02e90a8321fffd0c45e88bcb8aec3839c5971eb3ded89dd9e44960ef48c95564

General

Target
2026-07-08_6f1f9815b3fc3b3dfdc77f57273aedac_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe
Size 13.5MB
Sample260708-e54jtsbw4k
SHA256 02e90a8321fffd0c45e88bcb8aec3839c5971eb3ded89dd9e44960ef48c95564
MD5 6f1f9815b3fc3b3dfdc77f57273aedac
SHA1 a939c1559eb3f942d441d5cc649bb7820cfc8470
SHA512 2507da63962ee3c9f57b86e7c1d20a29f41681fa84db58433174412995c25e0bb014fc1ad33b73eda5bcf81673880c87b8528b0727d0768d1c531eca927e6367
SSDEEP 196608:XeNSE051muG/pNUJB0HXZ2vM8zfz94hnJY5igsG4ho74Q:XeNSr1gnSVvMCfWhJtG4ho7z
TLSH
T1ABE6BF07EC9515E9C4AEE234CA229253BA717C496B3173D72B90F7282F77BD06A79700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

Disable or Modify System Firewall

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RemoteX = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-08_6f1f9815b3fc3b3dfdc77f57273aedac_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe"	2026-07-08_6f1f9815b3fc3b3dfdc77f57273aedac_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

GoLang User-Agent 9 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2980	2026-07-08_6f1f9815b3fc3b3dfdc77f57273aedac_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2980	2026-07-08_6f1f9815b3fc3b3dfdc77f57273aedac_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 1992	2980	2026-07-08_6f1f9815b3fc3b3dfdc77f57273aedac_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe	87
PID 2980 wrote to memory of 596	2980	2026-07-08_6f1f9815b3fc3b3dfdc77f57273aedac_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe	89
PID 2980 wrote to memory of 4204	2980	2026-07-08_6f1f9815b3fc3b3dfdc77f57273aedac_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-08_6f1f9815b3fc3b3dfdc77f57273aedac_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe
C:\Users\Admin\AppData\Local\Temp\2026-07-08_6f1f9815b3fc3b3dfdc77f57273aedac_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe
1⤵
PID:312