e81b67b69065151c7b5bdc8f40ff92d7171063cbac01fb11894b24079cf153b2

Analysis

max time kernel
150s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 04:23

Target
2026-07-31_6a5f7665d6b9e7eb5a3a6dfb19d890d7_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 60.4MB
Sample260731-ezyfmatfmg
SHA256 e81b67b69065151c7b5bdc8f40ff92d7171063cbac01fb11894b24079cf153b2
MD5 6a5f7665d6b9e7eb5a3a6dfb19d890d7
SHA1 9ffcc8b155298ca1b5ae305f4ca963e339f7a9bb
SHA512 14811d4984be7539d918b7141a270510d5ab2c4df1cdc62b79c772c37b8556947817f4e86529d6e56de0acd3e79ed4559ffc26296357c4d1766871478df05711
SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfF:fMguj8Q4VfvCqFTrYR
TLSH
T1F5D750826240A0D5DC528334959627918593F5333E24FC8EB0DC01D6AFFF69FEAF9668
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000f00000001c54b-3.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
behavioral2/files/0x000f00000001c54b-3.dat	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000f00000001c54b-3.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Executes dropped EXE 1 IoCs

pid	Process
1108	systemNetwork1785471824264.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1108	1976	2026-07-31_6a5f7665d6b9e7eb5a3a6dfb19d890d7_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-31_6a5f7665d6b9e7eb5a3a6dfb19d890d7_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_6a5f7665d6b9e7eb5a3a6dfb19d890d7_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Users\Admin\AppData\Local\Temp\systemNetwork1785471824264.exe
  C:\Users\Admin\AppData\Local\Temp\systemNetwork1785471824264.exe
  2⤵
  - Executes dropped EXE
  PID:1108

systemNetwork1785471824264.exe

Path C:\Users\Admin\AppData\Local\Temp\systemNetwork1785471824264.exe
Size 1.8MB
SHA256 05628604201f56c2b2349a6beab5b407d519e59322e56946afb329e2b82fc465
MD5 6429f87a9be84d20e70167a70cb3b0fe
SHA1 5ee135c9206c93d4f210d9b16c271ed7d71d8890
SHA512 ec1e9fc88c42d6131c984f4416d356454ba85c3633bf0effc806ec14f9aa98258364bffbc8f9951890a40fd2fb4ffc6d7d464fdc16711fa848a442ea40bfca78
SSDEEP 49152:KNtCaxUjOe0Ka5oiZ+PfAYk4qERGEmplgNu3RxI:UK0Ka5oFQY
TLSH
T10D859E0AA27501F8D0BBD178CA465507EBB2B4190735A7DF1790CAA62F23FF15A7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download