24a8d5e644a1d4a9fecaced5c74bf22e4f55d43c97aeef1d4a326eb86587508d

General

Target
2026-06-01_96694f2ecd476897db54e710a1b3f322_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe
Size 19.1MB
Sample260601-bs75psaz5x
SHA256 24a8d5e644a1d4a9fecaced5c74bf22e4f55d43c97aeef1d4a326eb86587508d
MD5 96694f2ecd476897db54e710a1b3f322
SHA1 a1a6c4bd102fc336479ba8636dfe1ff152dad4ee
SHA512 04b19c5d75fa3e21dc3f38667c81b15315515b2a77b470d3399605a57ee0725c5c42a3082d298adde6770ab22ac8e0d201583ce2f1eea99e723967a39574ea0d
SSDEEP 196608:3dMoZWmmIDlnJIXFXDwWxTf5RxSG9hDAYRwM+3umZNlqrdpqC:3LZWmmIoNDw0LZD9FAYRw7jQ
TLSH
T1FB179E53E9A506E5C199AE34C8A38253BB717C448B3123D76B90FA283F77BD06E79710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3552	netsh.exe
4184	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
3100	downloader.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1708	2026-06-01_96694f2ecd476897db54e710a1b3f322_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe
3100	downloader.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 4052	1708	2026-06-01_96694f2ecd476897db54e710a1b3f322_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe	82
PID 4052 wrote to memory of 3552	4052	cmd.exe	83
PID 1708 wrote to memory of 4232	1708	2026-06-01_96694f2ecd476897db54e710a1b3f322_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe	84
PID 4232 wrote to memory of 4184	4232	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-06-01_96694f2ecd476897db54e710a1b3f322_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_96694f2ecd476897db54e710a1b3f322_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\system32\cmd.exe
  cmd /c "netsh advfirewall firewall delete rule name=\"xDownload\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name=\"xDownload\"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3552
- C:\Windows\system32\cmd.exe
  cmd /c "netsh advfirewall firewall add rule name=\"xDownload\" dir=in action=allow protocol=TCP localport=8877"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4232
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name=\"xDownload\" dir=in action=allow protocol=TCP localport=8877
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4184

\??\c:\xdown\downloader.exe
c:\xdown\downloader.exe service run
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

downloader.exe

Path C:\xdown\downloader.exe
Size 19.1MB
SHA256 24a8d5e644a1d4a9fecaced5c74bf22e4f55d43c97aeef1d4a326eb86587508d
MD5 96694f2ecd476897db54e710a1b3f322
SHA1 a1a6c4bd102fc336479ba8636dfe1ff152dad4ee
SHA512 04b19c5d75fa3e21dc3f38667c81b15315515b2a77b470d3399605a57ee0725c5c42a3082d298adde6770ab22ac8e0d201583ce2f1eea99e723967a39574ea0d
SSDEEP 196608:3dMoZWmmIDlnJIXFXDwWxTf5RxSG9hDAYRwM+3umZNlqrdpqC:3LZWmmIoNDw0LZD9FAYRw7jQ
TLSH
T1FB179E53E9A506E5C199AE34C8A38253BB717C448B3123D76B90FA283F77BD06E79710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xdown.conf

Path \??\c:\xdown\xdown.conf
Size 55B
SHA256 5c9d2b50ba362c6c4c2cfa27edf5bd9f8d215c62746c211c51ee061725e68b34
MD5 242e263702ab0132c60955b16bd25968
SHA1 63dafab5b9720810c00a875b2a5ae789312e9a24
SHA512 d54400d8ddcfc8b8667bff690fb988e7469da11e6e5df76e78ed33659f9b0849e3df2c158ec7fd99bcc4b25e1f28e8f64e292b124dec7ee4348b612c5075b421
TLSH
T1E9900213041D727341583AB011198492A3A5525E5518129592124B515515397856CA10
MD5 SHA1 SHA512 TLSH

Submit Download

xdown.log

Path \??\c:\xdown\xdown.log
Size 6KB
SHA256 8e6fd35013a8fb65faacbba2082b91206b050915da6631fbcf657545cc4137b8
MD5 ec304cf7f143304f75f67f0874b6505f
SHA1 864d1a4ae301d9fd04a5b6fc347213626a7c543a
SHA512 9ac8c6e28c26c6ae3746238ee3b8db0b85e709f0d1281e88a5f6946f71701a6266b42787b3ec9b0f28be320a7481bb0166e5c60f6e3ed1c70438515932d920e5
SSDEEP 96:KmyGp3/1sz1K2EyjE9UEPo8XaLjoLOfo9VLK6fsLV:dG1K2p9qFnaV
TLSH
T1C7D1D98E49B549B174074809CD1B3A188C15FB279186A8832FF9A5CCE0C9C2DEFB7977
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads