be089f13ffca418c6f421ed84fe0195ed22a49e1bb59076ae9c5410231ecff7d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 22:24

Target
2026-07-07_f1b69509b91fee4f3adfb7a4ae7cd2dd_cobalt-strike_coinminer_frostygoop_glassworm_hive_luca-s.exe
Size 2.0MB
Sample260707-2bv2xse16w
SHA256 be089f13ffca418c6f421ed84fe0195ed22a49e1bb59076ae9c5410231ecff7d
MD5 f1b69509b91fee4f3adfb7a4ae7cd2dd
SHA1 0a1984dc699c764f017a4febe311bada2c6c6b0d
SHA512 6372261f886f800cb15c9c172ed4cef7b2f1f9a4b7e4ec13e50314a37b1d48e419caf4203597119e5f661c76da0a93cf06410704a4477d3cde568d8bbfbafe9a
SSDEEP 49152:cZ+9/AplIFp/brb/T7vO90d7HjmAFd4A64nsfJU05rlisgCMbgzR44ovrfnz1:5FdV
TLSH
T124A5284BB89541B4C0AEE23589A59252BB307C980F3163D73F50B7B82F72BE85E79354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2820	ld-3040219235.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2820	1680	2026-07-07_f1b69509b91fee4f3adfb7a4ae7cd2dd_cobalt-strike_coinminer_frostygoop_glassworm_hive_luca-s.exe	87
PID 2820 wrote to memory of 3332	2820	ld-3040219235.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-07-07_f1b69509b91fee4f3adfb7a4ae7cd2dd_cobalt-strike_coinminer_frostygoop_glassworm_hive_luca-s.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_f1b69509b91fee4f3adfb7a4ae7cd2dd_cobalt-strike_coinminer_frostygoop_glassworm_hive_luca-s.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Users\Admin\AppData\Local\Temp\ld-3040219235.exe
  C:\Users\Admin\AppData\Local\Temp\ld-3040219235.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\SYSTEM32\cmd.exe
    cmd
    3⤵
    PID:3332

ld-3040219235.exe

Path C:\Users\Admin\AppData\Local\Temp\ld-3040219235.exe
Size 7KB
SHA256 fc48edc8af462db57b91a1031d46b4444d884a1f2073e196e515d25c48cf3032
MD5 d8cb06afc26e1c88e9212e5870a86352
SHA1 a35cd09a95780f0b49c5df57de3f2ada4e17ed26
SHA512 def9ef9790de8301313a963261c3d03d797143b5da694555a1ff0583dd32919e92e0d11991900b923152af088bc3519b3e3deef9f9f6fb0ab44ee75d394ae4f4
SSDEEP 24:ev1GSkiiljETfn9pF9knehtht6dp5raKq9K9qkeNDJSqUmZEWdKCI2vp:qkfj69qnehthEdTE9mSDoqUjWYC
TLSH
T162F132D273111877F6281BBFC283D9A762FEBA303273071A064C00163681E6A3531B83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2820-5-0x0000000140000000-0x0000000140005230-memory.dmp

Download