7c6aab4131eee32b103848128fff11612850301f16829eb6111a9140d57aad3c

General

Target
2026-07-21_cd06bbb8d089031bbad17bc15660c950_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 65.3MB
Sample260721-1j445afe75
SHA256 7c6aab4131eee32b103848128fff11612850301f16829eb6111a9140d57aad3c
MD5 cd06bbb8d089031bbad17bc15660c950
SHA1 7d1957280b2ec11e949d7df769c55706e3cccd22
SHA512 b8bfc0d14ca7069121fb4a4e8065021d273506ccb16fcc0c812f8198c783a2484aacf0ddcb8b014f5162397fe201089db7ce5e1e0dbe29e07a6ff937ae2ca850
SSDEEP 393216:t1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfU:tMguj8Q4VfvFqFTrYJ
TLSH
T100E79E3722B714ADF4B6D93281661106CE3A39175339D6CF718C62B52FBB6E44E39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	2476	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2476	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.exe	2026-07-21_cd06bbb8d089031bbad17bc15660c950_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe

Executes dropped EXE 3 IoCs

pid	Process
2692	msedge.exe
5388	msedge.exe
4460	AdobeHandler.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
5564	cmd.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
6	api.ipify.org

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
5872	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2384	cmd.exe
1008	cmd.exe
2980	cmd.exe
5932	cmd.exe
3812	cmd.exe
2388	cmd.exe
1140	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4460	AdobeHandler.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2512	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1200	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2476	powershell.exe
2476	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2476	powershell.exe
Token: SeDebugPrivilege	5872	tasklist.exe
Token: SeDebugPrivilege	2512	taskkill.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 1140	2196	2026-07-21_cd06bbb8d089031bbad17bc15660c950_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	89
PID 1140 wrote to memory of 2384	1140	cmd.exe	91
PID 2196 wrote to memory of 5564	2196	2026-07-21_cd06bbb8d089031bbad17bc15660c950_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	92
PID 5564 wrote to memory of 940	5564	cmd.exe	94
PID 2196 wrote to memory of 1008	2196	2026-07-21_cd06bbb8d089031bbad17bc15660c950_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	95
PID 1008 wrote to memory of 1200	1008	cmd.exe	97
PID 2196 wrote to memory of 2980	2196	2026-07-21_cd06bbb8d089031bbad17bc15660c950_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	98
PID 2980 wrote to memory of 2780	2980	cmd.exe	100
PID 2692 wrote to memory of 5932	2692	msedge.exe	103
PID 5932 wrote to memory of 2476	5932	cmd.exe	105
PID 2196 wrote to memory of 5388	2196	2026-07-21_cd06bbb8d089031bbad17bc15660c950_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	106
PID 5388 wrote to memory of 3812	5388	msedge.exe	107
PID 3812 wrote to memory of 5872	3812	cmd.exe	109
PID 3812 wrote to memory of 4276	3812	cmd.exe	110
PID 2692 wrote to memory of 2388	2692	msedge.exe	112
PID 2388 wrote to memory of 2512	2388	cmd.exe	114
PID 2692 wrote to memory of 4460	2692	msedge.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-21_cd06bbb8d089031bbad17bc15660c950_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_cd06bbb8d089031bbad17bc15660c950_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c copy /y "C:\Users\Admin\AppData\Local\Temp\2026-07-21_cd06bbb8d089031bbad17bc15660c950_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\msedge.exe""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1140
- - C:\Windows\system32\cmd.exe
    cmd /c copy /y "C:\Users\Admin\AppData\Local\Temp\2026-07-21_cd06bbb8d089031bbad17bc15660c950_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\msedge.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /delete /tn "WirelessMonitorTask" /f"
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5564
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "WirelessMonitorTask" /f
    3⤵
    PID:940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WirelessMonitorTask" /tr "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\msedge.exe" /sc ONLOGON /rl LIMITED /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1008
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WirelessMonitorTask" /tr "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\msedge.exe" /sc ONLOGON /rl LIMITED /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /query /tn "WirelessMonitorTask""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "WirelessMonitorTask"
    3⤵
    PID:2780
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "PID eq 2692" 2>nul | find "2692""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3812
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 2692"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5872
  - - C:\Windows\system32\find.exe
      find "2692"
      4⤵
      PID:4276

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\msedge.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\msedge.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Invoke-WebRequest -Uri https://api.ipify.org/ -UseBasicParsing -TimeoutSec 6).Content.Trim()""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Invoke-WebRequest -Uri https://api.ipify.org/ -UseBasicParsing -TimeoutSec 6).Content.Trim()"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM tor.exe 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM tor.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2512
- C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\MicrosoftWorker_lmpo4f\AdobeHandler.exe
  C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\MicrosoftWorker_lmpo4f\AdobeHandler.exe --SocksPort 9507 --DataDirectory C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\MicrosoftWorker_lmpo4f\data --Log "notice stdout" --DisableNetwork 0 --UseBridges 0 --ClientOnly 1 --NumEntryGuards 8 --NumDirectoryGuards 3 --CircuitBuildTimeout 30 --LearnCircuitBuildTimeout 0 --MaxCircuitDirtiness 600
  2⤵
  - Executes dropped EXE
  - System Time Discovery
  PID:4460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

