Overview

overview

6

Static

static

3

2026-05-08...kn.exe

windows10-2004-x64

6

2026-05-08...kn.exe

windows11-21h2-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    08/05/2026, 23:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-08_56b542b5d5fe6af93052abec8be754af_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
  • Size 8.8MB
  • Sample260508-3dheaabs4j
  • SHA256 20056e47d2b3c00e22ff86ba3a7349994112d188fa5045d12b6eb56cd314fbca
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
executionpersistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • GoLang User-Agent 64 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies registry key 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-08_56b542b5d5fe6af93052abec8be754af_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-08_56b542b5d5fe6af93052abec8be754af_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1900
    • C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v C2Agent /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-05-08_56b542b5d5fe6af93052abec8be754af_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe /f
      2⤵
      • Adds Run key to start application
      • Modifies registry key
      PID:2300
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-PSDrive -PSProvider FileSystem | Select -ExpandProperty Root"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5096
  • C:\Users\Admin\AppData\Local\Temp\2026-05-08_56b542b5d5fe6af93052abec8be754af_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
    C:\Users\Admin\AppData\Local\Temp\2026-05-08_56b542b5d5fe6af93052abec8be754af_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3164
    • C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v C2Agent /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-05-08_56b542b5d5fe6af93052abec8be754af_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe /f
      2⤵
      • Adds Run key to start application
      • Modifies registry key
      PID:1832
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-PSDrive -PSProvider FileSystem | Select -ExpandProperty Root"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5912

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        powershell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        • Size 3KB
        • SHA256 e9ed3ac973f1fbf644be44fd3f3b594dc1ae7dfb1b772ec7635411fd17175823
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 b9bb580ffde775609971b0bb32ea7961ce6791399ee33c2023355c37270e49b2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __PSScriptPolicyTest_dt1j3srx.2wx.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dt1j3srx.2wx.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/5096-0-0x00000234E8970000-0x00000234E8980000-memory.dmp
        Download

        memory/5096-1-0x00000234E8970000-0x00000234E8980000-memory.dmp
        Download

        memory/5096-2-0x00000234E8930000-0x00000234E8952000-memory.dmp
        Download

        memory/5096-9-0x00000234E8970000-0x00000234E8980000-memory.dmp
        Download

        memory/5096-13-0x00000234E8240000-0x00000234E8252000-memory.dmp
        Download

        memory/5096-12-0x00000234E69E0000-0x00000234E69EC000-memory.dmp
        Download

        memory/5912-23-0x000002019E990000-0x000002019E99C000-memory.dmp
        Download

        memory/5912-24-0x00000201A02D0000-0x00000201A02E2000-memory.dmp
        Download