Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
23/04/2026, 14:02
General
- Target 2026-04-23_bd146b4d0ab14b8e94c6c7edfd992818_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe
- Size 5.3MB
- Sample260423-rca32afx7v
- SHA256 adfbef2e161997f1522f4a6fa02edeca1c836c93c948489f91987d120c077bc0
Malware Config
Signatures
- Detects Windows executables referencing non-Windows User-Agents 1 IoCs
- Drops startup file 1 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_bd146b4d0ab14b8e94c6c7edfd992818_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_bd146b4d0ab14b8e94c6c7edfd992818_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\UpdateData\sys_updater.exe2⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\cmd.execmd /C "reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"WindowsUpdateCache\" /t REG_SZ /d \"\\\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\UpdateData\sys_updater.exe\\\" https://vortex.fayber.dev\" /f"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"WindowsUpdateCache\" /t REG_SZ /d \"\\\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\UpdateData\sys_updater.exe\\\" https://vortex.fayber.dev\" /f3⤵
-
-
-
C:\Windows\system32\conhost.exe\\?\C:\Windows\system32\conhost.exe --headless --width 80 --height 40 --signal 0x224 --server 0x2202⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NonInteractive -ExecutionPolicy Bypass2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\conhost.exe\\?\C:\Windows\system32\conhost.exe --headless --width 80 --height 40 --signal 0x4ac --server 0x4a82⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NonInteractive -ExecutionPolicy Bypass2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
sys_updater.exe
__PSScriptPolicyTest_djfnamzr.mxs.ps1
memory/1960-46-0x0000024E70D30000-0x0000024E70D3C000-memory.dmp
memory/1960-47-0x0000024E71100000-0x0000024E71112000-memory.dmp
memory/4932-4-0x0000015CB3530000-0x0000015CB3540000-memory.dmp
memory/4932-5-0x0000015CCB720000-0x0000015CCB742000-memory.dmp
memory/4932-12-0x0000015CB3530000-0x0000015CB3540000-memory.dmp
memory/4932-13-0x0000015CB3530000-0x0000015CB3540000-memory.dmp
memory/4932-14-0x0000015CB3530000-0x0000015CB3540000-memory.dmp
memory/4932-15-0x0000015CB3490000-0x0000015CB349C000-memory.dmp
memory/4932-17-0x0000015CB3530000-0x0000015CB3540000-memory.dmp
memory/4932-16-0x0000015CB35B0000-0x0000015CB35C2000-memory.dmp