ac9915e3599ffb83a878fab7994d79831bd8944c2d5ea99348b62beec7fe313d

Analysis

max time kernel
150s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_cf0be74210c2a8315f793b96f660e5a5_coinminer_dosia_frostygoop_hive_knight_luca-stealer_poet.exe
Size 15.7MB
Sample260708-vb7bmadz8v
SHA256 ac9915e3599ffb83a878fab7994d79831bd8944c2d5ea99348b62beec7fe313d
MD5 cf0be74210c2a8315f793b96f660e5a5
SHA1 8132cead17616994a74dc741dcbcc66ded3d7855
SHA512 2768efee9ff2fb39bb21c7456750762d27482be9b384c0bf9e435dfe48cda31102093c6a971245603ff00d5f244e81312a1731cf2437ca5674fa5ca9b65ccb9c
SSDEEP 98304:pHCFCYBz/ZHy5R8oLEdFtBL3S1fOZua8TbC3dB6+v3NgscLUpBvEZ+WT6FpOrz:dQz07LEdFfrS12guBNGJZ
TLSH
T1E3F62947E8E60894D4BDC2B586398226F971785C0B3973DB5B90BB341F337E15ABAB40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence spyware stealer trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	reg.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	reg.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	reg.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	reg.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	reg.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NVDisplay.Container.lnk	NVDisplay.Container.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NVDisplay.Container.lnk	2026-07-08_cf0be74210c2a8315f793b96f660e5a5_coinminer_dosia_frostygoop_hive_knight_luca-stealer_poet.exe

Executes dropped EXE 1 IoCs

pid	Process
2960	NVDisplay.Container.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000\Software\Microsoft\Windows\CurrentVersion\Run\NVDisplay.ContainerLocalSystem = "\"C:\\Users\\Admin\\AppData\\Roaming\\NVIDIA\\NVDisplay.Container.exe\""	2026-07-08_cf0be74210c2a8315f793b96f660e5a5_coinminer_dosia_frostygoop_hive_knight_luca-stealer_poet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000\Software\Microsoft\Windows\CurrentVersion\Run\NVDisplay.ContainerLocalSystem = "\"C:\\Users\\Admin\\AppData\\Roaming\\NVIDIA\\NVDisplay.Container.exe\""	NVDisplay.Container.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
1	ip-api.com
2	api.ipify.org
5	api.ipify.org

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
5824	tasklist.exe
1984	tasklist.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3324	PING.EXE

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3468	wmic.exe
3996	wmic.exe

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	3	Go-http-client/1.1
HTTP User-Agent header	6	Go-http-client/1.1

