8f76b0492179be7eaa324b16a978e62f5c451b29dfa668cddced41d36f3f3cc9

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 00:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_7fc5f6719a4b5c9e245c3555bdf83998_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
Size 1.9MB
Sample260711-a77xtab19w
SHA256 8f76b0492179be7eaa324b16a978e62f5c451b29dfa668cddced41d36f3f3cc9
MD5 7fc5f6719a4b5c9e245c3555bdf83998
SHA1 e0e0cf417a2867463fa4832480123fe53a6683ab
SHA512 3133d1e040bc8e41a1b6cc457e56494eb4623d6032617355df918d7519c0e1285e563e530c1b8337d5f5f097f6f93e613839629c9aa59cf080385030e8ad4f04
SSDEEP 49152:00MDpF0egrb/TxvO90d7HjmAFd4A64nsfJCew2r5gCYPCBgwiz1xuvbhxito:vean14bhxito
TLSH
T1A8956A07BC9155B9C4AAD23289665292BB71BC980F3123D73B50B3F82FB27D45E3A354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4868	cmd.exe
3800	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3800	PING.EXE

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5492	2026-07-10_7fc5f6719a4b5c9e245c3555bdf83998_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5492 wrote to memory of 4868	5492	2026-07-10_7fc5f6719a4b5c9e245c3555bdf83998_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe	87
PID 4868 wrote to memory of 3800	4868	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-10_7fc5f6719a4b5c9e245c3555bdf83998_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_7fc5f6719a4b5c9e245c3555bdf83998_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5492
- C:\Windows\system32\cmd.exe
  cmd /c "ping 127.0.0.1 -n 2 > nul & del \"C:\Users\Admin\AppData\Local\Temp\2026-07-10_7fc5f6719a4b5c9e245c3555bdf83998_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe.tmp\""
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5492-1-0x00000000000A0000-0x00000000002A3000-memory.dmp

Download