17ceb6c8a700129de303dd5603fafb420d4674e3bc6deb9a59597f28b4efc9b1

Reason

Machine shutdown

General

Target
2026-08-15_12dd4654f4990d4a20e40bc93bd83fa3_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 35.9MB
Sample260815-cavmbsdk7x
SHA256 17ceb6c8a700129de303dd5603fafb420d4674e3bc6deb9a59597f28b4efc9b1
MD5 12dd4654f4990d4a20e40bc93bd83fa3
SHA1 798842d5a88b3926121746043c115d6353037f5f
SHA512 06308e828f469ae9cd2e7cb90cf353fe3404e38d3be1c41ddb63bc84ccabf3d97b53d975cc325a4765cdc2cba84de2dfc975a7e8faf07e441d9d8c160e525892
SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfa:fMguj8Q4VfvBqFTrYN
TLSH
T1D3878B0773E60095E9B7D1388AA65507D773B8638331CBDF329D06152FABAD09A7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.bat	2026-08-15_12dd4654f4990d4a20e40bc93bd83fa3_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3684	cmd.exe
4884	cmd.exe
5460	cmd.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5088	powershell.exe
5088	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5088	powershell.exe
Token: SeShutdownPrivilege	4248	shutdown.exe
Token: SeRemoteShutdownPrivilege	4248	shutdown.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4808	PickerHost.exe
4252	LogonUI.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 244 wrote to memory of 5460	244	2026-08-15_12dd4654f4990d4a20e40bc93bd83fa3_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	90
PID 5460 wrote to memory of 1236	5460	cmd.exe	91
PID 1236 wrote to memory of 4548	1236	net.exe	92
PID 244 wrote to memory of 3684	244	2026-08-15_12dd4654f4990d4a20e40bc93bd83fa3_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	93
PID 3684 wrote to memory of 5088	3684	cmd.exe	94
PID 5088 wrote to memory of 1244	5088	powershell.exe	95
PID 244 wrote to memory of 4884	244	2026-08-15_12dd4654f4990d4a20e40bc93bd83fa3_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	96
PID 4884 wrote to memory of 4248	4884	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-08-15_12dd4654f4990d4a20e40bc93bd83fa3_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_12dd4654f4990d4a20e40bc93bd83fa3_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Creates a file in the Startup directory
- Suspicious use of WriteProcessMemory
PID:244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5460
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1236
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -enc cgBlAGcAIABhAGQAZAAgACIASABLAEwATQBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAIgAgAC8AdgAgAEMAOgBcAA=="
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -enc cgBlAGcAIABhAGQAZAAgACIASABLAEwATQBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAIgAgAC8AdgAgAEMAOgBcAA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\
      4⤵
      PID:1244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "shutdown /r /t 5 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\system32\shutdown.exe
    shutdown /r /t 5 /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4248

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4808

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a28855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4252