5d8e3ddb0843fb4fbd1f9dc18cc34aa83e850fa2ffd877abca2397f88a6c6436

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 09:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_6fd478e96189564400b9a83f2c5096f3_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 48.9MB
Sample260824-k6hawaz1gx
SHA256 5d8e3ddb0843fb4fbd1f9dc18cc34aa83e850fa2ffd877abca2397f88a6c6436
MD5 6fd478e96189564400b9a83f2c5096f3
SHA1 1f7a5d0e91806051e79e735fcad569445c66b273
SHA512 f9d4a9e5cf3d12e6ae6d9e78d9089c18dd38bb4c9afe223e71652a5bca1a79afe225b8cdfb41cd979cf0d46103a4a2b26d21549324bdc9f6d2ad278c2d49cb06
SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfh:fMguj8Q4VfvTqFTrY+gIm1zty
TLSH
T1D0B7AE0673E601A6E5B3D2388AA74103E773B4635731CBDB319C43542FABAE49A7E750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4840	2026-08-23_6fd478e96189564400b9a83f2c5096f3_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5188	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 5188	4840	2026-08-23_6fd478e96189564400b9a83f2c5096f3_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	90
PID 5188 wrote to memory of 4536	5188	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-08-23_6fd478e96189564400b9a83f2c5096f3_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_6fd478e96189564400b9a83f2c5096f3_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5188
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:4536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

node-hide-console-window.node

Path C:\Users\Admin\AppData\Local\Temp\pkg\7e39f51ebc3c78986a8c1aad4c0b9d694b104df972c944a494014ed0c76e75bc\node-hide-console-window\build\Release\node-hide-console-window.node
Size 108KB
SHA256 7e39f51ebc3c78986a8c1aad4c0b9d694b104df972c944a494014ed0c76e75bc
MD5 03410fe9cc2178faf758bd645da4ecf7
SHA1 404f825b471b638c18f7922a013a8e18d774d290
SHA512 0449116167f29b3a00ce39fac6c8fc196dc30ebf5f4e63ed42f8e237b65c7b7f332613d8fc0f7d33bf13b0e2f0a682ff47088772297e6b4b69e5559d9c051130
SSDEEP 3072:S6qsGkhsjnQrtvy0cMr1tNq9PS+ybvRpnp2eQ:bGYsjnga0lrFfHvrnpRQ
TLSH
T1F0B36C1BB3A400BBE4779678C9930E85D372B81507619BAF03A086992F637D19D3FF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download