688b88e428c259656a48d4246572c1b1e2cdbfa1d83ff8f7c2aa94de79dd7042

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 04:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_f51a78a58f66382aaac7ccd7288a47e6_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 37.2MB
Sample260703-ex92msbt3y
SHA256 688b88e428c259656a48d4246572c1b1e2cdbfa1d83ff8f7c2aa94de79dd7042
MD5 f51a78a58f66382aaac7ccd7288a47e6
SHA1 50344d91dd6c4021c8e2bc76b6a0e63bbec7a956
SHA512 ac69e581d55d11ea53d3ab90ac43d0e2c5b6ce5f742f2cb6a62e1981dd79f2504c9b4a8c2853f6b16cffb171e17c12590f98ac37dd7ee0799d1d80c5c0cfedb7
SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfM:fMguj8Q4VfvTqxTrY3Z
TLSH
T12A877B0773E601D5E5B3D2388AA75503D773B86753318BDF329D06152FABAE09A7A320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution

Malware Config

Signatures

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
1648	tasklist.exe
4500	tasklist.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5080	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5080	powershell.exe
5080	powershell.exe
5704	WMIC.exe
5704	WMIC.exe
5704	WMIC.exe
5704	WMIC.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	5080	powershell.exe
Token: SeDebugPrivilege	1648	tasklist.exe
Token: SeDebugPrivilege	4500	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5704	WMIC.exe
Token: SeSecurityPrivilege	5704	WMIC.exe
Token: SeTakeOwnershipPrivilege	5704	WMIC.exe
Token: SeLoadDriverPrivilege	5704	WMIC.exe
Token: SeSystemProfilePrivilege	5704	WMIC.exe
Token: SeSystemtimePrivilege	5704	WMIC.exe
Token: SeProfSingleProcessPrivilege	5704	WMIC.exe
Token: SeIncBasePriorityPrivilege	5704	WMIC.exe
Token: SeCreatePagefilePrivilege	5704	WMIC.exe
Token: SeBackupPrivilege	5704	WMIC.exe
Token: SeRestorePrivilege	5704	WMIC.exe
Token: SeShutdownPrivilege	5704	WMIC.exe
Token: SeDebugPrivilege	5704	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5704	WMIC.exe
Token: SeRemoteShutdownPrivilege	5704	WMIC.exe
Token: SeUndockPrivilege	5704	WMIC.exe
Token: SeManageVolumePrivilege	5704	WMIC.exe
Token: 33	5704	WMIC.exe
Token: 34	5704	WMIC.exe
Token: 35	5704	WMIC.exe
Token: 36	5704	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5704	WMIC.exe
Token: SeSecurityPrivilege	5704	WMIC.exe
Token: SeTakeOwnershipPrivilege	5704	WMIC.exe
Token: SeLoadDriverPrivilege	5704	WMIC.exe
Token: SeSystemProfilePrivilege	5704	WMIC.exe
Token: SeSystemtimePrivilege	5704	WMIC.exe
Token: SeProfSingleProcessPrivilege	5704	WMIC.exe
Token: SeIncBasePriorityPrivilege	5704	WMIC.exe
Token: SeCreatePagefilePrivilege	5704	WMIC.exe
Token: SeBackupPrivilege	5704	WMIC.exe
Token: SeRestorePrivilege	5704	WMIC.exe
Token: SeShutdownPrivilege	5704	WMIC.exe
Token: SeDebugPrivilege	5704	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5704	WMIC.exe
Token: SeRemoteShutdownPrivilege	5704	WMIC.exe
Token: SeUndockPrivilege	5704	WMIC.exe
Token: SeManageVolumePrivilege	5704	WMIC.exe
Token: 33	5704	WMIC.exe
Token: 34	5704	WMIC.exe
Token: 35	5704	WMIC.exe
Token: 36	5704	WMIC.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5972 wrote to memory of 5584	5972	2026-07-03_f51a78a58f66382aaac7ccd7288a47e6_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	89
PID 5584 wrote to memory of 5080	5584	cmd.exe	90
PID 5080 wrote to memory of 1932	5080	powershell.exe	91
PID 1932 wrote to memory of 556	1932	csc.exe	92
PID 5972 wrote to memory of 2856	5972	2026-07-03_f51a78a58f66382aaac7ccd7288a47e6_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	93
PID 2856 wrote to memory of 1648	2856	cmd.exe	94
PID 5972 wrote to memory of 5732	5972	2026-07-03_f51a78a58f66382aaac7ccd7288a47e6_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	96
PID 5732 wrote to memory of 4500	5732	cmd.exe	97
PID 5972 wrote to memory of 1332	5972	2026-07-03_f51a78a58f66382aaac7ccd7288a47e6_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	98
PID 1332 wrote to memory of 5704	1332	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-07-03_f51a78a58f66382aaac7ccd7288a47e6_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_f51a78a58f66382aaac7ccd7288a47e6_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-Type -Name W -Namespace W -MemberDefinition '[DllImport(\"kernel32.dll\")]public static extern IntPtr GetConsoleWindow();[DllImport(\"user32.dll\")]public static extern bool ShowWindow(IntPtr h, int n);';[W.W]::ShowWindow([W.W]::GetConsoleWindow(),0)""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5584
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-Type -Name W -Namespace W -MemberDefinition '[DllImport(\"kernel32.dll\")]public static extern IntPtr GetConsoleWindow();[DllImport(\"user32.dll\")]public static extern bool ShowWindow(IntPtr h, int n);';[W.W]::ShowWindow([W.W]::GetConsoleWindow(),0)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5080
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\npj3vcl1\npj3vcl1.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1932
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF4FA.tmp" "c:\Users\Admin\AppData\Local\Temp\npj3vcl1\CSC6D5AFC1A74D442C598FDC19455CFB2BF.TMP"
        5⤵
        
