3761f78dc669b7632efbd13b3e79336c9d6c76a70dcb95d56aa6ded024c64f82

Analysis

max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 00:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_200766ed1c786293bbc6b668d29f1664_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
Size 1.9MB
Sample260706-a3fb1agy6x
SHA256 3761f78dc669b7632efbd13b3e79336c9d6c76a70dcb95d56aa6ded024c64f82
MD5 200766ed1c786293bbc6b668d29f1664
SHA1 7c0aadc0af1d78507b75125cf793a6623c2a27d4
SHA512 a81192f52d09943cebdc8287f5e01c53118f7ae9c74e53fa538d8a4b4ac695fae28a5769d1a26f9514e48805d3b451163925b3f17e9c36babe33f221cdb3578d
SSDEEP 49152:00MDpF0egrb/TxvO90d7HjmAFd4A64nsfJCOA2r5gCYPCBgwiz14r:veanI
TLSH
T13A956B07BC9555B9C4AAD2318A665292BB70BC980F3123D73B50B3F82FB27D45E3A354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1432	cmd.exe
2128	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2128	PING.EXE

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1044	2026-07-06_200766ed1c786293bbc6b668d29f1664_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 1432	1044	2026-07-06_200766ed1c786293bbc6b668d29f1664_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe	88
PID 1432 wrote to memory of 2128	1432	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-06_200766ed1c786293bbc6b668d29f1664_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_200766ed1c786293bbc6b668d29f1664_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\system32\cmd.exe
  cmd /c "ping 127.0.0.1 -n 2 > nul & del \"C:\Users\Admin\AppData\Local\Temp\2026-07-06_200766ed1c786293bbc6b668d29f1664_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe.tmp\""
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1044-1-0x0000000000460000-0x0000000000663000-memory.dmp

Download