7f75a41477a1b78b5ab055c1d6333660c84be8b60ebdf12d1e1569b992cd92b7

Analysis

max time kernel
151s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 07:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_2a56a0095e3d03d28b0d02a696017106_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 65.3MB
Sample260720-jqv2csax4l
SHA256 7f75a41477a1b78b5ab055c1d6333660c84be8b60ebdf12d1e1569b992cd92b7
MD5 2a56a0095e3d03d28b0d02a696017106
SHA1 eb34f1f8e4841cf0f73ff0ddf577fc45039a367e
SHA512 d0ba28c58059f0bfaaf3425b4bcdccd5d6be3e6133e556d53e71c09eef33c3e5328d6d688f3c9e6ad1fd2f1b379126987488b16d9a016b697efb3a47f9fc974c
SSDEEP 393216:N1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfC:NMguj8Q4VfvkqFTrY8
TLSH
T1E2E79E3722B718ADF4B6D932C1661106CE3A39175339D6CF718C62B52FAB6D44E39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	5804	powershell.exe
5	5696	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
5804	powershell.exe
5696	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.exe	2026-07-20_2a56a0095e3d03d28b0d02a696017106_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe

Executes dropped EXE 3 IoCs

pid	Process
4144	msedge.exe
3000	msedge.exe
824	IntelWorker.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4740	cmd.exe

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	checkip.amazonaws.com
7	api.ipify.org
12	checkip.amazonaws.com
17	api.ipify.org
1	api.ipify.org

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
2268	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2844	cmd.exe
2180	cmd.exe
5528	cmd.exe
3440	cmd.exe
572	cmd.exe
1516	cmd.exe
3292	cmd.exe
1060	cmd.exe
3608	cmd.exe
6060	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
824	IntelWorker.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5748	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1028	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5804	powershell.exe
5804	powershell.exe
5696	powershell.exe
5696	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2268	tasklist.exe
Token: SeDebugPrivilege	5804	powershell.exe
Token: SeDebugPrivilege	5696	powershell.exe
Token: SeDebugPrivilege	5748	taskkill.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3476 wrote to memory of 3440	3476	2026-07-20_2a56a0095e3d03d28b0d02a696017106_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	89
PID 3440 wrote to memory of 572	3440	cmd.exe	91
PID 3476 wrote to memory of 4740	3476	2026-07-20_2a56a0095e3d03d28b0d02a696017106_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	92
PID 4740 wrote to memory of 2360	4740	cmd.exe	94
PID 3476 wrote to memory of 1516	3476	2026-07-20_2a56a0095e3d03d28b0d02a696017106_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	95
PID 1516 wrote to memory of 1028	1516	cmd.exe	97
PID 3476 wrote to memory of 3292	3476	2026-07-20_2a56a0095e3d03d28b0d02a696017106_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	98
PID 3292 wrote to memory of 2936	3292	cmd.exe	101
PID 4144 wrote to memory of 6060	4144	msedge.exe	103
PID 6060 wrote to memory of 2268	6060	cmd.exe	105
PID 6060 wrote to memory of 4212	6060	cmd.exe	106
PID 3476 wrote to memory of 3000	3476	2026-07-20_2a56a0095e3d03d28b0d02a696017106_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	108
PID 3000 wrote to memory of 2844	3000	msedge.exe	109
PID 2844 wrote to memory of 5804	2844	cmd.exe	111
PID 3000 wrote to memory of 2180	3000	msedge.exe	112
PID 2180 wrote to memory of 5696	2180	cmd.exe	114
PID 3000 wrote to memory of 5528	3000	msedge.exe	115
PID 5528 wrote to memory of 5928	5528	cmd.exe	117
PID 3000 wrote to memory of 1060	3000	msedge.exe	118
PID 1060 wrote to memory of 3344	1060	cmd.exe	120
PID 3000 wrote to memory of 3608	3000	msedge.exe	122
PID 3608 wrote to memory of 5748	3608	cmd.exe	124
PID 3000 wrote to memory of 824	3000	msedge.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-20_2a56a0095e3d03d28b0d02a696017106_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_2a56a0095e3d03d28b0d02a696017106_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c copy /y "C:\Users\Admin\AppData\Local\Temp\2026-07-20_2a56a0095e3d03d28b0d02a696017106_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\msedge.exe""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Windows\system32\cmd.exe
    cmd /c copy /y "C:\Users\Admin\AppData\Local\Temp\2026-07-20_2a56a0095e3d03d28b0d02a696017106_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\msedge.exe"
    3⤵
    - Executes a command shell one-liner
    PID:572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /delete /tn "DellGraphicsScan" /f"
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "DellGraphicsScan" /f
    3⤵
    PID:2360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "DellGraphicsScan" /tr "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\msedge.exe" /sc ONLOGON /rl LIMITED /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "DellGraphicsScan" /tr "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\msedge.exe" /sc ONLOGON /rl LIMITED /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /query /tn "DellGraphicsScan""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "DellGraphicsScan"
    3⤵
    PID:2936
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Invoke-WebRequest -Uri https://api.ipify.org/ -UseBasicParsing -TimeoutSec 6).Content.Trim()""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2844
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Invoke-WebRequest -Uri https://api.ipify.org/ -UseBasicParsing -TimeoutSec 6).Content.Trim()"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Invoke-WebRequest -Uri https://checkip.amazonaws.com/ -UseBasicParsing -TimeoutSec 6).Content.Trim()""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2180
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Invoke-WebRequest -Uri https://checkip.amazonaws.com/ -UseBasicParsing -TimeoutSec 6).Content.Trim()"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "curl -s --max-time 6 https://api.ipify.org/"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5528
  - - C:\Windows\system32\curl.exe
      curl -s --max-time 6 https://api.ipify.org/
      4⤵
      PID:5928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "curl -s --max-time 6 https://checkip.amazonaws.com/"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Windows\system32\curl.exe
      curl -s --max-time 6 https://checkip.amazonaws.com/
      4⤵
      PID:3344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM tor.exe 2>nul"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3608
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM tor.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5748
- - C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\SystemProcess_fzzwht\IntelWorker.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\SystemProcess_fzzwht\IntelWorker.exe --SocksPort 9889 --DataDirectory C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\SystemProcess_fzzwht\data --Log "notice stdout" --DisableNetwork 0 --UseBridges 0 --ClientOnly 1 --NumEntryGuards 8 --NumDirectoryGuards 3 --CircuitBuildTimeout 30 --LearnCircuitBuildTimeout 0 --MaxCircuitDirtiness 600
    3⤵
    - Executes dropped EXE
    - System Time Discovery
    PID:824

