34ad97945a1f70cdbf8af7777a6c71c990d841840cf3c94a387f6cc83450ad4b

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 11.3MB
Sample260708-e9yjdabx2q
SHA256 34ad97945a1f70cdbf8af7777a6c71c990d841840cf3c94a387f6cc83450ad4b
MD5 50cf5b4eb0b43d08455a381b05f4a4d3
SHA1 63000ff3aa0958801d3549446c7853f0d0223bcf
SHA512 327fca67c87a87a92b5b109ea32fefe4fcf786259a14096d5d92f2791c3dbe5b007f032d4f08a6e665302221887dda471bfcb3a6985f8eb30e2374ec89ebb75e
SSDEEP 98304:7r92T1ylvBQ8cCdFGp24tpXMwOHzO6iMwESD:7x2TAhy8cbQzMa
TLSH
T125C63A47E8A145E8C0AEE535CA629213BE717C885B3423D72B50F7643F36BD0AEB9714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution impact ransomware spyware stealer

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	api.ipify.org
12	api.ipify.org
15	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
984	powershell.exe
2940	powershell.exe
2508	powershell.exe
2888	powershell.exe
3488	powershell.exe
3680	powershell.exe
4352	powershell.exe
4388	powershell.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4104	systeminfo.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4624	vssadmin.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
548	taskkill.exe

Modifies registry key 1 TTPs 6 IoCs

Modify Registry

T1112

pid	Process
1172	reg.exe
4120	reg.exe
2952	reg.exe
3432	reg.exe
4768	reg.exe
3424	reg.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
984	powershell.exe
984	powershell.exe
2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
2940	powershell.exe
2940	powershell.exe
2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
2508	powershell.exe
2508	powershell.exe
2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
2888	powershell.exe
2888	powershell.exe
2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
3488	powershell.exe
3488	powershell.exe
3680	powershell.exe
3680	powershell.exe
4352	powershell.exe
4352	powershell.exe
2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
4388	powershell.exe
4388	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	984	powershell.exe
Token: SeIncreaseQuotaPrivilege	984	powershell.exe
Token: SeSecurityPrivilege	984	powershell.exe
Token: SeTakeOwnershipPrivilege	984	powershell.exe
Token: SeLoadDriverPrivilege	984	powershell.exe
Token: SeSystemProfilePrivilege	984	powershell.exe
Token: SeSystemtimePrivilege	984	powershell.exe
Token: SeProfSingleProcessPrivilege	984	powershell.exe
Token: SeIncBasePriorityPrivilege	984	powershell.exe
Token: SeCreatePagefilePrivilege	984	powershell.exe
Token: SeBackupPrivilege	984	powershell.exe
Token: SeRestorePrivilege	984	powershell.exe
Token: SeShutdownPrivilege	984	powershell.exe
Token: SeDebugPrivilege	984	powershell.exe
Token: SeSystemEnvironmentPrivilege	984	powershell.exe
Token: SeRemoteShutdownPrivilege	984	powershell.exe
Token: SeUndockPrivilege	984	powershell.exe
Token: SeManageVolumePrivilege	984	powershell.exe
Token: 33	984	powershell.exe
Token: 34	984	powershell.exe
Token: 35	984	powershell.exe
Token: 36	984	powershell.exe
Token: SeBackupPrivilege	4488	vssvc.exe
Token: SeRestorePrivilege	4488	vssvc.exe
Token: SeAuditPrivilege	4488	vssvc.exe
Token: SeDebugPrivilege	2940	powershell.exe
Token: SeIncreaseQuotaPrivilege	2940	powershell.exe
Token: SeSecurityPrivilege	2940	powershell.exe
Token: SeTakeOwnershipPrivilege	2940	powershell.exe
Token: SeLoadDriverPrivilege	2940	powershell.exe
Token: SeSystemProfilePrivilege	2940	powershell.exe
Token: SeSystemtimePrivilege	2940	powershell.exe
Token: SeProfSingleProcessPrivilege	2940	powershell.exe
Token: SeIncBasePriorityPrivilege	2940	powershell.exe
Token: SeCreatePagefilePrivilege	2940	powershell.exe
Token: SeBackupPrivilege	2940	powershell.exe
Token: SeRestorePrivilege	2940	powershell.exe
Token: SeShutdownPrivilege	2940	powershell.exe
Token: SeDebugPrivilege	2940	powershell.exe
Token: SeSystemEnvironmentPrivilege	2940	powershell.exe
Token: SeRemoteShutdownPrivilege	2940	powershell.exe
Token: SeUndockPrivilege	2940	powershell.exe
Token: SeManageVolumePrivilege	2940	powershell.exe
Token: 33	2940	powershell.exe
Token: 34	2940	powershell.exe
Token: 35	2940	powershell.exe
Token: 36	2940	powershell.exe
Token: SeDebugPrivilege	2508	powershell.exe
Token: SeDebugPrivilege	2888	powershell.exe
Token: SeDebugPrivilege	3488	powershell.exe
Token: SeDebugPrivilege	3680	powershell.exe
Token: SeDebugPrivilege	4352	powershell.exe
Token: SeIncreaseQuotaPrivilege	4352	powershell.exe
Token: SeSecurityPrivilege	4352	powershell.exe
Token: SeTakeOwnershipPrivilege	4352	powershell.exe
Token: SeLoadDriverPrivilege	4352	powershell.exe
Token: SeSystemProfilePrivilege	4352	powershell.exe
Token: SeSystemtimePrivilege	4352	powershell.exe
Token: SeProfSingleProcessPrivilege	4352	powershell.exe
Token: SeIncBasePriorityPrivilege	4352	powershell.exe
Token: SeCreatePagefilePrivilege	4352	powershell.exe
Token: SeBackupPrivilege	4352	powershell.exe
Token: SeRestorePrivilege	4352	powershell.exe
Token: SeShutdownPrivilege	4352	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 984	2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	84
PID 2692 wrote to memory of 2940	2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	90
PID 2692 wrote to memory of 4104	2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	93
PID 2692 wrote to memory of 2508	2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	97
PID 2692 wrote to memory of 2888	2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	101
PID 2692 wrote to memory of 3488	2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	104
PID 2692 wrote to memory of 3680	2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	106
PID 2692 wrote to memory of 4352	2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	108
PID 2692 wrote to memory of 3336	2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	111
PID 2692 wrote to memory of 548	2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	113
PID 2692 wrote to memory of 1172	2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	115
PID 2692 wrote to memory of 4120	2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	116
PID 2692 wrote to memory of 2952	2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	118
PID 2692 wrote to memory of 3432	2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	119
PID 2692 wrote to memory of 4768	2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	123
PID 2692 wrote to memory of 3424	2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	125
PID 2692 wrote to memory of 4388	2692	2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	127
PID 4388 wrote to memory of 4624	4388	powershell.exe	129

