Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
30/06/2026, 22:25
General
- Target 2026-06-30_596f8742b7448bef81f5829d07b6049d_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
- Size 36.1MB
- Sample260630-2cb1fahs3j
- SHA256 9152aac3e591d1a2ae65f9d94710b0e111aa3b1517394aac3b486efdfafe4a23
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_596f8742b7448bef81f5829d07b6049d_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-30_596f8742b7448bef81f5829d07b6049d_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -STA -File C:\Users\Admin\AppData\Local\Temp\filesplitter-patcher-Hc26FB\script.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -STA -File C:\Users\Admin\AppData\Local\Temp\filesplitter-patcher-UK6QzI\script.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_mrefqiu5.qtb.ps1
script.ps1
script.ps1
590aee7bdd69b59b.customDestinations-ms
R2NPNK7FADSMHDBWLIDY.temp
memory/2428-19-0x00007FFE50990000-0x00007FFE51334000-memory.dmp
memory/2428-24-0x00007FFE50990000-0x00007FFE51334000-memory.dmp
memory/2428-17-0x00007FFE50990000-0x00007FFE51334000-memory.dmp
memory/2428-18-0x00007FFE50990000-0x00007FFE51334000-memory.dmp
memory/2428-4-0x00007FFE50B1F000-0x00007FFE50B20000-memory.dmp
memory/2428-20-0x00007FFE50990000-0x00007FFE51334000-memory.dmp
memory/2428-21-0x00007FFE50990000-0x00007FFE51334000-memory.dmp
memory/2428-22-0x00007FFE50990000-0x00007FFE51334000-memory.dmp
memory/2428-23-0x00007FFE50990000-0x00007FFE51334000-memory.dmp
memory/2428-16-0x00007FFE50990000-0x00007FFE51334000-memory.dmp
memory/2428-25-0x000001AFE8D60000-0x000001AFE8F22000-memory.dmp
memory/2428-26-0x000001AFE9460000-0x000001AFE9988000-memory.dmp
memory/2428-28-0x00007FFE50990000-0x00007FFE51334000-memory.dmp
memory/2428-14-0x00007FFE50990000-0x00007FFE51334000-memory.dmp
memory/2428-13-0x00007FFE50990000-0x00007FFE51334000-memory.dmp
memory/2428-11-0x00007FFE50990000-0x00007FFE51334000-memory.dmp
memory/2428-10-0x000001AFCC750000-0x000001AFCC772000-memory.dmp