Analysis
- max time kernel
148s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/07/2026, 10:00
Behavioral task
behavioral1
Sample
2026-07-06_f78baf735f0c8e6cecb4cc1401859f7a_coinminer_glassworm_icedid_njrat_ryuk_sliver.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target 2026-07-06_f78baf735f0c8e6cecb4cc1401859f7a_coinminer_glassworm_icedid_njrat_ryuk_sliver.exe
- Size 3.3MB
- Sample260706-l151esht4j
- SHA256 f4facd527ab7bd990ad2bb0830df1bf85240ff272281e29d0c93cbc3bc2606e9
- MD5 f78baf735f0c8e6cecb4cc1401859f7a
- SHA1 d6f7f1061937bdd46545ad97d2d93577f8851b98
- SHA512 c62508a66f70827f57a63366439a8d2b3e02bb569a603db852dd8fdf6c0471db764ded965e753c677ef45bc7e7164dd15236e16de5739b94ecda38a311c943f3
- SSDEEP 49152:VdZEy2B6vflQf6X8uZQoy3vR6QVQy5Z+bm4M/HMFvfGW0/7Z7Ib3jxw5bZ:nHvfGfZvZj1/N/z/owJZ
- TLSH T1BCF58DD2A3A600E8E9B7F23C85568517E7F1B81753709BCF16A44A761F236D12B3E702
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
meshagent
Version
-
2
Botnet
-
HUB
C2
-
http://mc01.spoc-cloud.com:443/agent.ashx
Attributes
-
mesh_id
0xE0B98C75CB4F278C3A9672250130F5019DD93349AD01F9A8125FAE840111CD7E847CA180B6DBF13AF0468211F016E27C
-
server_id
9F422E215E6DF7BB20A48AF4C2985D8E6018C339E12E5720C492B875BB2A0B22CE35E693C63E090BC28D865CFBD65A4C
-
wss
wss://mc01.spoc-cloud.com:443/agent.ashx
Signatures
- Detects MeshAgent payload 1 IoCs
resource yara_rule behavioral2/files/0x000f00000001c55a-1.dat family_meshagent - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Mesh Agent\ImagePath = "\"C:\\Program Files\\Mesh Agent\\MeshAgent.exe\" " 2026-07-06_f78baf735f0c8e6cecb4cc1401859f7a_coinminer_glassworm_icedid_njrat_ryuk_sliver.exe - Executes dropped EXE 1 IoCs
pid Process 4440 MeshAgent.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\dll\ws2_32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\gdi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\advapi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\sechost.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\sechost.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\combase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\bcryptprimitives.pdb MeshAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\apphelp.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\gdi32full.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\advapi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\oleaut32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\DLL\iphlpapi.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\gdiplus.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\exe\MeshService64.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ucrtbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\win32u.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\msvcrt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\shell32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\DLL\dbgcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\bcrypt.pdb MeshAgent.exe File created C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\DFDD02349DB1EC7426E5F42ADD537685C5725A25 MeshAgent.exe File opened for modification C:\Windows\System32\apphelp.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\ucrtbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\win32u.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\gdi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\msvcp_win.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\msvcrt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\bcryptprimitives.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\DLL\kernel32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\crypt32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\user32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ole32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\DLL\iphlpapi.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\shcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\ntdll.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ucrtbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\user32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\shell32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\Kernel.Appcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\user32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\gdi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\msvcp_win.pdb MeshAgent.exe File opened for modification C:\Windows\System32\combase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ntdll.