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Invoke-CimMethod -ClassName Win32_ShadowCopy -MethodName Create -Arguments @{Volume=\"C:\\\"; Context=\"ClientAccessible\"}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-CimInstance Win32_ShadowCopy | Where-Object { $_.ID -eq '{DFCA8E4B-594D-41D3-BD46-A9FFAF77FF92}' } | Select-Object -ExpandProperty DeviceObject"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2940
- C:\Windows\system32\systeminfo.exe
  systeminfo
  2⤵
  - Gathers system information
  PID:4104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-WmiObject Win32_Processor | Select-Object -ExpandProperty Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-WmiObject Win32_Processor | Select-Object -ExpandProperty NumberOfCores"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-WmiObject Win32_VideoController | Select-Object -ExpandProperty Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-WmiObject Win32_OperatingSystem | Select-Object -ExpandProperty TotalVisibleMemorySize"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-CimInstance Win32_VideoController | Where-Object { $_.CurrentHorizontalResolution -gt 0 -and $_.CurrentVerticalResolution -gt 0 } | Select-Object Name, CurrentHorizontalResolution, CurrentVerticalResolution, CurrentRefreshRate, DeviceID | ConvertTo-Json"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4352
- C:\Windows\system32\curl.exe
  curl -s http://ip-api.com/json/85.203.46.153
  2⤵
  PID:3336
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM ms-teams.exe
  2⤵
  - Kills process with taskkill
  PID:548
- C:\Windows\system32\reg.exe
  reg query HKCU\Software\TigerVNC\WinVNC4 /v Password
  2⤵
  - Modifies registry key
  PID:1172
- C:\Windows\system32\reg.exe
  reg query HKCU\Software\TightVNC\Server /v ControlPassword
  2⤵
  - Modifies registry key
  PID:4120
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\RealVNC\vncserver /v Password
  2⤵
  - Modifies registry key
  PID:2952
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\TightVNC\Server /v Password
  2⤵
  - Modifies registry key
  PID:3432
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\TightVNC\Server /v ControlPassword
  2⤵
  - Modifies registry key
  PID:4768
- C:\Windows\system32\reg.exe
  reg query HKCU\Software\TightVNC\Server /v Password
  2⤵
  - Modifies registry key
  PID:3424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "vssadmin delete shadows /shadow=\"{DFCA8E4B-594D-41D3-BD46-A9FFAF77FF92}\" /quiet"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Windows\system32\vssadmin.exe
    "C:\Windows\system32\vssadmin.exe" delete shadows /shadow={DFCA8E4B-594D-41D3-BD46-A9FFAF77FF92} /quiet
    3⤵
    - Interacts with shadow copies
    PID:4624

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4488

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4080

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...