5c4630caabc153fb548389a997408ceb79df22102f03d2f634a1efc62c927345

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 03:16

Target
2026-07-11_02f2aec4f3875c9b4dacd4e8cf01ad03_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 37.3MB
Sample260711-dsffssaz7p
SHA256 5c4630caabc153fb548389a997408ceb79df22102f03d2f634a1efc62c927345
MD5 02f2aec4f3875c9b4dacd4e8cf01ad03
SHA1 b94e55f504f038cba5b2ed3ac3c58490224a6470
SHA512 da4d96465c5669ce39ebcfe9e22d2890a4557f6ac59e070d383e8b45555e1d4b590af3aafffcde7dc0360cff938a9cfe1041ea31305d399bf82069777ca2609c
SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYff:fMguj8Q4VfvvqFTrYfNq
TLSH
T18C878B0773E60095E9B7D1388AA75507D773B8638331CADF329D06152FABAD09A7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 768	4960	2026-07-11_02f2aec4f3875c9b4dacd4e8cf01ad03_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-11_02f2aec4f3875c9b4dacd4e8cf01ad03_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_02f2aec4f3875c9b4dacd4e8cf01ad03_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Users\Admin\AppData\Local\Temp\2026-07-11_02f2aec4f3875c9b4dacd4e8cf01ad03_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-11_02f2aec4f3875c9b4dacd4e8cf01ad03_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe C:\snapshot\temp\dropper-embedded.js --install
  2⤵
  PID:768

system.log

Path C:\Users\Admin\AppData\Local\Microsoft\Logs\system.log
Size 1KB
SHA256 3a0298954955bb056f29fe816fd799729185750f8671db0bb3b1de012e07becf
MD5 0eda722a4c67d7935174094d49069d2d
SHA1 1c7f0c5c3c7a38ef1c915e2eb4c9f06f1a5a6e3b
SHA512 df69df3f8798451401be339bb82145b86127af2dbe25173065eeaf95c8aa40f759d2109952c8c5103b1343fcd5de206b3e9defad90452a391b306a761f3b816d
TLSH
T18931CCD869BD3CBF900A19EDE9394A6C9DC5F40304229CD476FE95EC1F86F13692C894
MD5 SHA1 SHA512 TLSH

Submit Download

system.log

Path C:\Users\Admin\AppData\Local\Microsoft\Logs\system.log
Size 1KB
SHA256 8b3698ee2806fdbec72fa5b3b16ff6ca0667ff0c20b4e50a76ce6224b1788131
MD5 bdf51c4190870adddaa3e4f69ee303fb
SHA1 37f503eb7a297ccd31114fb17bd62c07065aa56d
SHA512 edd1cd09578f70eae9ee52637f31f082ba930c770a5a4bea59a3000fe415f6cf19dc784a0d45e66f54a41b0991d1c9980f496f9c9ea9daeea0ed364a56895492
TLSH
T1F421ADD859BD7CBF500A19EDE8394E2C9DC5F40704229CD476BE95EC1F46F13692C894
MD5 SHA1 SHA512 TLSH

Submit Download