Kills process with taskkill 16 IoCs

defense_evasion

pid	Process
4920	taskkill.exe
1168	taskkill.exe
4292	taskkill.exe
5844	taskkill.exe
4460	taskkill.exe
624	taskkill.exe
1744	taskkill.exe
5608	taskkill.exe
1052	taskkill.exe
2216	taskkill.exe
4164	taskkill.exe
4200	taskkill.exe
2696	taskkill.exe
1884	taskkill.exe
5676	taskkill.exe
2536	taskkill.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
2196	reg.exe
2328	reg.exe
3972	reg.exe
120	reg.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B	NVDisplay.Container.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 0f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f335090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda7f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997e00000001000000080000000080826f22e7dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b2000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	NVDisplay.Container.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 19000000010000001000000021d008b47b7a2a81c8435903ded424c903000000010000001400000047beabc922eae80e78783462a79f45c254fde68b7e00000001000000080000000080826f22e7dc011d000000010000001000000070253fbcbde32a014d38c1993098ad991400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde7f0000000100000016000000301406082b0601050507030306082b0601050507030462000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda53000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f3352000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	NVDisplay.Container.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 6b000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda0f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f335090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda7f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997e00000001000000080000000080826f22e7dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b19000000010000001000000021d008b47b7a2a81c8435903ded424c92000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	NVDisplay.Container.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 5c00000001000000040000000008000019000000010000001000000021d008b47b7a2a81c8435903ded424c903000000010000001400000047beabc922eae80e78783462a79f45c254fde68b7e00000001000000080000000080826f22e7dc011d000000010000001000000070253fbcbde32a014d38c1993098ad991400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde7f0000000100000016000000301406082b0601050507030306082b0601050507030462000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda53000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f3356b000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda2000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	NVDisplay.Container.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3324	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3900	schtasks.exe
4784	schtasks.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
5020	wmic.exe
5020	wmic.exe
5020	wmic.exe
5020	wmic.exe
3468	wmic.exe
3468	wmic.exe
3468	wmic.exe
3468	wmic.exe
3916	wmic.exe
3916	wmic.exe
3916	wmic.exe
3916	wmic.exe
5672	wmic.exe
5672	wmic.exe
5672	wmic.exe
5672	wmic.exe
5244	wmic.exe
5244	wmic.exe
5244	wmic.exe
5244	wmic.exe
3996	wmic.exe
3996	wmic.exe
3996	wmic.exe
3996	wmic.exe
4484	wmic.exe
4484	wmic.exe
4484	wmic.exe
4484	wmic.exe
4168	wmic.exe
4168	wmic.exe
4168	wmic.exe
4168	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5824	tasklist.exe
Token: SeDebugPrivilege	4920	taskkill.exe
Token: SeDebugPrivilege	1168	taskkill.exe
Token: SeDebugPrivilege	1052	taskkill.exe
Token: SeDebugPrivilege	2216	taskkill.exe
Token: SeDebugPrivilege	2696	taskkill.exe
Token: SeDebugPrivilege	4292	taskkill.exe
Token: SeDebugPrivilege	4460	taskkill.exe
Token: SeDebugPrivilege	624	taskkill.exe
Token: SeDebugPrivilege	1984	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5020	wmic.exe
Token: SeSecurityPrivilege	5020	wmic.exe
Token: SeTakeOwnershipPrivilege	5020	wmic.exe
Token: SeLoadDriverPrivilege	5020	wmic.exe
Token: SeSystemProfilePrivilege	5020	wmic.exe
Token: SeSystemtimePrivilege	5020	wmic.exe
Token: SeProfSingleProcessPrivilege	5020	wmic.exe
Token: SeIncBasePriorityPrivilege	5020	wmic.exe
Token: SeCreatePagefilePrivilege	5020	wmic.exe
Token: SeBackupPrivilege	5020	wmic.exe
Token: SeRestorePrivilege	5020	wmic.exe
Token: SeShutdownPrivilege	5020	wmic.exe
Token: SeDebugPrivilege	5020	wmic.exe
Token: SeSystemEnvironmentPrivilege	5020	wmic.exe
Token: SeRemoteShutdownPrivilege	5020	wmic.exe
Token: SeUndockPrivilege	5020	wmic.exe
Token: SeManageVolumePrivilege	5020	wmic.exe
Token: 33	5020	wmic.exe
Token: 34	5020	wmic.exe
Token: 35	5020	wmic.exe
Token: 36	5020	wmic.exe
Token: SeIncreaseQuotaPrivilege	5020	wmic.exe
Token: SeSecurityPrivilege	5020	wmic.exe
Token: SeTakeOwnershipPrivilege	5020	wmic.exe
Token: SeLoadDriverPrivilege	5020	wmic.exe
Token: SeSystemProfilePrivilege	5020	wmic.exe
Token: SeSystemtimePrivilege	5020	wmic.exe
Token: SeProfSingleProcessPrivilege	5020	wmic.exe
Token: SeIncBasePriorityPrivilege	5020	wmic.exe
Token: SeCreatePagefilePrivilege	5020	wmic.exe
