Analysis
- max time kernel
150s - max time network
157s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/08/2026, 02:55
General
- Target 2026-08-08_af2085ac264e38eed198bd97e546f2a1_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
- Size 44.9MB
- Sample260808-dexg6agm21
- SHA256 752b9085647083fa76e2f32e036c9a6246c41e094cc8e81bbf5a8ef6bc403b4f
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
- Executes dropped EXE 2 IoCs
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_af2085ac264e38eed198bd97e546f2a1_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_af2085ac264e38eed198bd97e546f2a1_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " $member = '[DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);'; $type = Add-Type -MemberDefinition $member -Name \"Win32ShowWindow\" -Namespace Win32 -PassThru; $hwnd = (Get-Process -Id 2848).MainWindowHandle; if ($hwnd -ne [IntPtr]::Zero) { $type::ShowWindow($hwnd, 0); } "2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\haikoghz\haikoghz.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES40B8.tmp" "c:\Users\Admin\AppData\Local\Temp\haikoghz\CSC645F8588ED7449FAB5A14AAD9C166C0.TMP"4⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\powershell_core.exe" /f"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\powershell_core.exe" /f3⤵
- Registers new Windows logon scripts automatically executed at logon.
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\powershell_core.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\powershell_core.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " $member = '[DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);'; $type = Add-Type -MemberDefinition $member -Name \"Win32ShowWindow\" -Namespace Win32 -PassThru; $hwnd = (Get-Process -Id 5332).MainWindowHandle; if ($hwnd -ne [IntPtr]::Zero) { $type::ShowWindow($hwnd, 0); } "3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\namswv1k\namswv1k.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4481.tmp" "c:\Users\Admin\AppData\Local\Temp\namswv1k\CSC62BC70A1CF3B44A1BD4E2D4D9FA562.TMP"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\upd_1786157783616.exeC:\Users\Admin\AppData\Local\Temp\upd_1786157783616.exe3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
.system
RES40B8.tmp
RES4481.tmp
namswv1k.dll
upd_1786157783616.exe
powershell_core.exe
CSC645F8588ED7449FAB5A14AAD9C166C0.TMP
haikoghz.0.cs
haikoghz.cmdline
CSC62BC70A1CF3B44A1BD4E2D4D9FA562.TMP
namswv1k.cmdline
memory/3056-51-0x00000289DC180000-0x00000289DC188000-memory.dmp
memory/5424-12-0x00007FFC7EB00000-0x00007FFC7F4A4000-memory.dmp
memory/5424-3-0x00007FFC7EC8F000-0x00007FFC7EC90000-memory.dmp
memory/5424-19-0x00007FFC7EB00000-0x00007FFC7F4A4000-memory.dmp
memory/5424-17-0x00007FFC7EB00000-0x00007FFC7F4A4000-memory.dmp
memory/5424-16-0x00007FFC7EB00000-0x00007FFC7F4A4000-memory.dmp
memory/5424-15-0x00007FFC7EB00000-0x00007FFC7F4A4000-memory.dmp
memory/5424-14-0x00007FFC7EB00000-0x00007FFC7F4A4000-memory.dmp
memory/5424-13-0x00007FFC7EB00000-0x00007FFC7F4A4000-memory.dmp
memory/5424-35-0x00007FFC7EB00000-0x00007FFC7F4A4000-memory.dmp
memory/5424-18-0x00007FFC7EB00000-0x00007FFC7F4A4000-memory.dmp
memory/5424-11-0x00007FFC7EB00000-0x00007FFC7F4A4000-memory.dmp
memory/5424-9-0x000001995DE10000-0x000001995DE32000-memory.dmp
memory/5424-7-0x00007FFC7EB00000-0x00007FFC7F4A4000-memory.dmp
memory/5424-6-0x00007FFC7EB00000-0x00007FFC7F4A4000-memory.dmp
memory/5424-5-0x00007FFC7EB00000-0x00007FFC7F4A4000-memory.dmp
memory/5424-4-0x00007FFC7EB00000-0x00007FFC7F4A4000-memory.dmp
memory/5984-57-0x00007FFCA2290000-0x00007FFCA2292000-memory.dmp
memory/5984-58-0x0000000140000000-0x00000001405B7000-memory.dmp