af883e0d122d3904772a7a7c1a438b50d5d0bbbb882df5f7d089ed737e3d9dcf

Analysis

max time kernel
150s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 00:49

Target
2026-08-17_04af46ee77b2174c2377fb40f4d97bf6_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 38.1MB
Sample260818-a6tc2atana
SHA256 af883e0d122d3904772a7a7c1a438b50d5d0bbbb882df5f7d089ed737e3d9dcf
MD5 04af46ee77b2174c2377fb40f4d97bf6
SHA1 292448cf0d18c9179e6c8375a3209e4d9c9119a4
SHA512 1fb5b315ce7d753431b243f27787f61a1257968789ddf9424cd5b95ed559da4963522469accddb71d66464d9f93cfae403d6dc4a8afac606a1e87a902283c93a
SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfc:fMguj8Q4VfvYqFTrYaC/C
TLSH
T10F978C0773E60095E9B7D1388AA64507D773B8678331CBDF329D06152FABAD09A7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c51d-8.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c51d-8.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Executes dropped EXE 1 IoCs

pid	Process
4304	.tmp_d3736e9ed551eb10.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 240 wrote to memory of 4304	240	2026-08-17_04af46ee77b2174c2377fb40f4d97bf6_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-17_04af46ee77b2174c2377fb40f4d97bf6_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_04af46ee77b2174c2377fb40f4d97bf6_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:240
- C:\Users\Admin\AppData\Local\Temp\.tmp_d3736e9ed551eb10.exe
  C:\Users\Admin\AppData\Local\Temp\.tmp_d3736e9ed551eb10.exe -o C:\Users\Admin\AppData\Local\Temp\output
  2⤵
  - Executes dropped EXE
  PID:4304

.tmp_d3736e9ed551eb10.exe

Path C:\Users\Admin\AppData\Local\Temp\.tmp_d3736e9ed551eb10.exe
Size 2.2MB
SHA256 75a5088b9fa990df7dfb19cdae096ffb47633715d8503eca54c504d4e7714b4d
MD5 c405f238c90051e61137827f0713617e
SHA1 32a70c22ceec6cd57782d77379f524890fc63dfe
SHA512 d591ccfb3e3ba8723fa02475e1ae30a7891c128bce7eda6f7333de650e587846223eab5368924bcb47593f62ec9487c21d5f2e7693ce1ff0fa6e80f2e42e62db
SSDEEP 49152:uQUoZsiuDzdKlXaOgJhxk+6zHoA1pXUCZgX:uXJpmaOg/xFAoATU
TLSH
T1E5B5E05AA3A411F8D1B7D274CD464A0BDBB3B8461670D79F13E04ADA1F23A715E2F322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download