8a9736246940e2b358b3eaa924d5d3b38ec3727bc1427765c5879739c4705854

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_06a171e9f4cb21dfc130c00dc762207a_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 36.0MB
Sample260702-ebyfqabw6t
SHA256 8a9736246940e2b358b3eaa924d5d3b38ec3727bc1427765c5879739c4705854
MD5 06a171e9f4cb21dfc130c00dc762207a
SHA1 d6c841fccb964bba7e51b32b36770230c8025283
SHA512 efcfa396af76a5a2367899c5bd156d49da2e6be9d872f178d3fb9b17510d756bf2582203ff3491f517ec20d2628f562f1bacee0e9440f12866abe632f6aa34f1
SSDEEP 393216:s1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYf+:sMguj8Q4Vfv3qFTrYd
TLSH
T126878B0773E60095E9B7D1388AA65507D773B8638331CBDF329D06152FABAD09A7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2808	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2808	powershell.exe
2808	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2808	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 696 wrote to memory of 2588	696	2026-07-02_06a171e9f4cb21dfc130c00dc762207a_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	86
PID 2588 wrote to memory of 2808	2588	cmd.exe	88
PID 2808 wrote to memory of 4272	2808	powershell.exe	89
PID 4272 wrote to memory of 468	4272	csc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-02_06a171e9f4cb21dfc130c00dc762207a_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_06a171e9f4cb21dfc130c00dc762207a_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -Command "Add-Type -Name W -Namespace C -MemberDefinition '[DllImport(\"user32.dll\")]public static extern bool ShowWindow(IntPtr h,int n);[DllImport(\"kernel32.dll\")]public static extern IntPtr GetConsoleWindow();';[C.W]::ShowWindow([C.W]::GetConsoleWindow(),0)""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Add-Type -Name W -Namespace C -MemberDefinition '[DllImport(\"user32.dll\")]public static extern bool ShowWindow(IntPtr h,int n);[DllImport(\"kernel32.dll\")]public static extern IntPtr GetConsoleWindow();';[C.W]::ShowWindow([C.W]::GetConsoleWindow(),0)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\r0ilzzcv\r0ilzzcv.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4272
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5C25.tmp" "c:\Users\Admin\AppData\Local\Temp\r0ilzzcv\CSCB02C720D1DBA412D94389C783A752B5.TMP"
        5⤵
        
        PID:468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES5C25.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5C25.tmp
Size 1KB
SHA256 c9a24c252205755b84ce0a1de5644f84e7d95ea3c66c9f48d7ebd7ed02938456
MD5 8a47b48c8df1327ce94ca95577e55b3a
SHA1 21f6ac9747d7fc2287f89f5016c7c79c6874a01f
SHA512 c25accbca81d71e757df9673504f174a05f4256f784b19b5ed5cdc4e83901dcf9e8fc90347a939cd1fa0d95ad76855101097fc669e68726fd279a134f204da5e
TLSH
T1AF21894493E9471AF077173269F6032FA628FD94EFA2539B854042281C51554EEA0AB3
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_asiyyncj.p0j.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_asiyyncj.p0j.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

r0ilzzcv.dll

Path C:\Users\Admin\AppData\Local\Temp\r0ilzzcv\r0ilzzcv.dll
Size 3KB
SHA256 6fb131af4f8015f75915ca1e9cfea1ad8beacf80d5c93407690ee3fe014e4bfd
MD5 34f812f71476245243fda070bff94345
SHA1 94aa0e45bf196a58a29375fda8950d33f704aaa5
SHA512 16baf98d0149a88f0b6282f75675497f762abd1da893147a671de7078597003904a374270373bc99fe687ab37052aa66a8af1e15afb379d505619812c5cae0e0
TLSH
T13C51001A53E8466BE4B70730ADF3471B3BB4F8508FB7535D59800269BC617645E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCB02C720D1DBA412D94389C783A752B5.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\r0ilzzcv\CSCB02C720D1DBA412D94389C783A752B5.TMP
Size 652B
SHA256 9c0bfc156d69b347fbd8906b1fb46c4470c18ac9198fa55b3952794f1e97e44f
MD5 ad9fb11d502fa7bb0948b797a60421aa
SHA1 c23664fc666021b44fe43437e62dd0d4ace5bd4f
SHA512 ced4e7428376e96dfaa21318875fc6c13427a35f14da06d076e467c01f3ef2a3bbd14bd8c6c6908e36ea62b21b7acd67bbafda1e5b3e787400acb305b2a6c3f6
TLSH
T11AF05E0963F8120EF0F35B30BDF643A395A8BC65DE3293ED5450032928649208962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

r0ilzzcv.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\r0ilzzcv\r0ilzzcv.0.cs
Size 262B
SHA256 a785d4c6d003afa9fab71baaca48d10ba54dc2c2626a370b06b47a46b89d5ac6
MD5 18c5bc8727f68cccbd06ce66cebc40bb
SHA1 2c85d3680f260544169460ff44f89a3a0f389c26
SHA512 104fc057bab432fbc13e98907306e8a5208f6edc3853e34b9d947cfe38a52c3c24c24702b7ac9af6ad1c66782ce51081d2986c6e76086b328cb445464009e894
TLSH
T146D05B1476F3DF34005344165E46E1BDB617912726B91B00B6B85311DF8B0065536A59
MD5 SHA1 SHA512 TLSH

Submit Download

r0ilzzcv.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\r0ilzzcv\r0ilzzcv.cmdline
Size 369B
SHA256 0a6a70da7aba6b8da4ed91f7e1a0eab66d3d40e70686e6a8dcf7ec0e570b5131
MD5 0068c69fc25af10a0e518170cf5f5055
SHA1 ba7367fd2bca8dfa35ca45fb2574506012a88da6
SHA512 975e2c21351e0c84cca076e36db543771fb6ca719c123f75a0452cdc7b0c78485359eca925abbdbea55831e6ba6533bacfd1c7c35f1396a7ab14e94967e44ae3
TLSH
T117E06F3A434BC2BD02ED120B32AAC4ACE37226C32A843FC490A0C40DE0670002BDA781
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2808-2-0x0000020C42390000-0x0000020C423A0000-memory.dmp

Download

memory/2808-1-0x0000020C42390000-0x0000020C423A0000-memory.dmp

Download

memory/2808-3-0x0000020C42480000-0x0000020C424A2000-memory.dmp

Download

memory/2808-23-0x0000020C5CBA0000-0x0000020C5CBA8000-memory.dmp

Download