752b9085647083fa76e2f32e036c9a6246c41e094cc8e81bbf5a8ef6bc403b4f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 02:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_af2085ac264e38eed198bd97e546f2a1_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 44.9MB
Sample260808-dexg6agm21
SHA256 752b9085647083fa76e2f32e036c9a6246c41e094cc8e81bbf5a8ef6bc403b4f
MD5 af2085ac264e38eed198bd97e546f2a1
SHA1 1cfe05dc08a174ed296950dc1508cd5b9f7b6263
SHA512 66285019f883209bac3e019d7145279e784480db29e6db376f099926785091ad026b5e0456cb541ca3ebdf2faceaea3db2edb077a4bc25e72be2676b16e678e0
SSDEEP 393216:s1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfg:sMguj8Q4VfvIqFTrYh/WyK
TLSH
T1C4A79D0773E501A6E5B3E1388AA74103E773B4635731CBDB329D03542FABAE49A3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

execution persistence

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
behavioral1/files/0x00070000000245ec-5.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Executes dropped EXE 1 IoCs

pid	Process
2372	powershell_core.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\powershell_core.exe"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2388	powershell.exe
692	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3840	cmd.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2388	powershell.exe
2388	powershell.exe
2388	powershell.exe
2388	powershell.exe
2388	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2388	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 692	2136	2026-08-08_af2085ac264e38eed198bd97e546f2a1_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	84
PID 2136 wrote to memory of 3840	2136	2026-08-08_af2085ac264e38eed198bd97e546f2a1_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	85
PID 2136 wrote to memory of 2372	2136	2026-08-08_af2085ac264e38eed198bd97e546f2a1_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	87
PID 2372 wrote to memory of 2388	2372	powershell_core.exe	89
PID 3840 wrote to memory of 3252	3840	cmd.exe	91
PID 2388 wrote to memory of 1620	2388	powershell.exe	92
PID 1620 wrote to memory of 4892	1620	csc.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-08-08_af2085ac264e38eed198bd97e546f2a1_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_af2085ac264e38eed198bd97e546f2a1_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command " $member = '[DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);'; $type = Add-Type -MemberDefinition $member -Name \"Win32ShowWindow\" -Namespace Win32 -PassThru; $hwnd = (Get-Process -Id 2136).MainWindowHandle; if ($hwnd -ne [IntPtr]::Zero) { $type::ShowWindow($hwnd, 0); } "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\powershell_core.exe" /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3840
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\powershell_core.exe" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    PID:3252
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\powershell_core.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\powershell_core.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command " $member = '[DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);'; $type = Add-Type -MemberDefinition $member -Name \"Win32ShowWindow\" -Namespace Win32 -PassThru; $hwnd = (Get-Process -Id 2372).MainWindowHandle; if ($hwnd -ne [IntPtr]::Zero) { $type::ShowWindow($hwnd, 0); } "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2388
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\j04txs3n\j04txs3n.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1620
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5966.tmp" "c:\Users\Admin\AppData\Local\Temp\j04txs3n\CSC4E6852998D5D430FBF9042271AAB346A.TMP"
        5⤵
        
        PID:4892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Privilege Escalation

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.system

Path C:\Users\Admin\.system
Size 14B
SHA256 1a9de770430d0f01afeaa7a2947e9e49931322e558ed64b836ac254e1d88b616
MD5 929ce50afc51f85f1da646fbbb4893c5
SHA1 f88ec40ea2eb773ad42ddcb8087220b56c417ded
SHA512 41712999bd72e3f43c7cd535025876c000aa056ab1ea2a01a95fa5ddf9d70c642e9e9f14cb6669d543382fc77fc8dc9da9c3db520fd6297153763e83a76c00b1
MD5 SHA1 SHA512

