62a4c41db8814adc6fea815812efcf796f7794f86907de0d01fea3b7097ade0b

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 04:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_a73bd86f2e4883ac758783939a2cc84e_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
Size 1.8MB
Sample260511-ffwclabv4y
SHA256 62a4c41db8814adc6fea815812efcf796f7794f86907de0d01fea3b7097ade0b
MD5 a73bd86f2e4883ac758783939a2cc84e
SHA1 b5db62136dc878f90c3d89bc5fcd5ac51eeff728
SHA512 a05f20f6da3f776666fc9efa32d0853b3e4ddc0a14b132d5309a79fa82844ff769fb187bb231828639757df6691560fa33703c103bafafd074a6f93c6048f845
SSDEEP 49152:00MDpF0egrb/TxvO90d7HjmAFd4A64nsfJCew2r5gCYPCBgwiz1xuW8v:vean1M
TLSH
T16C855A07BC9555B9C4AAD2318A665292BB70BC980F3123D73B50B3F82FB27D45E3A354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1640	cmd.exe
2764	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2764	PING.EXE

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4908	2026-05-11_a73bd86f2e4883ac758783939a2cc84e_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 1640	4908	2026-05-11_a73bd86f2e4883ac758783939a2cc84e_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe	84
PID 1640 wrote to memory of 2764	1640	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-05-11_a73bd86f2e4883ac758783939a2cc84e_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_a73bd86f2e4883ac758783939a2cc84e_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\system32\cmd.exe
  cmd /c "ping 127.0.0.1 -n 2 > nul & del \"C:\Users\Admin\AppData\Local\Temp\2026-05-11_a73bd86f2e4883ac758783939a2cc84e_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe.tmp\""
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4908-1-0x00000000009C0000-0x0000000000BC3000-memory.dmp

Download