        PID:556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5732
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path Win32_VideoController get CurrentHorizontalResolution,CurrentVerticalResolution 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1332
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path Win32_VideoController get CurrentHorizontalResolution,CurrentVerticalResolution
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESF4FA.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESF4FA.tmp
Size 1KB
SHA256 ad97a711e68137959efc4c64fd6dfedc4c64ddc81543b5d88a39959132151580
MD5 35176a75e1e490acadc82f588f7a808a
SHA1 f3ed1a6c1e9f988fa9c2f6c44cb54e7da221153c
SHA512 c8c65955730dc55930fadf7c37857f1bea8c2f1a84ca6ac22fe286a7b4667b7760ba57f9faa91e3f1f5749394e61c2bcdb5d3ad53b3aa3abbd20fd7e9eb79639
TLSH
T1F321570553E8470EF0B757316DFA035FA538FC69AFA1A75A4540521C2C41A58EFE0BB6
MD5 SHA1 SHA512 TLSH

Submit Download

npj3vcl1.dll

Path C:\Users\Admin\AppData\Local\Temp\npj3vcl1\npj3vcl1.dll
Size 3KB
SHA256 68f50f6a54ab4fa38010250cae2d43a4659009b1c7455938bf80be0044029d18
MD5 cd8f7e7d837069dc5e865628e8ad24b1
SHA1 482d0998442df5a4e41f15816c1e49c6938c4a1e
SHA512 ad19662420bb37fa9e1bbfea20d820a3e4cc4a4ca3f83137c0c53ad9eec8649c4eb952ead9f2fbdec318a8daee9392661baa8dd365b310fb4bf23fd2f26591b2
TLSH
T1D951EA0A63E8962BE4670730AEE3032B37B8FC109B73535E1980422DAC617644E32BF1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC6D5AFC1A74D442C598FDC19455CFB2BF.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\npj3vcl1\CSC6D5AFC1A74D442C598FDC19455CFB2BF.TMP
Size 652B
SHA256 15d0d37c6b3861928d190fde35b63f05eb4b957d3f16c4c8ee757cfad9f6f406
MD5 b8b714dad0440a91693ed90d501094b1
SHA1 f18f17e8f34939295a23642c50cfc7b36f8df67e
SHA512 dec91b68240529333513831e22dced7d76a0d9435b3f7926b13b4205d23c6b99476e0067c0c6736d8c165fe34515f0d254cf2726323fe3e79ea221ea60ab4280
TLSH
T143F05E0963F8020EF0F75B30BDF643A795A9BC65DE3293ED2440031D28649148A62FB6
MD5 SHA1 SHA512 TLSH

Submit Download

npj3vcl1.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\npj3vcl1\npj3vcl1.0.cs
Size 263B
SHA256 daf084d2f0b3866557857adac013dff487bbd5e793c587b59eb6d51ae80db567
MD5 1364b240cef587bf13ce4da1c50a21ed
SHA1 2b36f696096a4f89dcbeba76338b9641da8d2023
SHA512 94d244b2388a0cfc3616f0f53559dedff54a0eb4a56ecb46d9658f235d7ab7a215dedc835e55e8992e4c2ab8e2420f5a7fd580d282929c541ad36d028f790087
TLSH
T171D02B0876F3DE340013482A4D46E0BCB617902622791B007AA85310DF8B0064536A19
MD5 SHA1 SHA512 TLSH

Submit Download

npj3vcl1.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\npj3vcl1\npj3vcl1.cmdline
Size 369B
SHA256 fd8fad240cd7c57ba418d9749a7d623d6f6775c3a3535f0c124cf50d10b30061
MD5 f2aa4e4edf64116eba877324d02bea7e
SHA1 c6e81d427492faa32037eb722fd2c9f2d5df30c7
SHA512 a622f1542dd9343a782ba2d95ae9f25e71bb7e7ad4a95e8fc1e9c29ecdddf1dea0f7193ca66fb64123a233c8e3d5caa934253cfd30e3cd8f0276ca986b20eba3
TLSH
T1F7E0C03AA3E7C27D01DD6007276AD4ACC27307436D44BF8450C4840DD42F0002FE1F41
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5080-7-0x00007FFEF5000000-0x00007FFEF59A4000-memory.dmp

Download

memory/5080-9-0x00007FFEF5000000-0x00007FFEF59A4000-memory.dmp

Download

memory/5080-10-0x00007FFEF5000000-0x00007FFEF59A4000-memory.dmp

Download

memory/5080-8-0x00007FFEF5000000-0x00007FFEF59A4000-memory.dmp

Download

memory/5080-1-0x00007FFEF518F000-0x00007FFEF5190000-memory.dmp

Download

memory/5080-6-0x00007FFEF5000000-0x00007FFEF59A4000-memory.dmp

Download

memory/5080-25-0x00007FFEF5000000-0x00007FFEF59A4000-memory.dmp

Download

memory/5080-23-0x000001C85C750000-0x000001C85C758000-memory.dmp

Download

memory/5080-5-0x00007FFEF5000000-0x00007FFEF59A4000-memory.dmp

Download

memory/5080-4-0x000001C85C760000-0x000001C85C782000-memory.dmp

Download

memory/5080-26-0x00007FFEF5000000-0x00007FFEF59A4000-memory.dmp

Download