54ddb63590b0e581fb9fff927ddaccf3ade7b2436cae3602ef006e324d163078

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2026, 02:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_cad99216bcf25bbf7a8bcb0fbe26fe6c_cobalt-strike_coinminer_elex_frostygoop_glassworm_hive_l.exe
Size 10.0MB
Sample260511-c9eedsdx6p
SHA256 54ddb63590b0e581fb9fff927ddaccf3ade7b2436cae3602ef006e324d163078
MD5 cad99216bcf25bbf7a8bcb0fbe26fe6c
SHA1 688f8117e4f4fae3fae89b5d39dd36fb8dfa6eb1
SHA512 a9517109bc0cbf6dabcab53178f1e404bd03514a8d9849935bbc8f8ea9ae4d7812df157e4493ba8a56dc1b73abc7cfce2c5b538bad7b7b6b4e3a3407434522e4
SSDEEP 98304:JnCObKc+5RuTLIkjOtub4QToHNaDGXRkK2G3AH4JYDSDjXwc41In5vDa6SgiZVbf:pCxc+5EXatATOBpvMys1giz
TLSH
T179B66C90F9DB44F6EA0359304967623F233466098739CEC7C6445FA7E8B7BE20A73616
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_cad99216bcf25bbf7a8bcb0fbe26fe6c_cobalt-strike_coinminer_elex_frostygoop_glassworm_hive_l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 5692	2940	2026-05-11_cad99216bcf25bbf7a8bcb0fbe26fe6c_cobalt-strike_coinminer_elex_frostygoop_glassworm_hive_l.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-05-11_cad99216bcf25bbf7a8bcb0fbe26fe6c_cobalt-strike_coinminer_elex_frostygoop_glassworm_hive_l.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_cad99216bcf25bbf7a8bcb0fbe26fe6c_cobalt-strike_coinminer_elex_frostygoop_glassworm_hive_l.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\reg.exe
  reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /f /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads