d8cdd97c26fde78c889e3fe9ef4e7ed5f53a3a2fb931d47a8ab4351419583564

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/05/2026, 22:29

Target
2026-05-25_228efa81138251f2a7e14f67216f6db4_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 40.9MB
Sample260525-2ef26sbs2w
SHA256 d8cdd97c26fde78c889e3fe9ef4e7ed5f53a3a2fb931d47a8ab4351419583564
MD5 228efa81138251f2a7e14f67216f6db4
SHA1 5c6182500620754eb30628928b777a0c8cd70605
SHA512 9b23dd46bb7917715e3005a2c72fd0df2a0bed22e98c445aeb38de022950a30d4bc0a4129f9f4e7d8e66a56867319d34736b0acac9733bc06c62fb2b83d06fa2
SSDEEP 393216:g1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYf0:gMguj8Q4VfvTqFTrYj
TLSH
T158979C0773E60095E9B7D2388AA74507D773B8678331CADF329D06151FABAD09A7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4248	277bb46d110d6d6b.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4248	277bb46d110d6d6b.exe
4248	277bb46d110d6d6b.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 5104	5088	2026-05-25_228efa81138251f2a7e14f67216f6db4_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	82
PID 5104 wrote to memory of 4248	5104	cmd.exe	83

C:\Users\Admin\AppData\Local\Temp\2026-05-25_228efa81138251f2a7e14f67216f6db4_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-25_228efa81138251f2a7e14f67216f6db4_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\277bb46d110d6d6b.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Users\Admin\AppData\Local\Temp\277bb46d110d6d6b.exe
    C:\Users\Admin\AppData\Local\Temp\277bb46d110d6d6b.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4248

277bb46d110d6d6b.exe

Path C:\Users\Admin\AppData\Local\Temp\277bb46d110d6d6b.exe
Size 3.7MB
SHA256 610b22340583574cd135e3e2021baec472ee56300b5fdce7eb2399135fe6796f
MD5 87fa5457e9e2049aa27c11eb1e23c187
SHA1 249ab5868b6ac95a93d61271be680ba7a76a8ef5
SHA512 441d89272345d7c67e734274ea697b284955efad056c509cce0d947779daf461c5543faa6c6d876569f754218cbedc14cd0cf966c9196251175f5c3c114c9a49
SSDEEP 49152:aS9GMzOpDCzriB17Wzns9ieI4/1ve1Rj/Q:/zQ7Ww94
TLSH
T1B5069339F40606DCC81BC7F69B0DAD42C2F1B44F9391EB9F29E1AF505F6A890292F561
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download