Token: SeBackupPrivilege	5020	wmic.exe
Token: SeRestorePrivilege	5020	wmic.exe
Token: SeShutdownPrivilege	5020	wmic.exe
Token: SeDebugPrivilege	5020	wmic.exe
Token: SeSystemEnvironmentPrivilege	5020	wmic.exe
Token: SeRemoteShutdownPrivilege	5020	wmic.exe
Token: SeUndockPrivilege	5020	wmic.exe
Token: SeManageVolumePrivilege	5020	wmic.exe
Token: 33	5020	wmic.exe
Token: 34	5020	wmic.exe
Token: 35	5020	wmic.exe
Token: 36	5020	wmic.exe
Token: SeIncreaseQuotaPrivilege	3468	wmic.exe
Token: SeSecurityPrivilege	3468	wmic.exe
Token: SeTakeOwnershipPrivilege	3468	wmic.exe
Token: SeLoadDriverPrivilege	3468	wmic.exe
Token: SeSystemProfilePrivilege	3468	wmic.exe
Token: SeSystemtimePrivilege	3468	wmic.exe
Token: SeProfSingleProcessPrivilege	3468	wmic.exe
Token: SeIncBasePriorityPrivilege	3468	wmic.exe
Token: SeCreatePagefilePrivilege	3468	wmic.exe
Token: SeBackupPrivilege	3468	wmic.exe
Token: SeRestorePrivilege	3468	wmic.exe
Token: SeShutdownPrivilege	3468	wmic.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 2196	4576	2026-07-08_cf0be74210c2a8315f793b96f660e5a5_coinminer_dosia_frostygoop_hive_knight_luca-stealer_poet.exe	88
PID 4576 wrote to memory of 2328	4576	2026-07-08_cf0be74210c2a8315f793b96f660e5a5_coinminer_dosia_frostygoop_hive_knight_luca-stealer_poet.exe	90
PID 4576 wrote to memory of 4484	4576	2026-07-08_cf0be74210c2a8315f793b96f660e5a5_coinminer_dosia_frostygoop_hive_knight_luca-stealer_poet.exe	92
PID 4576 wrote to memory of 5292	4576	2026-07-08_cf0be74210c2a8315f793b96f660e5a5_coinminer_dosia_frostygoop_hive_knight_luca-stealer_poet.exe	94
PID 4576 wrote to memory of 5824	4576	2026-07-08_cf0be74210c2a8315f793b96f660e5a5_coinminer_dosia_frostygoop_hive_knight_luca-stealer_poet.exe	96
PID 4576 wrote to memory of 3900	4576	2026-07-08_cf0be74210c2a8315f793b96f660e5a5_coinminer_dosia_frostygoop_hive_knight_luca-stealer_poet.exe	99
PID 4576 wrote to memory of 4920	4576	2026-07-08_cf0be74210c2a8315f793b96f660e5a5_coinminer_dosia_frostygoop_hive_knight_luca-stealer_poet.exe	101
PID 4576 wrote to memory of 1168	4576	2026-07-08_cf0be74210c2a8315f793b96f660e5a5_coinminer_dosia_frostygoop_hive_knight_luca-stealer_poet.exe	103
PID 4576 wrote to memory of 1052	4576	2026-07-08_cf0be74210c2a8315f793b96f660e5a5_coinminer_dosia_frostygoop_hive_knight_luca-stealer_poet.exe	105
PID 4576 wrote to memory of 2216	4576	2026-07-08_cf0be74210c2a8315f793b96f660e5a5_coinminer_dosia_frostygoop_hive_knight_luca-stealer_poet.exe	107
PID 4576 wrote to memory of 2696	4576	2026-07-08_cf0be74210c2a8315f793b96f660e5a5_coinminer_dosia_frostygoop_hive_knight_luca-stealer_poet.exe	110
PID 4576 wrote to memory of 4292	4576	2026-07-08_cf0be74210c2a8315f793b96f660e5a5_coinminer_dosia_frostygoop_hive_knight_luca-stealer_poet.exe	112
PID 2960 wrote to memory of 3972	2960	NVDisplay.Container.exe	115
PID 4576 wrote to memory of 4460	4576	2026-07-08_cf0be74210c2a8315f793b96f660e5a5_coinminer_dosia_frostygoop_hive_knight_luca-stealer_poet.exe	117
PID 2960 wrote to memory of 120	2960	NVDisplay.Container.exe	119
PID 4576 wrote to memory of 624	4576	2026-07-08_cf0be74210c2a8315f793b96f660e5a5_coinminer_dosia_frostygoop_hive_knight_luca-stealer_poet.exe	121
PID 2960 wrote to memory of 3016	2960	NVDisplay.Container.exe	123
PID 2960 wrote to memory of 3376	2960	NVDisplay.Container.exe	125
PID 2960 wrote to memory of 1984	2960	NVDisplay.Container.exe	127
PID 4576 wrote to memory of 5020	4576	2026-07-08_cf0be74210c2a8315f793b96f660e5a5_coinminer_dosia_frostygoop_hive_knight_luca-stealer_poet.exe	129
PID 4576 wrote to memory of 3468	4576	2026-07-08_cf0be74210c2a8315f793b96f660e5a5_coinminer_dosia_frostygoop_hive_knight_luca-stealer_poet.exe	131
PID 4576 wrote to memory of 3916	4576	2026-07-08_cf0be74210c2a8315f793b96f660e5a5_coinminer_dosia_frostygoop_hive_knight_luca-stealer_poet.exe	133
PID 4576 wrote to memory of 5672	4576	2026-07-08_cf0be74210c2a8315f793b96f660e5a5_coinminer_dosia_frostygoop_hive_knight_luca-stealer_poet.exe	135
PID 2960 wrote to memory of 4784	2960	NVDisplay.Container.exe	137
PID 2960 wrote to memory of 1744	2960	NVDisplay.Container.exe	139
PID 2960 wrote to memory of 1884	2960	NVDisplay.Container.exe	141
PID 2960 wrote to memory of 5676	2960	NVDisplay.Container.exe	143
PID 4576 wrote to memory of 3648	4576	2026-07-08_cf0be74210c2a8315f793b96f660e5a5_coinminer_dosia_frostygoop_hive_knight_luca-stealer_poet.exe	145
PID 3648 wrote to memory of 2424	3648	cmd.exe	147
PID 2960 wrote to memory of 4164	2960	NVDisplay.Container.exe	149
PID 2424 wrote to memory of 3324	2424	cmd.exe	151
PID 2960 wrote to memory of 5608	2960	NVDisplay.Container.exe	152
PID 2960 wrote to memory of 2536	2960	NVDisplay.Container.exe	154
PID 2960 wrote to memory of 4200	2960	NVDisplay.Container.exe	156
PID 2960 wrote to memory of 5844	2960	NVDisplay.Container.exe	158
PID 2960 wrote to memory of 5244	2960	NVDisplay.Container.exe	160
PID 2960 wrote to memory of 3996	2960	NVDisplay.Container.exe	162
PID 2960 wrote to memory of 4484	2960	NVDisplay.Container.exe	164
PID 2960 wrote to memory of 4168	2960	NVDisplay.Container.exe	166

