d930f3c74ba939d05dffc49be4f2db09d3e68188d1d2297a30ffc8c8a6176dbf

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 20:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_02ef14ab0e6bec0a8c1fc4f2b42b12d0_avaddon_byakugan_cobalt-strike_coinminer_glassworm_icedi.exe
Size 62.5MB
Sample260825-yz29csag36
SHA256 d930f3c74ba939d05dffc49be4f2db09d3e68188d1d2297a30ffc8c8a6176dbf
MD5 02ef14ab0e6bec0a8c1fc4f2b42b12d0
SHA1 1314ed8bada2ad6c462b3a930fdc654e4a25771e
SHA512 1426205f6e561f3e1cac88b811ca1c9a832931d8d54cdf5594ae7fc4b64e47d70b2a55fd87839215d82c7602cf84c8b1e323f6cb6472d2b24cd08a536080e846
SSDEEP 393216:7zJjLG+AqDOPrr5g3EKd7qr12pFd5glhzHwSQ9C1Bm/B7AAtvDlA2L1MoFspkEs6:7a8aTaxXrLYw6ycrYRaqNnAQcx
TLSH
T124E7BE07B3E505A2E5B792388A9B0203E372B4535730DBDB719C43182FAB6E49A7F754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3064	2026-08-24_02ef14ab0e6bec0a8c1fc4f2b42b12d0_avaddon_byakugan_cobalt-strike_coinminer_glassworm_icedi.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1160	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 1160	3064	2026-08-24_02ef14ab0e6bec0a8c1fc4f2b42b12d0_avaddon_byakugan_cobalt-strike_coinminer_glassworm_icedi.exe	90
PID 1160 wrote to memory of 2292	1160	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-08-24_02ef14ab0e6bec0a8c1fc4f2b42b12d0_avaddon_byakugan_cobalt-strike_coinminer_glassworm_icedi.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_02ef14ab0e6bec0a8c1fc4f2b42b12d0_avaddon_byakugan_cobalt-strike_coinminer_glassworm_icedi.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1160
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:2292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

node-dpapi.node

Path C:\Users\Admin\AppData\Local\Temp\pkg\86e240e49ca6ed8f801a54b4755cd8b06a36b26f49a73352cd3ff75e022deb87\win-dpapi\build\Release\node-dpapi.node
Size 140KB
SHA256 86e240e49ca6ed8f801a54b4755cd8b06a36b26f49a73352cd3ff75e022deb87
MD5 d835f1751a5ca57a289c455e7e1390e3
SHA1 1ac58407d2336a4898bf83003318c8b3c4ff4a68
SHA512 aecf75c2736469d886ddc41e9bdebefcd8e2edfa91926487c086b34f8309dab7a193d3a7f01a48d7a44a087cefb93d4176672a89d946fd1d9738577b269ac8ee
SSDEEP 3072:F5ng2MK8IKUSVwubJXoT941YKVHHDxmQLQV:TuyS6uSTaRMAU
TLSH
T1C0E36B5BB3A111BBE5678239C9634A06E372B8510761DBAF0364437B1F633D09E3BB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download