c1b0c7ea3cadec159ca206b6bc1c83aad4162a1d4b33927a5d32be764e0746a8

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_042ad29df668958860bf0044c0796ac0_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 37.1MB
Sample260703-js1dvsdv8z
SHA256 c1b0c7ea3cadec159ca206b6bc1c83aad4162a1d4b33927a5d32be764e0746a8
MD5 042ad29df668958860bf0044c0796ac0
SHA1 19b69ffc91d6fbef658e77e963653f9d3d4bc0c3
SHA512 1053a7e4c1c05be6ce92b144417d01c4498522a6f477234d1ff35987d32042b447ff14eb057d37f3622a32658d89b9aa261ad94dda743e41e88e599cdbeaad70
SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfI:fMguj8Q4VfvzqqTrY+
TLSH
T187877B0773A601D5E5B3D2388AA75503D773B8635331CBDF329D06152FABAE09A7A720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution

Malware Config

Signatures

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
3968	tasklist.exe
4716	tasklist.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3424	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3424	powershell.exe
3424	powershell.exe
2344	WMIC.exe
2344	WMIC.exe
2344	WMIC.exe
2344	WMIC.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	3424	powershell.exe
Token: SeDebugPrivilege	3968	tasklist.exe
Token: SeDebugPrivilege	4716	tasklist.exe
Token: SeIncreaseQuotaPrivilege	2344	WMIC.exe
Token: SeSecurityPrivilege	2344	WMIC.exe
Token: SeTakeOwnershipPrivilege	2344	WMIC.exe
Token: SeLoadDriverPrivilege	2344	WMIC.exe
Token: SeSystemProfilePrivilege	2344	WMIC.exe
Token: SeSystemtimePrivilege	2344	WMIC.exe
Token: SeProfSingleProcessPrivilege	2344	WMIC.exe
Token: SeIncBasePriorityPrivilege	2344	WMIC.exe
Token: SeCreatePagefilePrivilege	2344	WMIC.exe
Token: SeBackupPrivilege	2344	WMIC.exe
Token: SeRestorePrivilege	2344	WMIC.exe
Token: SeShutdownPrivilege	2344	WMIC.exe
Token: SeDebugPrivilege	2344	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2344	WMIC.exe
Token: SeRemoteShutdownPrivilege	2344	WMIC.exe
Token: SeUndockPrivilege	2344	WMIC.exe
Token: SeManageVolumePrivilege	2344	WMIC.exe
Token: 33	2344	WMIC.exe
Token: 34	2344	WMIC.exe
Token: 35	2344	WMIC.exe
Token: 36	2344	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2344	WMIC.exe
Token: SeSecurityPrivilege	2344	WMIC.exe
Token: SeTakeOwnershipPrivilege	2344	WMIC.exe
Token: SeLoadDriverPrivilege	2344	WMIC.exe
Token: SeSystemProfilePrivilege	2344	WMIC.exe
Token: SeSystemtimePrivilege	2344	WMIC.exe
Token: SeProfSingleProcessPrivilege	2344	WMIC.exe
Token: SeIncBasePriorityPrivilege	2344	WMIC.exe
Token: SeCreatePagefilePrivilege	2344	WMIC.exe
Token: SeBackupPrivilege	2344	WMIC.exe
Token: SeRestorePrivilege	2344	WMIC.exe
Token: SeShutdownPrivilege	2344	WMIC.exe
Token: SeDebugPrivilege	2344	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2344	WMIC.exe
Token: SeRemoteShutdownPrivilege	2344	WMIC.exe
Token: SeUndockPrivilege	2344	WMIC.exe
Token: SeManageVolumePrivilege	2344	WMIC.exe
Token: 33	2344	WMIC.exe
Token: 34	2344	WMIC.exe
Token: 35	2344	WMIC.exe
Token: 36	2344	WMIC.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 3876	2568	2026-07-03_042ad29df668958860bf0044c0796ac0_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	89
PID 3876 wrote to memory of 3424	3876	cmd.exe	90
PID 3424 wrote to memory of 2352	3424	powershell.exe	91
PID 2352 wrote to memory of 1748	2352	csc.exe	92
PID 2568 wrote to memory of 4664	2568	2026-07-03_042ad29df668958860bf0044c0796ac0_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	93
PID 4664 wrote to memory of 3968	4664	cmd.exe	94
PID 2568 wrote to memory of 1804	2568	2026-07-03_042ad29df668958860bf0044c0796ac0_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	96
PID 1804 wrote to memory of 4716	1804	cmd.exe	97
PID 2568 wrote to memory of 2012	2568	2026-07-03_042ad29df668958860bf0044c0796ac0_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	98
PID 2012 wrote to memory of 2344	2012	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-07-03_042ad29df668958860bf0044c0796ac0_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_042ad29df668958860bf0044c0796ac0_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-Type -Name W -Namespace W -MemberDefinition '[DllImport(\"kernel32.dll\")]public static extern IntPtr GetConsoleWindow();[DllImport(\"user32.dll\")]public static extern bool ShowWindow(IntPtr h, int n);';[W.W]::ShowWindow([W.W]::GetConsoleWindow(),0)""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-Type -Name W -Namespace W -MemberDefinition '[DllImport(\"kernel32.dll\")]public static extern IntPtr GetConsoleWindow();[DllImport(\"user32.dll\")]public static extern bool ShowWindow(IntPtr h, int n);';[W.W]::ShowWindow([W.W]::GetConsoleWindow(),0)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3424
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nxlzzobc\nxlzzobc.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2352
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4B38.tmp" "c:\Users\Admin\AppData\Local\Temp\nxlzzobc\CSCAA2442153F3A4B4482C6A0A7B14C4FC.TMP"
        5⤵
        