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-08_cf0be74210c2a8315f793b96f660e5a5_coinminer_dosia_frostygoop_hive_knight_luca-stealer_poet.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_cf0be74210c2a8315f793b96f660e5a5_coinminer_dosia_frostygoop_hive_knight_luca-stealer_poet.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Windows\system32\reg.exe
  reg query HKLM\HARDWARE\ACPI\DSDT\VBOX__
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Modifies registry key
  PID:2196
- C:\Windows\system32\reg.exe
  reg query HKLM\HARDWARE\ACPI\FADT\VBOX__
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Modifies registry key
  PID:2328
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  PID:4484
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
  2⤵
  - Looks for VMWare Tools registry key
  PID:5292
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5824
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn NvTelemetryContainer /tr \"C:\Users\Admin\AppData\Roaming\NVIDIA\NVDisplay.Container.exe\" /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3900
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4920
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM msedge.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1168
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM brave.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1052
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM opera.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2216
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM vivaldi.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM yandex.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4292
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM torch.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4460
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:624
- C:\Windows\System32\Wbem\wmic.exe
  wmic cpu get Name
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5020
- C:\Windows\System32\Wbem\wmic.exe
  wmic path Win32_VideoController get Name
  2⤵
  - Detects videocard installed
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3468
- C:\Windows\System32\Wbem\wmic.exe
  wmic OS get TotalVisibleMemorySize
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3916
- C:\Windows\System32\Wbem\wmic.exe
  wmic OS get Caption
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5672
- C:\Windows\system32\cmd.exe
  cmd /c start /min "" C:\Users\Admin\AppData\Local\Temp\gs_cleanup.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\gs_cleanup.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2424
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 3
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3324