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ws2_32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\advapi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\shell32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ole32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\combase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\comctl32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dbghelp.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\apphelp.pdb MeshAgent.exe File opened for modification C:\Windows\System32\kernel32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\gdi32full.pdb MeshAgent.exe File opened for modification C:\Windows\System32\oleaut32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ntasn1.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ntasn1.pdb MeshAgent.exe File opened for modification C:\Windows\System32\kernelbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ws2_32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\rpcrt4.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\crypt32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\win32u.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\sechost.pdb MeshAgent.exe - Drops file in Program Files directory 6 IoCs
description ioc Process File opened for modification C:\Program Files\Mesh Agent\MeshAgent.db MeshAgent.exe File created C:\Program Files\Mesh Agent\MeshAgent.db MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\MeshAgent.db.tmp MeshAgent.exe File created C:\Program Files\Mesh Agent\MeshAgent.db.tmp MeshAgent.exe File created C:\Program Files\Mesh Agent\MeshAgent.msh MeshAgent.exe File created C:\Program Files\Mesh Agent\MeshAgent.exe 2026-07-06_f78baf735f0c8e6cecb4cc1401859f7a_coinminer_glassworm_icedid_njrat_ryuk_sliver.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry MeshAgent.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278056738127788" MeshAgent.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5524 wrote to memory of 4264 5524 2026-07-06_f78baf735f0c8e6cecb4cc1401859f7a_coinminer_glassworm_icedid_njrat_ryuk_sliver.exe 91 PID 5524 wrote to memory of 1196 5524 2026-07-06_f78baf735f0c8e6cecb4cc1401859f7a_coinminer_glassworm_icedid_njrat_ryuk_sliver.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_f78baf735f0c8e6cecb4cc1401859f7a_coinminer_glassworm_icedid_njrat_ryuk_sliver.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_f78baf735f0c8e6cecb4cc1401859f7a_coinminer_glassworm_icedid_njrat_ryuk_sliver.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_f78baf735f0c8e6cecb4cc1401859f7a_coinminer_glassworm_icedid_njrat_ryuk_sliver.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_f78baf735f0c8e6cecb4cc1401859f7a_coinminer_glassworm_icedid_njrat_ryuk_sliver.exe" -fulluninstall2⤵PID:1196
-
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_f78baf735f0c8e6cecb4cc1401859f7a_coinminer_glassworm_icedid_njrat_ryuk_sliver.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_f78baf735f0c8e6cecb4cc1401859f7a_coinminer_glassworm_icedid_njrat_ryuk_sliver.exe" -fullinstall2⤵
- Sets service image path in registry
- Drops file in Program Files directory
PID:4264
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:4440
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Mesh Agent\MeshAgent.exe
- Size 3.3MB
- SHA256 f4facd527ab7bd990ad2bb0830df1bf85240ff272281e29d0c93cbc3bc2606e9
- MD5 f78baf735f0c8e6cecb4cc1401859f7a
- SHA1 d6f7f1061937bdd46545ad97d2d93577f8851b98
- SHA512 c62508a66f70827f57a63366439a8d2b3e02bb569a603db852dd8fdf6c0471db764ded965e753c677ef45bc7e7164dd15236e16de5739b94ecda38a311c943f3
- SSDEEP 49152:VdZEy2B6vflQf6X8uZQoy3vR6QVQy5Z+bm4M/HMFvfGW0/7Z7Ib3jxw5bZ:nHvfGfZvZj1/N/z/owJZ
- TLSH T1BCF58DD2A3A600E8E9B7F23C85568517E7F1B81753709BCF16A44A761F236D12B3E702
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\FC9A5659D0A3386DCB5BD0C492F08B150BB782BD
- Size 1KB
- SHA256 a045063b99acef5c9387ccc323d17a7a1a1d39ba2a7c6ea6f817dc2622358e8f
- MD5 c9941c321de6d9bdc93b3c594ff1a7f1
- SHA1 a74d6d3356967798cf4ee2a49cf676100eccaa63
- SHA512 5572f9057af3a525ff9e78397eeac98e56abf8f97f95472bf96a4fab6d559cd0b31debb7e4909724277f59f6c23b2954e3ee322f0678b41a44ca8a8cecbddc6f
- TLSH T1AD210D361FFC4C1EFC416F720C786F1551FBE0542A52D56D482801DF4995735955130D
- MD5 SHA1 SHA512 TLSH