Overview

overview

10

Static

static

10

2026-07-12...t_.exe

windows10-2004-x64

6

2026-07-12...t_.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    114s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/07/2026, 00:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-12_2d6bc379d7bf76a9afa86a0118b3e17c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
  • Size 48.5MB
  • Sample260713-aev3jsb19w
  • SHA256 0e0e9535df8229b04269a4400a933e7634e9a6f162b1956ad08c303acf1533e7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoverypersistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Modifies registry class 19 IoCs
  • Modifies registry key 1 TTPs 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-12_2d6bc379d7bf76a9afa86a0118b3e17c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-12_2d6bc379d7bf76a9afa86a0118b3e17c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1772
    • C:\Windows\system32\reg.exe
      reg add HKCU\Software\Classes\Test-Ultimate /ve /d "Test Ultimate" /f
      2⤵
      • Modifies registry class
      • Modifies registry key
      PID:1200
    • C:\Windows\system32\reg.exe
      reg add HKCU\Software\Classes\Test-Ultimate /v "URL Protocol" /d "" /f
      2⤵
      • Modifies registry class
      • Modifies registry key
      PID:2132
    • C:\Windows\system32\reg.exe
      reg add HKCU\Software\Classes\Test-Ultimate /v FriendlyTypeName /d "Test Ultimate" /f
      2⤵
      • Modifies registry class
      • Modifies registry key
      PID:4976
    • C:\Windows\system32\reg.exe
      reg add HKCU\Software\Classes\Test-Ultimate\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Temp\2026-07-12_2d6bc379d7bf76a9afa86a0118b3e17c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe\" \"%1\"" /f
      2⤵
      • Modifies registry class
      • Modifies registry key
      PID:2856
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TU_Edge.exe""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1184
      • C:\Windows\system32\reg.exe
        reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TU_Edge.exe"
        3⤵
          PID:4132
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TU_Edge.exe" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\2026-07-12_2d6bc379d7bf76a9afa86a0118b3e17c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe\"" /f"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4948
        • C:\Windows\system32\reg.exe
          reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TU_Edge.exe" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\2026-07-12_2d6bc379d7bf76a9afa86a0118b3e17c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe\"" /f
          3⤵
          • Adds Run key to start application
          PID:4192
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "TU_Edge.exe" /t REG_BINARY /d 020000000000000000000000 /f"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4920
        • C:\Windows\system32\reg.exe
          reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "TU_Edge.exe" /t REG_BINARY /d 020000000000000000000000 /f
          3⤵
            PID:4680
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "TU_Edge.exe" /t REG_BINARY /d 020000000000000000000000 /f"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2748
          • C:\Windows\system32\reg.exe
            reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "TU_Edge.exe" /t REG_BINARY /d 020000000000000000000000 /f
            3⤵
              PID:4180
        • C:\Users\Admin\AppData\Local\Temp\2026-07-12_2d6bc379d7bf76a9afa86a0118b3e17c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
          "C:\Users\Admin\AppData\Local\Temp\2026-07-12_2d6bc379d7bf76a9afa86a0118b3e17c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
          1⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4196
          • C:\Windows\system32\reg.exe
            reg add HKCU\Software\Classes\Test-Ultimate /ve /d "Test Ultimate" /f
            2⤵
            • Modifies registry class
            • Modifies registry key
            PID:4608
          • C:\Windows\system32\reg.exe
            reg add HKCU\Software\Classes\Test-Ultimate /v "URL Protocol" /d "" /f
            2⤵
            • Modifies registry class
            • Modifies registry key
            PID:4396
          • C:\Windows\system32\reg.exe
            reg add HKCU\Software\Classes\Test-Ultimate /v FriendlyTypeName /d "Test Ultimate" /f
            2⤵
            • Modifies registry class
            • Modifies registry key
            PID:1388
          • C:\Windows\system32\reg.exe
            reg add HKCU\Software\Classes\Test-Ultimate\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Temp\2026-07-12_2d6bc379d7bf76a9afa86a0118b3e17c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe\" \"%1\"" /f
            2⤵
            • Modifies registry class
            • Modifies registry key
            PID:4712
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TU_Edge.exe""
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4916
            • C:\Windows\system32\reg.exe
              reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TU_Edge.exe"
              3⤵
                PID:5624
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "TU_Edge.exe" /t REG_BINARY /d 020000000000000000000000 /f"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3764
              • C:\Windows\system32\reg.exe
                reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "TU_Edge.exe" /t REG_BINARY /d 020000000000000000000000 /f
                3⤵
                  PID:5140
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "TU_Edge.exe" /t REG_BINARY /d 020000000000000000000000 /f"
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:6024
                • C:\Windows\system32\reg.exe
                  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "TU_Edge.exe" /t REG_BINARY /d 020000000000000000000000 /f
                  3⤵
                    PID:6000
                • C:\Windows\system32\tasklist.exe
                  tasklist /FI "IMAGENAME eq TU_Edge.exe" /FO CSV /NH
                  2⤵
                  • Enumerates processes with tasklist
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4440

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads