232b154fbc76014ada09854e43c369af6825f9d055587107a4a3b91d3d72a4ae

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/04/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-27_55518b8348a555952b1af7cd848a69de_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 7.2MB
Sample260427-e5lzsaew6r
SHA256 232b154fbc76014ada09854e43c369af6825f9d055587107a4a3b91d3d72a4ae
MD5 55518b8348a555952b1af7cd848a69de
SHA1 318b2e2b4835cf8dc83cd7f7d7b892bdca698141
SHA512 c4ff1d49b7e2da6e5037f51fdf2a27af6b222682f1a6fa078b23f51c40d92bd74236f65ba06a910d6c675cfa52f8b8c6ae2f8a57bd89286a611f1be5e11987e8
SSDEEP 49152:0MDgrwWfvitrEV6/GPRs6bny9laoxLXnvBer4rORXkQNZggNnSUm97Li24HRMClh:02gI4R9wPXUr4SRTMARxlOrcsGEuE8
TLSH
T16C763947FCA555E9C0ADD23589639212BB727C481B3123D32BA0F3282F76BD06EB9754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

persistence

Malware Config

Signatures

Custom signature

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024441-1.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Executes dropped EXE 1 IoCs

pid	Process
3396	ZenconnektAgent.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ZenconnektAgent = "C:\\Users\\Admin\\AppData\\Roaming\\Zenconnekt\\ZenconnektAgent.exe"	ZenconnektAgent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ZenconnektAgent = "C:\\Users\\Admin\\AppData\\Roaming\\Zenconnekt\\ZenconnektAgent.exe"	2026-04-27_55518b8348a555952b1af7cd848a69de_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-04-27_55518b8348a555952b1af7cd848a69de_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-04-27_55518b8348a555952b1af7cd848a69de_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ZenconnektAgent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ZenconnektAgent.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4508	2026-04-27_55518b8348a555952b1af7cd848a69de_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
3396	ZenconnektAgent.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-27_55518b8348a555952b1af7cd848a69de_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-27_55518b8348a555952b1af7cd848a69de_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4508

C:\Users\Admin\AppData\Roaming\Zenconnekt\ZenconnektAgent.exe
C:\Users\Admin\AppData\Roaming\Zenconnekt\ZenconnektAgent.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ZenconnektAgent.exe

Path C:\Users\Admin\AppData\Roaming\Zenconnekt\ZenconnektAgent.exe
Size 7.2MB
SHA256 232b154fbc76014ada09854e43c369af6825f9d055587107a4a3b91d3d72a4ae
MD5 55518b8348a555952b1af7cd848a69de
SHA1 318b2e2b4835cf8dc83cd7f7d7b892bdca698141
SHA512 c4ff1d49b7e2da6e5037f51fdf2a27af6b222682f1a6fa078b23f51c40d92bd74236f65ba06a910d6c675cfa52f8b8c6ae2f8a57bd89286a611f1be5e11987e8
SSDEEP 49152:0MDgrwWfvitrEV6/GPRs6bny9laoxLXnvBer4rORXkQNZggNnSUm97Li24HRMClh:02gI4R9wPXUr4SRTMARxlOrcsGEuE8
TLSH
T16C763947FCA555E9C0ADD23589639212BB727C481B3123D32BA0F3282F76BD06EB9754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download