\rpcrt4.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\iphlpapi.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\DLL\iphlpapi.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\Kernel.Appcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\bcryptprimitives.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\win32u.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\DLL\imm32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ole32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\gdiplus.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\rpcrt4.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ucrtbase.pdb	MeshAgent.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\9B45A841F277F285FF4EFFC82E7675120345E1C9	MeshAgent.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\044B4B21CDF560BEA03E458526561672E069BF11	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ntasn1.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\MeshService64.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\apphelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\win32u.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\bcrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\msvcrt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\kernel32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\kernelbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ucrtbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ncrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ole32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DLL\dbgcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\msvcrt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\combase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DLL\bcrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dbgcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\DLL\kernel32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\win32u.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\sechost.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dbghelp.pdb	MeshAgent.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\MeshAgent\symbols\dll\ncrypt.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\dll\bcryptprimitives.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\exe\MeshService64.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\symbols\dll\shell32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\symbols\dll\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\kernelbase.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\dll\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\symbols\dll\sechost.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\dll\ntasn1.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\dll\ucrtbase.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\dll\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\dll\gdi32full.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\dll\msvcrt.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\symbols\dll\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\dll\shcore.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\MeshAgent.db	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\sechost.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\combase.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\dll\win32u.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\symbols\dll\gdi32full.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\ole32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\dll\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\symbols\dll\gdiplus.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\symbols\dll\ntasn1.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\symbols\exe\MeshService64.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\symbols\dll\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\symbols\dll\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\symbols\dll\ucrtbase.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\user32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\symbols\dll\user32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\dll\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\symbols\DLL\imm32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\symbols\dll\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\symbols\dll\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\symbols\dll\combase.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\bcrypt.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\dll\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\symbols\dll\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\shell32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\DLL\dbgcore.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\symbols\DLL\dbgcore.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\symbols\DLL\bcrypt.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\imm32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\bcryptprimitives.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\symbols\DLL\kernel32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\symbols\dll\kernelbase.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\ucrtbase.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\symbols\dll\msvcrt.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\dll\sechost.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\symbols\dll\ole32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\ntasn1.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\Kernel.Appcore.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\dll\user32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\msvcrt.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\dll\ole32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\DLL\iphlpapi.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\dll\ncrypt.pdb	MeshAgent.exe
File created	C:\Program Files\MeshAgent\MeshAgent.db	MeshAgent.exe
File created	C:\Program Files\MeshAgent\MeshAgent.msh	MeshAgent.exe
File opened for modification	C:\Program Files\MeshAgent\dll\dbghelp.pdb	MeshAgent.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4416	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 48 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134237993806306124"	MeshAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	MeshAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4416	powershell.exe
4416	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4416	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 3760	2720	2026-05-19_453f8664f1e8db926c5e2da7ab388b0f_coinminer_glassworm_icedid_njrat_ryuk_sliver.exe	83
PID 2720 wrote to memory of 4360	2720	2026-05-19_453f8664f1e8db926c5e2da7ab388b0f_coinminer_glassworm_icedid_njrat_ryuk_sliver.exe	84
PID 3672 wrote to memory of 4416	3672	MeshAgent.exe	90
PID 3672 wrote to memory of 2160	3672	MeshAgent.exe	93
PID 3672 wrote to memory of 5044	3672	MeshAgent.exe	96
PID 5044 wrote to memory of 4920	5044	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-05-19_453f8664f1e8db926c5e2da7ab388b0f_coinminer_glassworm_icedid_njrat_ryuk_sliver.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-19_453f8664f1e8db926c5e2da7ab388b0f_coinminer_glassworm_icedid_njrat_ryuk_sliver.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Users\Admin\AppData\Local\Temp\2026-05-19_453f8664f1e8db926c5e2da7ab388b0f_coinminer_glassworm_icedid_njrat_ryuk_sliver.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-05-19_453f8664f1e8db926c5e2da7ab388b0f_coinminer_glassworm_icedid_njrat_ryuk_sliver.exe" -fulluninstall
  2⤵
  PID:3760
- C:\Users\Admin\AppData\Local\Temp\2026-05-19_453f8664f1e8db926c5e2da7ab388b0f_coinminer_glassworm_icedid_njrat_ryuk_sliver.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-05-19_453f8664f1e8db926c5e2da7ab388b0f_coinminer_glassworm_icedid_njrat_ryuk_sliver.exe" -fullinstall
  2⤵
  - Sets service image path in registry
  PID:4360

C:\Program Files\MeshAgent\MeshAgent.exe
"C:\Program Files\MeshAgent\MeshAgent.exe" --meshServiceName="MeshAgent"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4416
- C:\Program Files\MeshAgent\MeshAgent.exe
  MeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2160
- C:\Windows\system32\cmd.exe
  /c manage-bde -protectors -get C: -Type recoverypassword
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\system32\manage-bde.exe
    manage-bde -protectors -get C: -Type recoverypassword
    3⤵
    PID:4920

C:\Program Files\MeshAgent\MeshAgent.exe
"C:\Program Files\MeshAgent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MeshAgent.db.tmp

Path C:\Program Files\MeshAgent\MeshAgent.db.tmp
Size 168KB
SHA256 7c837c4a5e28f048742e6813528ce28116fef9b7bbb16cf55337a810c4bae9ce
MD5 aa5bd137f10ebae5af0afb43a51caa8f
SHA1 9bd0e83adf95378c4d88303309c3bc5bccb70d2c
SHA512 d544e492db6071816455ca99ee9dc3247ce090169837eaf3e41c98769f99762923447a67a3f0fcf8721cfad2e382eedd93e95d1ea44a7f36b87c2685d24bc6c1
SSDEEP 3072:lw9l2DkK1RmYedwMJJnLnR9AIq1kNmPtUh1OlisI88P7sLZJ3bQK/jbZ:e9l2DhmtdvnLD3qwmSqBuGrQIZ
TLSH
T13DF3E11A8F6DB07F3F9A13B56C0B0E317BD80738835258417DEF541981B6B59DAAB0E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MeshAgent.exe

Path C:\Program Files\MeshAgent\MeshAgent.exe
Size 3.3MB
SHA256 6a14715f11200fd974c719ee344d07d49fdb3e036cec1e721bacb89edb19aaec
MD5 453f8664f1e8db926c5e2da7ab388b0f
SHA1 e6897e61b8f8dbf6d1b2025e7a2974f672077e9c
SHA512 aa834c1a6d483b40f0ac07fd39cf517da031d8e94e3bd2fab7faebbd35567488d7536d77e890aad437c8ad1e5e631b2344064baf17a1c27245f48d11348c040b
SSDEEP 49152:jdZEy2B6vflQf6X8uZQoy3vR6QVQy5Z+bm4M/HMFvfGW0/7Z7Ib3jxw5bs:hHvfGfZvZj1/N/z/owJs
TLSH
T105F58DD2A3A600E8E9B7F23C85568517E7F1B81753709BCF16A44A761F236D12B3E702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_zchk1erh.n5j.ps1

Path C:\Windows\Temp\__PSScriptPolicyTest_zchk1erh.n5j.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4416-18-0x000001DACF3F0000-0x000001DACF412000-memory.dmp

Download

memory/4416-25-0x000001DACF820000-0x000001DACF866000-memory.dmp

Download