0591762d5616fc1f8d0c78ed4c61df47d21669bfd04b6f56260ce168af6aabe3

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/05/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-23_d1c6fa078f2e7c86efbaf245d6622871_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 44.9MB
Sample260523-e1e1nsfw2s
SHA256 0591762d5616fc1f8d0c78ed4c61df47d21669bfd04b6f56260ce168af6aabe3
MD5 d1c6fa078f2e7c86efbaf245d6622871
SHA1 64c0dc3c720ec9aceefd6506dc17fd2bfff403ad
SHA512 57495b36d2731a840853995ceca4b398d7bda26b1e68ad6cc924981853267db89be7c5f8c04729516f58a9ebe781c7508402a6a8156051845ebe51f729085973
SSDEEP 393216:s1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYff:sMguj8Q4Vfv5qFTrYv/Wy6
TLSH
T119A79D0773E501A6E5B3E1388AA74103E773B4635731CBDB329D03542FABAE49A3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

execution persistence

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024459-5.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Executes dropped EXE 1 IoCs

pid	Process
1516	powershell_core.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\powershell_core.exe"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3972	powershell.exe
3288	powershell.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3972	powershell.exe
3972	powershell.exe
3288	powershell.exe
3288	powershell.exe
3288	powershell.exe
3288	powershell.exe
3288	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3972	powershell.exe
Token: SeDebugPrivilege	3288	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 3972	1264	2026-05-23_d1c6fa078f2e7c86efbaf245d6622871_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	86
PID 1264 wrote to memory of 1348	1264	2026-05-23_d1c6fa078f2e7c86efbaf245d6622871_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	87
PID 1264 wrote to memory of 1516	1264	2026-05-23_d1c6fa078f2e7c86efbaf245d6622871_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	90
PID 1348 wrote to memory of 1540	1348	cmd.exe	91
PID 1516 wrote to memory of 3288	1516	powershell_core.exe	92
PID 3288 wrote to memory of 3868	3288	powershell.exe	96
PID 3868 wrote to memory of 2088	3868	csc.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-05-23_d1c6fa078f2e7c86efbaf245d6622871_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-23_d1c6fa078f2e7c86efbaf245d6622871_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command " $member = '[DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);'; $type = Add-Type -MemberDefinition $member -Name \"Win32ShowWindow\" -Namespace Win32 -PassThru; $hwnd = (Get-Process -Id 1264).MainWindowHandle; if ($hwnd -ne [IntPtr]::Zero) { $type::ShowWindow($hwnd, 0); } "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\powershell_core.exe" /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\powershell_core.exe" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    PID:1540
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\powershell_core.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\powershell_core.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command " $member = '[DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);'; $type = Add-Type -MemberDefinition $member -Name \"Win32ShowWindow\" -Namespace Win32 -PassThru; $hwnd = (Get-Process -Id 1516).MainWindowHandle; if ($hwnd -ne [IntPtr]::Zero) { $type::ShowWindow($hwnd, 0); } "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3288
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tcxcjc1p\tcxcjc1p.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3868
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES84FA.tmp" "c:\Users\Admin\AppData\Local\Temp\tcxcjc1p\CSC555745C794E48F9B7AAC3FB1442374.TMP"
        5⤵
        
        PID:2088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Privilege Escalation

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.system

Path C:\Users\Admin\.system
Size 14B
SHA256 24f109e6a66a5de19faaaf0b708ad52c05cf94df802001828e511ef5d65aa73d
MD5 d0f67bc961d6f0940d315ad102f4694b
SHA1 8357f4586b0ecd77a0e1d8ecca648ac6a84deb83
SHA512 21891f4dd060674a938ca1c473b52331350065e9e034d831ba531400ba5babfcf706453397c6811f24bc65b78dc9f0fdc229f1dfdbc1ac0dc1bbadd8ea2bf8c6
MD5 SHA1 SHA512

Submit Download

RES84FA.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES84FA.tmp
Size 1KB
SHA256 881a0f4cb2d2b36d98d903d84e8a3de68741e25429e374e33400f5bb588c17ca
MD5 59bde26d01a22f927d4626558fc3dfa5
SHA1 30b906ee33dd0c50b48a24ea8dca8da77271ab22
SHA512 09948782bba974581f308f6a4df09899ea760045df57b5ba2e0a5ff876741a43f7dc928cea3c38a117be32b64093e8819f74d2b49fa0e806143abaf66c55a400
TLSH
T187218C0583E94B5EF0B7473169F7131BA628FD64EFA2975B8540422C2C91904EEE1EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_wjibzq1y.wxo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wjibzq1y.wxo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tcxcjc1p.dll