Submit Download

RES5966.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5966.tmp
Size 1KB
SHA256 eda0dcc237713d1884d4a1ae65eaaceff25a7ddf21b3ee1c2d6355d7a8600a7d
MD5 391a90731b4d3256463c6309895809ca
SHA1 bff7796358132b61b230966fbb53624bb95ecebf
SHA512 69b5380682efd620607f088752c1e955fabbba76e2f66b3b21064599f8f26763646bf5900d0b37fc7e333ecbcc36ee6d4d29cc76794276fccb690dff71caafae
TLSH
T18C21C90483E80B0FF0774B31A9F6072BA234FD65EFA2975B8440422C1C91104EEE0EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_tfttk4ua.tmj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tfttk4ua.tmj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

j04txs3n.dll

Path C:\Users\Admin\AppData\Local\Temp\j04txs3n\j04txs3n.dll
Size 3KB
SHA256 5675ef91dfcb3e9285c0a4a6ee29aa65eb86c4dcd789739fca9773829755d798
MD5 045198d2b71cbdc5873d13b59aab9bbf
SHA1 67c40890d4e7cb4400dd34e989eb95dfcabe3470
SHA512 1e17a185e60f77b13d33570542e1a311eba87cc7c19534adac9eff1f6e6b9b6773d0ea63335d48e287e5b9feb1a4652ffce2e129b015a2feccffd47b7520b725
TLSH
T1C451BB06A3E8866BE4770B34AEF343266774FC14AFB3576D59804328AC616645D31FB1
MD5 SHA1 SHA512 TLSH

Submit Download

powershell_core.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\powershell_core.exe
Size 44.9MB
SHA256 752b9085647083fa76e2f32e036c9a6246c41e094cc8e81bbf5a8ef6bc403b4f
MD5 af2085ac264e38eed198bd97e546f2a1
SHA1 1cfe05dc08a174ed296950dc1508cd5b9f7b6263
SHA512 66285019f883209bac3e019d7145279e784480db29e6db376f099926785091ad026b5e0456cb541ca3ebdf2faceaea3db2edb077a4bc25e72be2676b16e678e0
SSDEEP 393216:s1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfg:sMguj8Q4VfvIqFTrYh/WyK
TLSH
T1C4A79D0773E501A6E5B3E1388AA74103E773B4635731CBDB329D03542FABAE49A3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC4E6852998D5D430FBF9042271AAB346A.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\j04txs3n\CSC4E6852998D5D430FBF9042271AAB346A.TMP
Size 652B
SHA256 66864d2e1aa4bb11c1c15da03c5bce9113ef7e4e0d3fbb89685e8adbfca53f5f
MD5 6e396ba276830e934e2daf8764185367
SHA1 54fbaa54517a04f98291d48dfcc3745f1acd5982
SHA512 a9e0e9cf15aa418408872210e60d224836cad6eaa76b75782317351eafbbafe9e95faa979367eebe398ea8e53b9f39a1bdc71544aeef6e24e15658648cca2e16
TLSH
T18FF03A09A3F8020EF4F34B74B9F6436391A8BC65DE7293ED2440432D28645209962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

j04txs3n.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\j04txs3n\j04txs3n.0.cs
Size 218B
SHA256 531c21f32b41b8651df1f844f1a6485b19926699ff33c80de4fc70a44882394c
MD5 841704ba97da956e81f807e77177b947
SHA1 ba3a59add0183f3de2845a7a99713020124567b6
SHA512 a15176ad1aa3900b90094f8a4f8e15c30947547c323fe9f2c7ef3b33eccfcbb9ca79e2b92b8f936f39b8dc365402dfbb9afcdff659212f14e9a2ffb83e56d0d2
TLSH
T11FD0A71875F359E100134C224C46F1FD76234136259E1609A6A50310EF8B00D4131E59
MD5 SHA1 SHA512 TLSH

Submit Download

j04txs3n.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\j04txs3n\j04txs3n.cmdline
Size 369B
SHA256 bb727319f438efe3613ab17cc7177707f34556cb86e13203825398adab490749
MD5 df6154ff9924cd2280a423676b275311
SHA1 7d76daa7c3a48c9574e6de2e8de5dedc3f226c88
SHA512 4161a4bc080e228369c4d3db4a15521c6d99ff6ff149ed31bdd76c00c0a6bd65788571b6c6d259a5a76013dff35d3803c4ad5220aff58664f4143144e8454b24
TLSH
T16DE0682A53CACA7E11DE180721A9E6AC82720A5329403FC4606084BDD2F70502BD1762
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2388-17-0x0000021609840000-0x0000021609862000-memory.dmp

Download

memory/2388-30-0x0000021609350000-0x0000021609358000-memory.dmp

Download