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\msedge.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\msedge.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "PID eq 3476" 2>nul | find "3476""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6060
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "PID eq 3476"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2268
- - C:\Windows\system32\find.exe
    find "3476"
    3⤵
    PID:4212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 30968549dad31e60a30bcfafe0bc33e745f34f538841d09b91306ea455eee958
MD5 f623929fbf303a8b140095d9568ac988
SHA1 8c39ae9758011dabd587c6f4ae7a63b11343106d
SHA512 a75f1a30783549196144f66a43688f6eda179859f804ced37e03a1ee4d445e87466f1f43b6288dfe775833f9cda36e23ce2796a771515202691ae59162d6efe6
TLSH
T1F7215733F3CC8624DC9A413650CEAC1136B687DB409ECE6BBB84D558B42F289DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

.mid_5ef0c09b

Path C:\Users\Admin\AppData\Local\Temp\.mid_5ef0c09b
Size 36B
SHA256 dd19f8479c3fd0c3286d90f7ed6a2853de02f1f5c434bba9f4bc75c4a2f5baeb
MD5 ad1e391715efeec72939c5134a0e8137
SHA1 a955aa7da4c5e1e33fe087c2b4702fdcda1c8e23
SHA512 57f48070a40a0951d7ea37eb94c029bce5be82f119ea8b8d03525c677ebdb9528a67dd15e5ac394713e4fe85968d41d694b2ea0241a212a0e33f7caf1541c2ca
MD5 SHA1 SHA512

Submit Download

.psvc_c4c73a594bd2

Path C:\Users\Admin\AppData\Local\Temp\.psvc_c4c73a594bd2
Size 281B
SHA256 a0aece9580238ed52dcf58307dbc514c0a2dfa91f8a1def0cad4c4229a5bab7a
MD5 35915000555e3a5e4ce9c16616749fcd
SHA1 a31ef373d9ea3a8bbad8929041912c1e83ae5e1a
SHA512 9894c705f116d80921b5e8b9b51481320abe46be5e843c43b03f475a057d44b8053076a2b8c04cf7ec5bcb1feeb2721ed43f16b5ff28a4a34af9108e3ba9ac3f
TLSH
T180D02B24D401EE2BFD752B19926A6F0B20B90047B4C05F0F87008D48AED52ACD02DC83
MD5 SHA1 SHA512 TLSH

