8a9736246940e2b358b3eaa924d5d3b38ec3727bc1427765c5879739c4705854

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_06a171e9f4cb21dfc130c00dc762207a_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 36.0MB
Sample260702-ebyfqabw6t
SHA256 8a9736246940e2b358b3eaa924d5d3b38ec3727bc1427765c5879739c4705854
MD5 06a171e9f4cb21dfc130c00dc762207a
SHA1 d6c841fccb964bba7e51b32b36770230c8025283
SHA512 efcfa396af76a5a2367899c5bd156d49da2e6be9d872f178d3fb9b17510d756bf2582203ff3491f517ec20d2628f562f1bacee0e9440f12866abe632f6aa34f1
SSDEEP 393216:s1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYf+:sMguj8Q4Vfv3qFTrYd
TLSH
T126878B0773E60095E9B7D1388AA65507D773B8638331CBDF329D06152FABAD09A7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4928	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4928	powershell.exe
4928	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4928	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2604	2580	2026-07-02_06a171e9f4cb21dfc130c00dc762207a_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	88
PID 2604 wrote to memory of 4928	2604	cmd.exe	90
PID 4928 wrote to memory of 3400	4928	powershell.exe	91
PID 3400 wrote to memory of 792	3400	csc.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-07-02_06a171e9f4cb21dfc130c00dc762207a_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_06a171e9f4cb21dfc130c00dc762207a_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -Command "Add-Type -Name W -Namespace C -MemberDefinition '[DllImport(\"user32.dll\")]public static extern bool ShowWindow(IntPtr h,int n);[DllImport(\"kernel32.dll\")]public static extern IntPtr GetConsoleWindow();';[C.W]::ShowWindow([C.W]::GetConsoleWindow(),0)""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Add-Type -Name W -Namespace C -MemberDefinition '[DllImport(\"user32.dll\")]public static extern bool ShowWindow(IntPtr h,int n);[DllImport(\"kernel32.dll\")]public static extern IntPtr GetConsoleWindow();';[C.W]::ShowWindow([C.W]::GetConsoleWindow(),0)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4928
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\m2yc0zew\m2yc0zew.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3400
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8C48.tmp" "c:\Users\Admin\AppData\Local\Temp\m2yc0zew\CSCFFD77E87699F42B692201CA274FD636E.TMP"
        5⤵
        
        PID:792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES8C48.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8C48.tmp
Size 1KB
SHA256 06f577a3b74bc891c096799e42d9e99e6de3e3ac87f45474685a25c314c839ee
MD5 51ae065e586be9f8c64ce78fed5c3f28
SHA1 e60db76135e0db5b54d60a43ff28ffdec0f51a7e
SHA512 51e657932389c1101b78a6f3ef897d2d753d30982ab7c6913d599fd39df6bcbc81c727020b4565842787a4a9cff52e2e86354cff13e6ef5fde6c79d9eb15edad
TLSH
T17721CC0543EC470EF0734731A9F5172F9674FD54EFA2939B444002282C52544EEE0B73
MD5 SHA1 SHA512 TLSH

Submit Download

m2yc0zew.dll

Path C:\Users\Admin\AppData\Local\Temp\m2yc0zew\m2yc0zew.dll
Size 3KB
SHA256 603784f4dc4cbfa9d152a6ec408a17dcfba2e845c35d0534ddc9cfd0775bba91
MD5 80e3cf2bdd50cc74edf65039f98cea06
SHA1 bdc1e0c2ff6947956c1e7f0c03119d0e028e59f8
SHA512 4ea6841d3e1919be5545645d5dcae8dc1b4be87c381aeb62844ea01738f4e47247dfe94a31ff50b17b920ceb38f263b886f0934fe60a5d1dbb86d353d319f756
TLSH
T12251DE1A57E84A6BE4B70730ADF3471B37B4FC508BB3635D19800269BC657A45E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCFFD77E87699F42B692201CA274FD636E.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\m2yc0zew\CSCFFD77E87699F42B692201CA274FD636E.TMP
Size 652B
SHA256 1f4a89ffe31249a4b3fb22ee901d4edf1ab143edae953c9965885db4876717a7
MD5 052ff0f25905c2c436aa5499d610515a
SHA1 2dc3e1a160edc4dc40e718e43c14833d61d8963c
SHA512 fd25952a416c1798a2f391ef2f136c889fc7e85e4c26f96bd1400e3d2596b1d92070705d50953608e1462788e7eec7ea62e40d213ee06e99dd100699ff82f182
TLSH
T181F05E0963F8020EF0F35B70BDF6436395A8BC65DE7293ED1490032928649609962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

m2yc0zew.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\m2yc0zew\m2yc0zew.0.cs
Size 262B
SHA256 a785d4c6d003afa9fab71baaca48d10ba54dc2c2626a370b06b47a46b89d5ac6
MD5 18c5bc8727f68cccbd06ce66cebc40bb
SHA1 2c85d3680f260544169460ff44f89a3a0f389c26
SHA512 104fc057bab432fbc13e98907306e8a5208f6edc3853e34b9d947cfe38a52c3c24c24702b7ac9af6ad1c66782ce51081d2986c6e76086b328cb445464009e894
TLSH
T146D05B1476F3DF34005344165E46E1BDB617912726B91B00B6B85311DF8B0065536A59
MD5 SHA1 SHA512 TLSH

Submit Download

m2yc0zew.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\m2yc0zew\m2yc0zew.cmdline
Size 369B
SHA256 a0f9a8c6b9b4ab33a785e67a38f1adb2a97bb4bdb1802f1a5e037181424e874e
MD5 97cdb5db2add0b62995b61fef9473df7
SHA1 9232401b168cfb4079ac050899d3ab70c459d2b1
SHA512 b93887e47c93519373044fbf9d87b4d5da0de82c346a6951a2fcba1367f625c321b4fdbc622047e96d8973f48992ec185351ea64618662411671acc80912d1e6
TLSH
T106E0C02A626FC27D82ED10072BA9C4ECC272079329407FC8A840450FD01F00027F1761
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4928-8-0x00007FFEC52F0000-0x00007FFEC5C94000-memory.dmp

Download

memory/4928-1-0x00007FFEC547F000-0x00007FFEC5480000-memory.dmp

Download

memory/4928-10-0x00007FFEC52F0000-0x00007FFEC5C94000-memory.dmp

Download

memory/4928-11-0x00007FFEC52F0000-0x00007FFEC5C94000-memory.dmp

Download

memory/4928-12-0x00007FFEC52F0000-0x00007FFEC5C94000-memory.dmp

Download

memory/4928-13-0x00007FFEC52F0000-0x00007FFEC5C94000-memory.dmp

Download

memory/4928-14-0x00007FFEC52F0000-0x00007FFEC5C94000-memory.dmp

Download

memory/4928-15-0x00007FFEC52F0000-0x00007FFEC5C94000-memory.dmp

Download

memory/4928-16-0x00007FFEC52F0000-0x00007FFEC5C94000-memory.dmp

Download

memory/4928-9-0x00007FFEC52F0000-0x00007FFEC5C94000-memory.dmp

Download

memory/4928-7-0x00007FFEC52F0000-0x00007FFEC5C94000-memory.dmp

Download

memory/4928-22-0x00007FFEC52F0000-0x00007FFEC5C94000-memory.dmp

Download

memory/4928-6-0x00007FFEC52F0000-0x00007FFEC5C94000-memory.dmp

Download

memory/4928-30-0x0000013C4B660000-0x0000013C4B668000-memory.dmp

Download

memory/4928-32-0x00007FFEC52F0000-0x00007FFEC5C94000-memory.dmp

Download

memory/4928-5-0x0000013C4B630000-0x0000013C4B652000-memory.dmp

Download

memory/4928-4-0x00007FFEC52F0000-0x00007FFEC5C94000-memory.dmp

Download