5db7b8fcbcf8f4aad23d98067deca0986a04588885712d8b46da58a42d8dfbe3

Analysis

max time kernel
150s
max time network
102s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_09f21486b34aceb615a32c9766e7646e_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
Size 1.8MB
Sample260714-e75vnsgw6y
SHA256 5db7b8fcbcf8f4aad23d98067deca0986a04588885712d8b46da58a42d8dfbe3
MD5 09f21486b34aceb615a32c9766e7646e
SHA1 82524c01ec81094a50c17bc7909592136424b34c
SHA512 4549cbc27503bc4a48a850a5d689f7e1da166914812e93b8d6a18d43092cecf0ec8c568f39dc90873118998b4a8e250b29a7eeb07dcef7e9cbeb37fe7938c73e
SSDEEP 49152:00MDpF0egrb/TxvO90d7HjmAFd4A64nsfJCew2r5gCYPCBgwiz1xuXcvY/uv:vean1wj/m
TLSH
T122956A07BC9554B9C4AAD23189665292BB71BC980F3123DB3B50B3F82FB27D45E3A354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2036	cmd.exe
1256	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1256	PING.EXE

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2712	2026-07-14_09f21486b34aceb615a32c9766e7646e_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 2036	2712	2026-07-14_09f21486b34aceb615a32c9766e7646e_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe	87
PID 2036 wrote to memory of 1256	2036	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-14_09f21486b34aceb615a32c9766e7646e_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_09f21486b34aceb615a32c9766e7646e_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\system32\cmd.exe
  cmd /c "ping 127.0.0.1 -n 2 > nul & del \"C:\Users\Admin\AppData\Local\Temp\2026-07-14_09f21486b34aceb615a32c9766e7646e_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe.tmp\""
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2712-1-0x0000000000420000-0x0000000000623000-memory.dmp

Download