PowerShell

1

T1059.001

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Indicator Removal

1

T1070

Clear Persistence

1

T1070.009

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Process Discovery

Query Registry

System Information Discovery

1

T1082

System Time Discovery

1

T1124

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.mid_6aaa97f9

Path C:\Users\Admin\AppData\Local\Temp\.mid_6aaa97f9
Size 36B
SHA256 25fab25effa8aefec32f85b7cc410dbe917f5529cf745bb1575a85cbbc35fdb0
MD5 b3222338535c76817bf7279fb531c2d5
SHA1 7fcf873fb9bf89e48acf79cb9b832e9e0a730805
SHA512 4a0ef0400d64454258dbf76e3b024e70bf9aa74a6829dcf1c15ed7eb1e7571c9e72dbe643def94f52e9d8725c8dbe677438bfcdad7d90d5d09e722a10e586ef4
MD5 SHA1 SHA512

Submit Download

.psvc_0943ca19f715

Path C:\Users\Admin\AppData\Local\Temp\.psvc_0943ca19f715
Size 284B
SHA256 6e65ce8406c9f4d2ced92e7e4aa655aa02337d2954700d87e309d4c5309e9cc4
MD5 173e9d528ae330eada51147b0d7c5e52
SHA1 ba5372186840098c5fe5c6c5f7130434b72dcd40
SHA512 b4b424c741e36933051942d1fe778ae9579a9726418ccabf666832a9864fc0cc9cc14814a18d391cb7d8b379774b11337e405ba3ae079ec45fddececa31f1378
TLSH
T19DD02B249041EE2BFC723B19926A6F0B21B9000BB4C0AF0E8B048D48BADA16CD02DC53
MD5 SHA1 SHA512 TLSH

Submit Download

.winsvc_0943ca19f715c8ee

Path C:\Users\Admin\AppData\Local\Temp\.winsvc_0943ca19f715c8ee
Size 4B
SHA256 e495105c5ee3a20067fe6e4cf513511742e5a72f1c4f1cb8e16204582123ab24
MD5 d790c9e6c0b5e02c87b375e782ac01bc
SHA1 d91afe852abb1bd6931c4e534b568e24eb7ff9a9
SHA512 ef8b3a67f8ab4261acb9a8b896a636817f5fc3a3de1eee449f98c61910139ba4be19e872eccb386e404748b4c477a3cb67db8c2d4977a5b687108db93be9a931
MD5 SHA1 SHA512

Submit Download

AdobeHandler.exe

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\MicrosoftWorker_lmpo4f\AdobeHandler.exe
Size 9.9MB
SHA256 5c204e004ec7f65ebe3a9bdc55170144a1067bf89a6712b87e0825a036e45ff8
MD5 e7a2dcb8517590998754000074ebe058
SHA1 a349c04514d14dea3ac435b05a6f33112d0a6ba8
SHA512 30b7dc2e768cac57c9b4620a0f03180c22aeda7857090d4bcfa3c113dbda87b89ca59c06310d8584a86fca8cb3cca3cd0c0b31e34c54c52ab07fc5f82c643b11
SSDEEP 98304:VDzqKjm8GE+CTH/SDnmdNB9YKdzCOmCl1dvv1wDKlE/z7j6kR++:xaKJSPwzXmo1dvaRR
TLSH
T1D9A62947F27710DDC5BAC17892177223F9A13C8C81346B6B5A8097622B74B68AF7EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdesc-consensus

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\MicrosoftWorker_lmpo4f\data\cached-microdesc-consensus
Size 3.4MB
SHA256 6768d6d9d0724cd22fdaf98a2d01a0c184a40be712d0b68bafc62d25e8fddb8c
MD5 fa53345d4b3be93593558887875b43c6
SHA1 04ad8fa0eba9eb397f1667446e5364c4b394a8c1
SHA512 7a93b752f91cb67cabb7bec0e3b6724f7d0eaeb14c982fba35f246ee9d226fd496fe48b035b0102bf30f40c96d517e9756e11539f12f9243f0c02dab5447da19
SSDEEP 24576:+DIHG7brbb4TCF0UADyKBZzezllWHW1heU:+X/4TCFy90eU
TLSH
T1B4F532EA97124EEAD32A09DBE510FF7BF33F5725C2486B94286F48FA7205091752093D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\MicrosoftWorker_lmpo4f\data\cached-microdescs.new
Size 28.9MB
SHA256 133a8ec6ef4736780bb5ae7a4353aaec249dd52823968c433c37d0d3b674328e
MD5 942cb20984fa353fd782f99023f43d97
SHA1 c5b2a34a62fc1e0f36aad4c08e103a15e7e847c7
SHA512 4794f8b960f8ed418ada757cdc32880a45db43f9d6cc9480213de25dfb97eb37337dd4371183d065014c38255a953587b8fe9d33021b33dda4b54be7f16aa8c1
SSDEEP 24576:iiByLmVVhaDVWrklqjVLk+VZrVrr7eVhUbyVVrKbKQyVQVzZpVvVTVU8yVpECDKp:yENPLbsLwyr/bX4vizbmb
TLSH
T19E67AEDA89AB04C14D05E7CDEC2607C3DF144A3E4B6001A176AAF5677B332AFC55EA78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2476-16-0x000001ABB3EF0000-0x000001ABB3F12000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads