38956d79e4a1229c3705269651259540fb71bcc360aad48cdfdc87434d0081f2

Analysis

max time kernel
149s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/05/2026, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-18_e6dac67abbe4f069fa87c16189bf5f92_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
Size 1.8MB
Sample260518-cbdefaa16l
SHA256 38956d79e4a1229c3705269651259540fb71bcc360aad48cdfdc87434d0081f2
MD5 e6dac67abbe4f069fa87c16189bf5f92
SHA1 47dc64efdcd13d5c870f1fb8c97c319de6239eff
SHA512 c6be14f052f49ad1d517b34a4875f9db6e3e76300827356299279f55c15f141478993d1e94b155837a8f05575328643ea733c7a3e73093755865262e9880bc71
SSDEEP 49152:00MDpF0egrb/TxvO90d7HjmAFd4A64nsfJCew2r5gCYPCBgwiz1xuSd:vean15d
TLSH
T1C7855A07BC9555B9C4AAD2318A665292BB70BC980F3123D73B50B3F82FB27D45E3A354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2440	cmd.exe
2684	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2684	PING.EXE

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
916	2026-05-18_e6dac67abbe4f069fa87c16189bf5f92_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 2440	916	2026-05-18_e6dac67abbe4f069fa87c16189bf5f92_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe	78
PID 2440 wrote to memory of 2684	2440	cmd.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-18_e6dac67abbe4f069fa87c16189bf5f92_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-18_e6dac67abbe4f069fa87c16189bf5f92_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\system32\cmd.exe
  cmd /c "ping 127.0.0.1 -n 2 > nul & del \"C:\Users\Admin\AppData\Local\Temp\2026-05-18_e6dac67abbe4f069fa87c16189bf5f92_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe.tmp\""
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/916-1-0x00000000004D0000-0x00000000006D3000-memory.dmp

Download