Overview

overview

9

Static

static

3

2026-07-10...t_.exe

windows10-2004-x64

9

2026-07-10...t_.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    111s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/07/2026, 02:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-10_91b364dc669141be0fed15f6284bed0a_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
  • Size 37.3MB
  • Sample260710-ch3mxac15w
  • SHA256 348af86e224003f9aa44e53da205d25c1238272e94e015b3232a28752d31eff1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
persistence

Malware Config

Signatures

  • Detects executables Discord URL observed in first stage droppers 1 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops file in Windows directory 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-10_91b364dc669141be0fed15f6284bed0a_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-10_91b364dc669141be0fed15f6284bed0a_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1184
    • C:\Users\Admin\AppData\Local\Temp\2026-07-10_91b364dc669141be0fed15f6284bed0a_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-10_91b364dc669141be0fed15f6284bed0a_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe C:\snapshot\temp\dropper-embedded.js --install
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5164
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsUpdate" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Windows\System\svchost.exe\"" /f"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2604
        • C:\Windows\system32\reg.exe
          reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsUpdate" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Windows\System\svchost.exe\"" /f
          4⤵
          • Adds Run key to start application
          PID:3316
      • C:\Users\Admin\AppData\Local\Windows\System\svchost.exe
        C:\Users\Admin\AppData\Local\Windows\System\svchost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5088
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe"
          4⤵
            PID:1528
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
            4⤵
              PID:4680
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe"
              4⤵
                PID:252
        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
          1⤵
            PID:4540
          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
            1⤵
              PID:2584
            • C:\Users\Admin\AppData\Local\Windows\System\svchost.exe
              "C:\Users\Admin\AppData\Local\Windows\System\svchost.exe"
              1⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of WriteProcessMemory
              PID:2576
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe"
                2⤵
                  PID:3636
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                  2⤵
                    PID:5604
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe"
                    2⤵
                      PID:1664
                  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                    1⤵
                      PID:5572
                    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                      1⤵
                        PID:2108

                      Network

                            MITRE ATT&CK Enterprise v16

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            system.log
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Logs\system.log
                            • Size 341B
                            • SHA256 bd34b1417886c7ec67e8606674880485ab9aebe756bf78ecbfbd47e14073543e
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            system.log
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Logs\system.log
                            • Size 1KB
                            • SHA256 f805e9e3f7691752fcd54d02fdb32f461f7e21c3b295686adef10e06681938be
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            system.log
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Logs\system.log
                            • Size 965B
                            • SHA256 4492013f7ebbb07e16f6b574d0e3f327b87ad685cb0639143920a6f94838bd88
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            system.log
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Logs\system.log
                            • Size 1KB
                            • SHA256 e73a9fd59b6e84ed17b03832ec2545adc6c60b53f61f078f7fd212e1c905b82a
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            qwe900.log
                            • Path C:\Users\Admin\AppData\Local\Temp\qwe900.log
                            • Size 671B
                            • SHA256 4a05ab9d3df561c7d4b2c91a1ae1a3a72d5fb2cf4f594d670f984bee23321187
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            qwe900.log
                            • Path C:\Users\Admin\AppData\Local\Temp\qwe900.log
                            • Size 952B
                            • SHA256 457aecc66923b90037987bb1c5873b87a0966ccb450d3f7762d962e594caae33
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            qwe900.log
                            • Path C:\Users\Admin\AppData\Local\Temp\qwe900.log
                            • Size 1KB
                            • SHA256 5954f820b075ceaba7cd7a610ff0d4afeba6d5bd055ec1beacfb51e0c8a848c9
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            qwe900.log
                            • Path C:\Users\Admin\AppData\Local\Temp\qwe900.log
                            • Size 1KB
                            • SHA256 184935d3445a1130dad35a983806b45e4c320c83f243341db53ed2901c714035
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            qwe900.log
                            • Path C:\Users\Admin\AppData\Local\Temp\qwe900.log
                            • Size 2KB
                            • SHA256 e1c39f0d5343e514da62cddddd8d728154b3d5d54eded109e09d2467e5533319
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            qwe900.log
                            • Path C:\Users\Admin\AppData\Local\Temp\qwe900.log
                            • Size 2KB
                            • SHA256 38d7b6eb50e06415b922bc86988c7a37885f14dda25550750d205def1312e6f6
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            qwe900.log
                            • Path C:\Users\Admin\AppData\Local\Temp\qwe900.log
                            • Size 2KB
                            • SHA256 8eb5a8a93f3af0a63f1309f955fa36d62b36a830ec82b5117662b1d36325e2b8
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            qwe900.log
                            • Path C:\Users\Admin\AppData\Local\Temp\qwe900.log
                            • Size 2KB
                            • SHA256 8ff5b226f62914a65ff25804117133e1d7fb07ace2359f05f6905cf54d8de2c8
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            qwe900.log
                            • Path C:\Users\Admin\AppData\Local\Temp\qwe900.log
                            • Size 2KB
                            • SHA256 f4987e0ea33cdf1fa8843843bb8435aba1625ed7b0d717bf8cf250bdc9015792
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            qwe900.log
                            • Path C:\Users\Admin\AppData\Local\Temp\qwe900.log
                            • Size 3KB
                            • SHA256 ea83cbcdc017b5e2d7776d8796c3b6c313ce93bf1abc2494a4989265ba1ae5bb
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            qwe900.log
                            • Path C:\Users\Admin\AppData\Local\Temp\qwe900.log
                            • Size 3KB
                            • SHA256 0409bc60d267baeadbfc86b5ad9545c338a5320ac99dbde322600acc9227670c
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            qwe900.log
                            • Path C:\Users\Admin\AppData\Local\Temp\qwe900.log
                            • Size 3KB
                            • SHA256 9a6b0887a2a32a4aaf3c2def56772c28e2e8250c4b1086418530f597e2db72a1
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            svchost.exe
                            • Path C:\Users\Admin\AppData\Local\Windows\System\svchost.exe
                            • Size 1.7MB
                            • SHA256 c5aa67c0bfa2980e2a3754e5a51394248e9ead4adb56b3303cfb5b906df055b5
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            debug.log
                            • Path C:\Windows\debug.log
                            • Size 132B
                            • SHA256 fb6273b2e45ff7de9da62f77875c16108e7c834314a83f92beae339a47700c9b
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download