        PID:1748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path Win32_VideoController get CurrentHorizontalResolution,CurrentVerticalResolution 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path Win32_VideoController get CurrentHorizontalResolution,CurrentVerticalResolution
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES4B38.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4B38.tmp
Size 1KB
SHA256 d3737a9836c54e2cfdf7db9c34a9d294634d5802cc7a475dbfa58b9c103eb150
MD5 b3a92895e283678b332eb4faec493040
SHA1 8e667d760502dc7bf568316900f14d2e38ad9672
SHA512 68e1c3c9fab75c5f0d248c54c1d4f140c04fffb0bc58ca42cd7300368d05129c0a57cedc665e73a4049c5d34d3ae792f6c6de3050663eb5fdf1a364491e6b0b5
TLSH
T14821CC0553E84B1FF073473279FA176F9238FD54EFA2A75A844042282C41504EEA0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

nxlzzobc.dll

Path C:\Users\Admin\AppData\Local\Temp\nxlzzobc\nxlzzobc.dll
Size 3KB
SHA256 4d8af800872d053d5b0418879318a7e91d342214401cd22acf34e7fa8d800677
MD5 e7343eef8b8fb8599b2edc1b20339f29
SHA1 0eda1fd854324a8f37144712d8e9a2c985c65907
SHA512 b2d3ebefad39a8b61d0376432258f5074c90281b0a6bd56afd33c54f4dddd79b46d9ee19027d5d819c6826ceb4c7ec1f1ba19183233c065650418b4da648182a
TLSH
T1A651CA1A57E8562BE4770731AEE3072777B8FC109F73635E59804229ACA17644E31FB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCAA2442153F3A4B4482C6A0A7B14C4FC.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\nxlzzobc\CSCAA2442153F3A4B4482C6A0A7B14C4FC.TMP
Size 652B
SHA256 dd6b7e7b55e93e2b8504da31bed308011838b52b5ba1fef3d2b965f516308887
MD5 4417b47135ad08e443c53174e309232d
SHA1 61cf4f61a9edd495851d5cdecbe5ab51ab92b81d
SHA512 d96161249f6536d6715036100be013ca8906aa6a7872a2f1b4328076b16d283f3ed6ed7366b90f019cc09e9e04464c924c931cc73ab3f2d912302cd8d621aa75
TLSH
T107F05E0967F8121EF0F34B31BDF643A395A8BC65DE73A3ED1440431928649108A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

nxlzzobc.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\nxlzzobc\nxlzzobc.0.cs
Size 263B
SHA256 daf084d2f0b3866557857adac013dff487bbd5e793c587b59eb6d51ae80db567
MD5 1364b240cef587bf13ce4da1c50a21ed
SHA1 2b36f696096a4f89dcbeba76338b9641da8d2023
SHA512 94d244b2388a0cfc3616f0f53559dedff54a0eb4a56ecb46d9658f235d7ab7a215dedc835e55e8992e4c2ab8e2420f5a7fd580d282929c541ad36d028f790087
TLSH
T171D02B0876F3DE340013482A4D46E0BCB617902622791B007AA85310DF8B0064536A19
MD5 SHA1 SHA512 TLSH

Submit Download

nxlzzobc.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\nxlzzobc\nxlzzobc.cmdline
Size 369B
SHA256 8f03b4ad75746da553ef910538c8d2cd0d00e4e89e8326ae14c34168546c3afd
MD5 6a9228c5bfcfd615203f7d0e99b1f5d9
SHA1 35bea9eab5eee02039e4b8cadb54ebc0481a056a
SHA512 e8861dcbb1dbfe5a51c29a5b78899adf558e419e606bb30371c2cfbc25f3c10ecbba0644957e0696e50f032524dc04d88eb7c047db4135ae8c8d21e237f76633
TLSH
T1E8E0C63A8387C27DD1FD100B22AAC4BCC276078369D03F849240840DF0A700C2BD3785
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3424-7-0x00007FFA57780000-0x00007FFA58124000-memory.dmp

Download

memory/3424-6-0x00007FFA57780000-0x00007FFA58124000-memory.dmp

Download

memory/3424-10-0x00007FFA57780000-0x00007FFA58124000-memory.dmp

Download

memory/3424-12-0x00007FFA57780000-0x00007FFA58124000-memory.dmp

Download

memory/3424-11-0x00007FFA57780000-0x00007FFA58124000-memory.dmp

Download

memory/3424-8-0x00007FFA57780000-0x00007FFA58124000-memory.dmp

Download

memory/3424-1-0x00007FFA5790F000-0x00007FFA57910000-memory.dmp

Download

memory/3424-9-0x00007FFA57780000-0x00007FFA58124000-memory.dmp

Download

memory/3424-5-0x000001BBFA960000-0x000001BBFA982000-memory.dmp

Download

memory/3424-26-0x000001BBFABE0000-0x000001BBFABE8000-memory.dmp

Download

memory/3424-28-0x00007FFA57780000-0x00007FFA58124000-memory.dmp

Download

memory/3424-4-0x00007FFA57780000-0x00007FFA58124000-memory.dmp

Download

memory/3424-22-0x00007FFA57780000-0x00007FFA58124000-memory.dmp

Download

memory/3424-29-0x00007FFA57780000-0x00007FFA58124000-memory.dmp

Download