a4a55925af8bfb2204f193f5e42f1c3e420d7b951d2822ebeabf978b2a4cc7c2

Analysis

max time kernel
150s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_c3fb623fea138fecdbcd9dd1b26bee82_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 41.0MB
Sample260910-dd6dnsdp4w
SHA256 a4a55925af8bfb2204f193f5e42f1c3e420d7b951d2822ebeabf978b2a4cc7c2
MD5 c3fb623fea138fecdbcd9dd1b26bee82
SHA1 6e292e6d56831e76bae6f2a75a8a9e07301cabfd
SHA512 94887704dd41a9b24a4ae7365b86a06e5e37ac6c90c6750f61fc83bbf2b347449d9f6bda6786ed046b4381da222231fb925d0069f5343e0f89fbeca969eaa6e4
SSDEEP 393216:X1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfV:XMguj8Q4VfvzqFTrYO
TLSH
T10A979C0773E60095E9B7D1388AA75507D773B8638331CADF329D06152FABAD09A7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1596	40500b0b1a82cfb1.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2592	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1596	40500b0b1a82cfb1.exe
1596	40500b0b1a82cfb1.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 2592	3992	2026-09-08_c3fb623fea138fecdbcd9dd1b26bee82_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	89
PID 2592 wrote to memory of 1596	2592	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-08_c3fb623fea138fecdbcd9dd1b26bee82_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_c3fb623fea138fecdbcd9dd1b26bee82_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\40500b0b1a82cfb1.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Users\Admin\AppData\Local\Temp\40500b0b1a82cfb1.exe
    C:\Users\Admin\AppData\Local\Temp\40500b0b1a82cfb1.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

40500b0b1a82cfb1.exe

Path C:\Users\Admin\AppData\Local\Temp\40500b0b1a82cfb1.exe
Size 3.8MB
SHA256 c2e4d19211b325b02d230c306717ebfb0b86b18af7047a434ab21baa874cf5f5
MD5 9f4d5e19c454a744710a1096c0a8681e
SHA1 eabafb6216aff77bd7170f92121bebcdb42c96ab
SHA512 6564ae975fadb5b1e6dd33caafc3e1868a7224ef53d0036f7e07d9dd4b9f2bc376f2d216dbe471364cbec2c628114a0a7bb32ff3cbe20ad86a59a2ac1004957b
SSDEEP 24576:bSAihQi/Xu1d8almzCdK6vu+IhsArdGV2ajxSEOSeFzqg:bSAihQu+1XlmzCdtgHdajlONF
TLSH
T15816B730E44516EDDCAAD3F69F49AD42C2F2B44B9392EBAF29D1BD005F6B8C4096F510
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download