Submit Download

.winsvc_c4c73a594bd20b5e

Path C:\Users\Admin\AppData\Local\Temp\.winsvc_c4c73a594bd20b5e
Size 4B
SHA256 73b78aae3fdfcb4a4ccc874fbe69f43990ed8c8b6ba1f8dba81067764f454d25
MD5 ddcbe25988981920c872c1787382f04d
SHA1 a35497a705d56199f0123a22bbc6ebbb6fc4d3f0
SHA512 88c51264915860f4d97036fdde974aa40cf7b649e23a8ce47f7923266544a7cf66e4c697c545a4555435cb027208bc968486f2fdf27f69e953598737050c63fa
MD5 SHA1 SHA512

Submit Download

.winsvc_c4c73a594bd20b5e

Path C:\Users\Admin\AppData\Local\Temp\.winsvc_c4c73a594bd20b5e
Size 4B
SHA256 a176eeb31e601c3877c87c2843a2f584968975269e369d5c86788b4c2f92d2a2
MD5 e93028bdc1aacdfb3687181f2031765d
SHA1 7507d41ecbd162a0d6dfdaaa9988a91184351735
SHA512 5d2951e35a8e507db30cab1ed234ba19c083b235465029b1b25ebe3a2e50ab544413e2576d168326cb7fe927e0f75ca16964f5a8b7940cecdcb637d17fb5edde
MD5 SHA1 SHA512

Submit Download

IntelWorker.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\SystemProcess_fzzwht\IntelWorker.exe
Size 9.9MB
SHA256 5c204e004ec7f65ebe3a9bdc55170144a1067bf89a6712b87e0825a036e45ff8
MD5 e7a2dcb8517590998754000074ebe058
SHA1 a349c04514d14dea3ac435b05a6f33112d0a6ba8
SHA512 30b7dc2e768cac57c9b4620a0f03180c22aeda7857090d4bcfa3c113dbda87b89ca59c06310d8584a86fca8cb3cca3cd0c0b31e34c54c52ab07fc5f82c643b11
SSDEEP 98304:VDzqKjm8GE+CTH/SDnmdNB9YKdzCOmCl1dvv1wDKlE/z7j6kR++:xaKJSPwzXmo1dvaRR
TLSH
T1D9A62947F27710DDC5BAC17892177223F9A13C8C81346B6B5A8097622B74B68AF7EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdesc-consensus

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\SystemProcess_fzzwht\data\cached-microdesc-consensus
Size 3.4MB
SHA256 d99bb41c77763fefc0ab84584655f67995c1c6993883e82ec8b25a458722634c
MD5 4bcca21ea07b9c1d2581990a5ae8db59
SHA1 ec6835642229541fb0b4cd745a8a97f0dc841a92
SHA512 55741193adf1935224f557aec7eeb07fbf5abc0464dd791cad9ce48cfe1758849fa6021414fda9922d0e60159a20d63e600f5631b7fbba39f5134901df48b2c9
SSDEEP 24576:yZcyh3Kxz5sUDS4JnMFfNzU4WmAvw4NLUYq:ynKNdS4J2WLDq
TLSH
T17EF532EA97124EEAD32A09DBE510FF7BF33F5725C2486B94286F48FA7205091752093D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\SystemProcess_fzzwht\data\cached-microdescs.new
Size 14.7MB
SHA256 06486f41e9b21f4c5afc5f6bd08a63840e04de98764a0dea7fb9515f041f37e0
MD5 2090d5ef780a087888288215e60f1d2d
SHA1 3fd582ac928685bbf249ba394993adbff5ba7926
SHA512 d4c7c2af7cdfa9823c695621ba2f368f2bd6e37fa09d125064a033645a50950b27e6d5a4ff02f9e4f253793359da1a0a2c551f381ae6b2e31ecda415d2842094
SSDEEP 24576:inyV8V/olViVnVUxUVCAGuLVLVJSGzR8VxQ6VBVoVa2VLVTJEVumVZ9XlVX7roVO:QlBM4Ll2zHwqxRrf
TLSH
T10CF6AEDA89AB04C14E05E7CDDC2607C3DF104A3A4B6001A176AAF5677F332AFC55EA79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5804-18-0x00000161A1CF0000-0x00000161A1D12000-memory.dmp

Download