Overview

overview

7

Static

static

3

2026-04-26...e_.exe

windows10-2004-x64

7

2026-04-26...e_.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    26/04/2026, 04:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-26_70ecd38654a7e4de700765f3374064be_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe
  • Size 34.8MB
  • Sample260426-e8h3asdv8w
  • SHA256 4087b18b61e0bea9d01d7e99ba43aa534e59e72fb8281464d3132cd2464715e0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 24 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 53 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-26_70ecd38654a7e4de700765f3374064be_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-26_70ecd38654a7e4de700765f3374064be_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5248
    • C:\Users\Admin\AppData\Local\Temp\python_installer.exe
      C:\Users\Admin\AppData\Local\Temp\python_installer.exe /quiet InstallAllUsers=0 PrependPath=0 TargetDir=C:\Users\Admin\AppData\Local\Programs\PythonCustom Include_launcher=0
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2304
      • C:\Windows\Temp\{94ABA7DC-25B5-4880-901F-D0E2AC3E23B2}\.cr\python_installer.exe
        "C:\Windows\Temp\{94ABA7DC-25B5-4880-901F-D0E2AC3E23B2}\.cr\python_installer.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\python_installer.exe" -burn.filehandle.attached=544 -burn.filehandle.self=692 /quiet InstallAllUsers=0 PrependPath=0 TargetDir=C:\Users\Admin\AppData\Local\Programs\PythonCustom Include_launcher=0
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:5632
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1848
  • C:\Users\Admin\AppData\Local\Package Cache\{b6178a40-1665-4565-b73e-48dd6e039a65}\python-3.12.2-amd64.exe
    "C:\Users\Admin\AppData\Local\Package Cache\{b6178a40-1665-4565-b73e-48dd6e039a65}\python-3.12.2-amd64.exe" /burn.runonce
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4144
    • C:\Users\Admin\AppData\Local\Package Cache\{b6178a40-1665-4565-b73e-48dd6e039a65}\python-3.12.2-amd64.exe
      "C:\Users\Admin\AppData\Local\Package Cache\{b6178a40-1665-4565-b73e-48dd6e039a65}\python-3.12.2-amd64.exe" /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.12.2 (64-bit)_20260426053654.log" InstallAllUsers=0 PrependPath=0 TargetDir=C:\Users\Admin\AppData\Local\Programs\PythonCustom Include_launcher=0
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5744
      • C:\Users\Admin\AppData\Local\Package Cache\{b6178a40-1665-4565-b73e-48dd6e039a65}\python-3.12.2-amd64.exe
        "C:\Users\Admin\AppData\Local\Package Cache\{b6178a40-1665-4565-b73e-48dd6e039a65}\python-3.12.2-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Package Cache\{b6178a40-1665-4565-b73e-48dd6e039a65}\python-3.12.2-amd64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.12.2 (64-bit)_20260426053654.log" InstallAllUsers=0 PrependPath=0 TargetDir=C:\Users\Admin\AppData\Local\Programs\PythonCustom Include_launcher=0
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:2192
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 960
          4⤵
          • Program crash
          PID:1316
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2192 -ip 2192
    1⤵
      PID:5952