C:\Users\Admin\AppData\Roaming\NVIDIA\NVDisplay.Container.exe
"C:\Users\Admin\AppData\Roaming\NVIDIA\NVDisplay.Container.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\system32\reg.exe
  reg query HKLM\HARDWARE\ACPI\DSDT\VBOX__
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Modifies registry key
  PID:3972
- C:\Windows\system32\reg.exe
  reg query HKLM\HARDWARE\ACPI\FADT\VBOX__
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Modifies registry key
  PID:120
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  PID:3016
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
  2⤵
  - Looks for VMWare Tools registry key
  PID:3376
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1984
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn NvTelemetryContainer /tr \"C:\Users\Admin\AppData\Roaming\NVIDIA\NVDisplay.Container.exe\" /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4784
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM chrome.exe
  2⤵
  - Kills process with taskkill
  PID:1744
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM msedge.exe
  2⤵
  - Kills process with taskkill
  PID:1884
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM brave.exe
  2⤵
  - Kills process with taskkill
  PID:5676
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM opera.exe
  2⤵
  - Kills process with taskkill
  PID:4164
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM vivaldi.exe
  2⤵
  - Kills process with taskkill
  PID:5608
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM yandex.exe
  2⤵
  - Kills process with taskkill
  PID:2536
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM torch.exe
  2⤵
  - Kills process with taskkill
  PID:4200
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM firefox.exe
  2⤵
  - Kills process with taskkill
  PID:5844
- C:\Windows\System32\Wbem\wmic.exe
  wmic cpu get Name
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5244
- C:\Windows\System32\Wbem\wmic.exe
  wmic path Win32_VideoController get Name
  2⤵
  - Detects videocard installed
  - Suspicious behavior: EnumeratesProcesses
  PID:3996
- C:\Windows\System32\Wbem\wmic.exe
  wmic OS get TotalVisibleMemorySize
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4484
- C:\Windows\System32\Wbem\wmic.exe
  wmic OS get Caption
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gs_cleanup.bat

Path C:\Users\Admin\AppData\Local\Temp\gs_cleanup.bat
Size 252B
SHA256 321cfca7b16bef35d6cfde55b6004ad31e80fed0955c9a2f14a3c559bbf22fe7
MD5 077cb373bd31ea6c5c2278018b7f0cce
SHA1 cf64f4dc1df4aba272cfb415c8b4e75c01fea23a
SHA512 dba2932699f1b30ce5c54d274a97467b936c41974ccac1b420d04b9f3534153620322283a84b88720beb1d597dbe5755a36107de80c181e97362e6c4bfafc608
TLSH
T1D1D0970AA18EDBB40002321B41EA104C80889DCE3F012693C30281FF918B4BEF9D23E1
MD5 SHA1 SHA512 TLSH

Submit Download

NVDisplay.Container.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NVDisplay.Container.lnk
Size 183B
SHA256 bc58fc08e1b8ac1d68897237405a57591d261ca9f5fdcfb881d94dbe8fcc6d0c
MD5 782a571dbabe996fab84fcce939d87c5
SHA1 27c0bcf6cc9aa2ae36c16d2a6369e88b249ebf1a
SHA512 193c43a7aa5ed172180e09384f926acfafbd36e6805dd5d47aecf19ab9ea537e38aad528518940e4e7bdc46fb7beb33c30c218ec65cd2ae336d3006b768991fd
TLSH
T14CC0125423CBCFFCD405823607B62B4CCE30DA043F883B095716E05E9A72540E85291D
MD5 SHA1 SHA512 TLSH

Submit Download

NVDisplay.Container.exe

Path C:\Users\Admin\AppData\Roaming\NVIDIA\NVDisplay.Container.exe
Size 15.7MB
SHA256 ac9915e3599ffb83a878fab7994d79831bd8944c2d5ea99348b62beec7fe313d
MD5 cf0be74210c2a8315f793b96f660e5a5
SHA1 8132cead17616994a74dc741dcbcc66ded3d7855
SHA512 2768efee9ff2fb39bb21c7456750762d27482be9b384c0bf9e435dfe48cda31102093c6a971245603ff00d5f244e81312a1731cf2437ca5674fa5ca9b65ccb9c
SSDEEP 98304:pHCFCYBz/ZHy5R8oLEdFtBL3S1fOZua8TbC3dB6+v3NgscLUpBvEZ+WT6FpOrz:dQz07LEdFfrS12guBNGJZ
TLSH
T1E3F62947E8E60894D4BDC2B586398226F971785C0B3973DB5B90BB341F337E15ABAB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download