967ff6098ed8c1928c3f37c7ef548ce3bb85c0a3e695025c51789942ae8664df

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_806777e1b008171dd06e6f3b41df602a_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
Size 68.4MB
Sample260824-jf2fdsce23
SHA256 967ff6098ed8c1928c3f37c7ef548ce3bb85c0a3e695025c51789942ae8664df
MD5 806777e1b008171dd06e6f3b41df602a
SHA1 3b2656b47fb27869e1a69bc923d1521fd772c8b2
SHA512 35f6ca78fbf84f445136da4de13d81373b5cf735ee7253e2b9a32a86fb9d1e1d799ab6d00ebf79118739cfcd2689f4a493a434ef0d2560baed4008d1bb5ddc6a
SSDEEP 786432:d0LoCOn+27s4urYDNulLBiuB5+2IqeG78f51XwtNGfT72Lyl8yb:dMoCm/7XwuE8
TLSH
T15FF7BE02B3E505A3D5A792348A9B0203E372B4631734DBDB719C43582FAB7E45ABF764
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
5792	2026-08-23_806777e1b008171dd06e6f3b41df602a_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
5792	2026-08-23_806777e1b008171dd06e6f3b41df602a_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
5792	2026-08-23_806777e1b008171dd06e6f3b41df602a_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2532	cmd.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
5792	2026-08-23_806777e1b008171dd06e6f3b41df602a_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
5792	2026-08-23_806777e1b008171dd06e6f3b41df602a_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
5792	2026-08-23_806777e1b008171dd06e6f3b41df602a_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
5792	2026-08-23_806777e1b008171dd06e6f3b41df602a_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
5792	2026-08-23_806777e1b008171dd06e6f3b41df602a_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5792 wrote to memory of 2532	5792	2026-08-23_806777e1b008171dd06e6f3b41df602a_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe	89
PID 2532 wrote to memory of 4320	2532	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-23_806777e1b008171dd06e6f3b41df602a_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_806777e1b008171dd06e6f3b41df602a_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:4320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

node_sqlite3.node

Path C:\Users\Admin\AppData\Local\Temp\pkg\152ddddf0ebc8fd9fdd0143778b6765e49678532a2b1e33e66adc235fa88b7a7\sqlite3\lib\binding\napi-v6-win32-unknown-x64\node_sqlite3.node
Size 1.6MB
SHA256 152ddddf0ebc8fd9fdd0143778b6765e49678532a2b1e33e66adc235fa88b7a7
MD5 d5d477af6910a4856d5457b8e667f84b
SHA1 80e99d5b15c1c65ffa7e44c52c14056691ee3295
SHA512 435bc0f5b6af33549e59b5c50c43bd62ef5faf6acad85ad9d79f5ee80c82fed86f45391f20a35c0114d92aa80cc8c68aef0420501f4d5f5e2eed701c830013f2
SSDEEP 24576:DJvDTRiJfuwxRQM3DxAwW9PlKkOOEJHChNdQBoFSsXE1PKlmGPeZ:DBYtNxCMKwstKkOOEJiOOFHXY
TLSH
T11E758F56B2B801BCC46BC2788A1B5607E7B174051774ABDF15D04AAA6F23FE25A7F330
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node-hide-console-window.node

Path C:\Users\Admin\AppData\Local\Temp\pkg\27731562ce46fbefaa0bf08e7f5f596ea5bb6f248e868153f8b8f121de01d544\node-hide-console-window\build\Release\node-hide-console-window.node
Size 96KB
SHA256 27731562ce46fbefaa0bf08e7f5f596ea5bb6f248e868153f8b8f121de01d544
MD5 87efb9612d5c4e0622631c4218c4dc55
SHA1 b8b157ef604c950feddb862fca77b0cde668eb13
SHA512 746f115a0d35822335566bf061e5896321e2b313d2df5ea4f84d80d4f54e28d1a5c5932b1c8f25bcb2b7a8f93c408bb427c3b821349c7c14cfe3b751db8b73c1
SSDEEP 1536:7K2km4zj0fM7SarS0ScSGvmlGRvoqGw2zXJl0QsWUgEd09dleGFcWCcetA:u2km4f0k2arZMGOERvm1zXP0RxM8OcWr
TLSH
T12CA36A6BB3E500BBE4724238C4630E12D776F8511A219B6F53A4065E1F633D1AE3EFA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node-dpapi.node

Path C:\Users\Admin\AppData\Local\Temp\pkg\7bcfaf256447da5215324f98bdc94f4ad5c4e87c49bd87aa9cc87bed20af0aa3\win-dpapi\build\Release\node-dpapi.node
Size 142KB
SHA256 7bcfaf256447da5215324f98bdc94f4ad5c4e87c49bd87aa9cc87bed20af0aa3
MD5 d1b43555e4a28d9e51d465d2af2f8a4d
SHA1 2756ba8da5f8345086ddcf598ace2ceaf099e532
SHA512 a7219dcfccb828f49a438b8ef57413b51cf8959e3e6e375e58f274b322a7617d8ee1d4bb203fdceb908b988286af220d8d6f073de14b3c2bff8dd27e6f060195
SSDEEP 3072:N6K2F6s0QqV+Mpr2uDui9ddt3QpOVdhmhjXR:8KXpauxdjupXR
TLSH
T10AE35B5BB3A111BBE5678239C9234A02E7B2B85107719B6F0364476F1F633E19D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download