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e582c1f.rbs
          • Path C:\Config.Msi\e582c1f.rbs
          • Size 8KB
          • SHA256 8c2b0daae652c45e8a6e3cabcda2b0e03646eb805157fed4fdf576ca77eebf7f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e582c24.rbs
          • Path C:\Config.Msi\e582c24.rbs
          • Size 12KB
          • SHA256 ee36b9ee8e65f458313d3ec7c7e57f56468580a14647f9dfac4a4c014a1728e7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e582c29.rbs
          • Path C:\Config.Msi\e582c29.rbs
          • Size 49KB
          • SHA256 1e13fbb45e73726c5d2d5f5c30b008552d6c6a208a0f85e7bef4f7b02a7218f8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          core_JustForMe
          • Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\core_JustForMe
          • Size 2.0MB
          • SHA256 e747ceb205400dcdd45cbedc372f9c3cacdd158277e4d27ae1b95d223e323918
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          doc_JustForMe
          • Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\doc_JustForMe
          • Size 5.4MB
          • SHA256 02cc5a3a1d6c54390d68ee97f6c08c2a061a457780e48919c29462ef95a92b09
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          lib_JustForMe
          • Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\lib_JustForMe
          • Size 7.3MB
          • SHA256 af7b6e1b27c6ee7a2e40b947fda039ad26827ac12ed4d0ffa80a6576f5b5fb8b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tcltk_JustForMe
          • Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\tcltk_JustForMe
          • Size 3.4MB
          • SHA256 f0d5c603ff7d87412f5a1e45e8ab7bd95d6f40bb90fd107125964421d7f06233
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          exe.msi
          • Path C:\Users\Admin\AppData\Local\Package Cache\{097D2A37-E94B-4FAD-8C89-D63443BD4D4A}v3.12.2150.0\exe.msi
          • Size 712KB
          • SHA256 91f05b779c2bbeb7a371c2ca24f600d8c21664ad8d2bc464e5565bb90e9405d2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          test.msi
          • Path C:\Users\Admin\AppData\Local\Package Cache\{94087C99-E4F5-4637-A789-3B6059DF787B}v3.12.2150.0\test.msi
          • Size 5.3MB
          • SHA256 fc1036043979b114687df71c1d80abb91734e8fa1e39e7b60056801f0c39db4a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pip.msi
          • Path C:\Users\Admin\AppData\Local\Package Cache\{BDE73EDC-76AE-475D-8885-9B583631B0FC}v3.12.2150.0\pip.msi
          • Size 268KB
          • SHA256 cfe1f73cd965e2cf1bcb94143fd87b7a6cb0d315977cab1da3002f5029948b98
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dev.msi
          • Path C:\Users\Admin\AppData\Local\Package Cache\{F131E2DD-B8C5-42F3-85B7-3D4BAC9582CD}v3.12.2150.0\dev.msi
          • Size 384KB
          • SHA256 633283cfcc5e870c6ce19404267a5e0509625b6b106d0c68e7133557d5c1bcb6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          state.rsm
          • Path C:\Users\Admin\AppData\Local\Package Cache\{b6178a40-1665-4565-b73e-48dd6e039a65}\state.rsm
          • Size 1KB
          • SHA256 57f8258780dc33e911d6344d9c7c2780ecf322018e40cb1b51b896b0b407a499
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Python 3.12.2 (64-bit)_20260426053654.log
          • Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.2 (64-bit)_20260426053654.log
          • Size 66KB
          • SHA256 adb4d3b7416287b165f077cb86d5937ba9aedb2322873ca2f6e3c8b461381d54
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Python 3.12.2 (64-bit)_20260426053654_000_core_JustForMe.log
          • Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.2 (64-bit)_20260426053654_000_core_JustForMe.log
          • Size 1KB
          • SHA256 c29d02b2d152ad3be24df4073ac1fc8b3f6677361de3f5205283fc58dcae40be
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Python 3.12.2 (64-bit)_20260426053654_001_exe_JustForMe.log
          • Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.2 (64-bit)_20260426053654_001_exe_JustForMe.log
          • Size 1KB
          • SHA256 4de0431d15ed190ffec0d1214f884f63f4deb07570cbd3a5196694aabfb14660
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Python 3.12.2 (64-bit)_20260426053654_002_dev_JustForMe.log
          • Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.2 (64-bit)_20260426053654_002_dev_JustForMe.log
          • Size 1KB
          • SHA256 3badfd7224ffe146beb8929c9e8e2d05bd86b8969b488bb1f2a02bba56273888
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Python 3.12.2 (64-bit)_20260426053654_003_lib_JustForMe.log
          • Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.2 (64-bit)_20260426053654_003_lib_JustForMe.log
          • Size 3KB
          • SHA256 eca4a9d234c376f304e4505d5f565a76bc1a2b554b2910f73d2af8ec5589d1a7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          python_installer.exe
          • Path C:\Users\Admin\AppData\Local\Temp\python_installer.exe
          • Size 25.4MB
          • SHA256 b9314802f9efbf0f20a8e2cb4cacc4d5cfb0110dac2818d94e770e1ba5137c65
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PythonBA.dll
          • Path C:\Windows\Temp\{38EEBB1E-11DA-461B-BEAA-1BED18F36BD2}\.ba\PythonBA.dll
          • Size 675KB
          • SHA256 565f03893da383e5bec8c6eaa7c8fbb3e6db0b9bddd5a1399b0dec66fa44d64d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SideBar.png
          • Path C:\Windows\Temp\{38EEBB1E-11DA-461B-BEAA-1BED18F36BD2}\.ba\SideBar.png
          • Size 50KB
          • SHA256 79434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python_installer.exe
          • Path C:\Windows\Temp\{94ABA7DC-25B5-4880-901F-D0E2AC3E23B2}\.cr\python_installer.exe
          • Size 858KB
          • SHA256 1474dbd6a33da8f2f0b50007ba48f0c1ddb3e0e6f8c969722eed1e683a9af68a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1848-620-0x000001FABB880000-0x000001FABB88C000-memory.dmp
          Download