Path C:\Users\Admin\AppData\Local\Temp\tcxcjc1p\tcxcjc1p.dll
Size 3KB
SHA256 cab1878d8c5c25c0bd89207696e0cd49e91dc1879eca7729750059c7ac7d6711
MD5 51b037f4ddeb87ac8743242d16f2da6d
SHA1 6ce07058fb92c7b7d07f5d0382efd26b4167ee22
SHA512 f10eea2e316d6f3dea75dddc00d9f496dbcfb910f9384e22b99d16f709b2391bd825652cf0076c304344541c597426c7dcc951c6ba304ba5f9e80e9c7a46ee49
TLSH
T15C51AF1767E8466BE0770734AEF3436627B8F8549BB3532D5A904328AC11A145D71FB1
MD5 SHA1 SHA512 TLSH

Submit Download

powershell_core.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\powershell_core.exe
Size 44.9MB
SHA256 0591762d5616fc1f8d0c78ed4c61df47d21669bfd04b6f56260ce168af6aabe3
MD5 d1c6fa078f2e7c86efbaf245d6622871
SHA1 64c0dc3c720ec9aceefd6506dc17fd2bfff403ad
SHA512 57495b36d2731a840853995ceca4b398d7bda26b1e68ad6cc924981853267db89be7c5f8c04729516f58a9ebe781c7508402a6a8156051845ebe51f729085973
SSDEEP 393216:s1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYff:sMguj8Q4Vfv5qFTrYv/Wy6
TLSH
T119A79D0773E501A6E5B3E1388AA74103E773B4635731CBDB329D03542FABAE49A3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC555745C794E48F9B7AAC3FB1442374.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\tcxcjc1p\CSC555745C794E48F9B7AAC3FB1442374.TMP
Size 652B
SHA256 344b6cecc11936eefb554474217e10f322427840e784a3f69e1ed441e676f531
MD5 f3d854c5e6011a747aaab40ce75bcdd1
SHA1 c99af0664eb29b0a94666ea64de13decd090cf1e
SHA512 fbff190a153da8e2405f12836919ee3859c7f5a35ea49f36d9ba16b8dc003be0a0fd7b5d843b97ef20c0bb83f929b614abde3196cc21f0e367990e0b967df137
TLSH
T187F05E0963F8120EF0F34B30BDF6436399A8BC64DE3293ED2544031D2864A148DB2FB2
MD5 SHA1 SHA512 TLSH

Submit Download

tcxcjc1p.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\tcxcjc1p\tcxcjc1p.0.cs
Size 218B
SHA256 531c21f32b41b8651df1f844f1a6485b19926699ff33c80de4fc70a44882394c
MD5 841704ba97da956e81f807e77177b947
SHA1 ba3a59add0183f3de2845a7a99713020124567b6
SHA512 a15176ad1aa3900b90094f8a4f8e15c30947547c323fe9f2c7ef3b33eccfcbb9ca79e2b92b8f936f39b8dc365402dfbb9afcdff659212f14e9a2ffb83e56d0d2
TLSH
T11FD0A71875F359E100134C224C46F1FD76234136259E1609A6A50310EF8B00D4131E59
MD5 SHA1 SHA512 TLSH

Submit Download

tcxcjc1p.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\tcxcjc1p\tcxcjc1p.cmdline
Size 369B
SHA256 fe1ee8147ebc03454db2b238fae01957bf2b07f9c6d4a79f3a9d1ed9ed99a913
MD5 71c53e65e7906be798742a0d0bc9b641
SHA1 e080277c1b022f8e4fd5f7c6fa04fed3fbf7107e
SHA512 df0f2b2c63ebe548923b5e5353ea1cd6fb808fd372665b4b79724b099cf39d7aa92c217fa5a4572a128ea15b3b1f0952759ccdf33ba4a5eeb5885d456fcdbe59
TLSH
T1F0E0C62AC296CAFD85ED100B2A7BC4ADC2B207D339803F84B0808C0DF0270012FF2782
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3288-37-0x000001F598B80000-0x000001F598B88000-memory.dmp

Download

memory/3972-10-0x000002676F550000-0x000002676F572000-memory.dmp

Download