73c428f3f7048325df6fd3a0a25be4a21fec2746eda2fef787a63f5742f5483f

General

Target
2026-06-28_3ca69243662fc6f2486ea0092efb3b18_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver.exe
Size 6.5MB
Sample260628-27ed2sf19x
SHA256 73c428f3f7048325df6fd3a0a25be4a21fec2746eda2fef787a63f5742f5483f
MD5 3ca69243662fc6f2486ea0092efb3b18
SHA1 d2fcf016a73e5d38f23a5aeae730667d75403826
SHA512 c174d12b4b6a32abc6906fd5665f6e834b76956f84da76f2a80cd5c863f9514b2da97da52e69db674f96af233c8f1c0deb556c1f3c588cd0b6a4db3f2a8209c0
SSDEEP 98304:sLNHK52kTFPSM6b5VeZvwPJme0z8TDd8hclf9qx9xnnJd+Me4I:yUhPSDeZiChMqx9lJheR
TLSH
T1FA66DF07B8E60CA4D9BED270857A8216F974BC490B3663DB6790B7341F737E15A36B80
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3544	.vaultd-673558502

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	.vaultd-673558502
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	.vaultd-673558502
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	.vaultd-673558502

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3544	.vaultd-673558502
3544	.vaultd-673558502

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 3544	2668	2026-06-28_3ca69243662fc6f2486ea0092efb3b18_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-28_3ca69243662fc6f2486ea0092efb3b18_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_3ca69243662fc6f2486ea0092efb3b18_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Users\Admin\AppData\Local\Temp\.vaultd-673558502
  C:\Users\Admin\AppData\Local\Temp\.vaultd-673558502
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  PID:3544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.vaultd-673558502

Path C:\Users\Admin\AppData\Local\Temp\.vaultd-673558502
Size 9.5MB
SHA256 9ccbc229f29b6fd7322aeac8e360e8f8a67bd1ba56fb428ada9c66a9988e7540
MD5 98d6a3b138570bd54332fb4832b36edf
SHA1 e8ccbf98360bb6e4560a29c8dcd088f759a11cf1
SHA512 250f9edf00cb29bb6eed809f9bea19edf4ad33c7b5acf2e3ed91e48f220b9c6ea53d181fb76e785891af3374a81e463086f779de3ffc2b8663172893f9669b03
SSDEEP 98304:pP4jbJFBikmGgMFt9OiwvAChE9MllZCC:pP4jb0oguLOiwv/i9MkC
TLSH
T1B5A62953E8E60894D4FDC2B199368226A971781D0B3933EF57A1FB302F327E15A76B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing