Analysis
- max time kernel
149s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
15/07/2026, 23:22
General
- Target 2026-07-15_c3aedaa149a1c1073c9c6564a0a93e8f_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
- Size 12.4MB
- Sample260715-3cvm8abt2t
- SHA256 6c8e5da0d6865bfed4cfb849104a8ebfdb2963d1f03fdbaa9e0fb06deafdc9b2
Malware Config
Signatures
- UPX dump on OEP (original entry point) 19 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 2 IoCs
- UPX packed file 19 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
- Modifies system certificate store 2 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_c3aedaa149a1c1073c9c6564a0a93e8f_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_c3aedaa149a1c1073c9c6564a0a93e8f_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\225400094.exe"C:\Users\Admin\AppData\Local\Temp\225400094.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /End /TN NubyoneAgent3⤵
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /TN NubyoneAgent /XML C:\Users\Admin\AppData\Local\Temp\zc-task-1784157768274171600.xml /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NonInteractive -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing;$s=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds;$bmp=New-Object System.Drawing.Bitmap($s.Width,$s.Height);$g=[System.Drawing.Graphics]::FromImage($bmp);$g.CopyFromScreen($s.Location,[System.Drawing.Point]::Empty,$s.Size);$ms=New-Object System.IO.MemoryStream;$bmp.Save($ms,[System.Drawing.Imaging.ImageFormat]::Jpeg);$g.Dispose();$bmp.Dispose();[Convert]::ToBase64String($ms.ToArray())"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NonInteractive -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing;$s=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds;$bmp=New-Object System.Drawing.Bitmap($s.Width,$s.Height);$g=[System.Drawing.Graphics]::FromImage($bmp);$g.CopyFromScreen($s.Location,[System.Drawing.Point]::Empty,$s.Size);$ms=New-Object System.IO.MemoryStream;$bmp.Save($ms,[System.Drawing.Imaging.ImageFormat]::Jpeg);$g.Dispose();$bmp.Dispose();[Convert]::ToBase64String($ms.ToArray())"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\ProgramData\Nubyone\zc-agent.exeC:\ProgramData\Nubyone\zc-agent.exe1⤵
- Executes dropped EXE
- Modifies trusted root certificate store through registry
- Modifies system certificate store
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
225400094.exe
zc-task-1784157768274171600.xml
memory/2216-35-0x00007FF7665D0000-0x00007FF76982A000-memory.dmp
memory/2216-5-0x00007FF7665D0000-0x00007FF76982A000-memory.dmp
memory/2216-13-0x00007FF7665D0000-0x00007FF76982A000-memory.dmp
memory/2216-43-0x00007FF7665D0000-0x00007FF76982A000-memory.dmp
memory/2216-39-0x00007FF7665D0000-0x00007FF76982A000-memory.dmp
memory/2216-21-0x00007FF7665D0000-0x00007FF76982A000-memory.dmp
memory/2216-37-0x00007FF7665D0000-0x00007FF76982A000-memory.dmp
memory/2216-23-0x00007FF7665D0000-0x00007FF76982A000-memory.dmp
memory/2216-25-0x00007FF7665D0000-0x00007FF76982A000-memory.dmp
memory/2216-31-0x00007FF7665D0000-0x00007FF76982A000-memory.dmp
memory/2216-27-0x00007FF7665D0000-0x00007FF76982A000-memory.dmp
memory/3184-14-0x00000275E9E30000-0x00000275E9E52000-memory.dmp
memory/4200-26-0x00007FF7A2600000-0x00007FF7A585A000-memory.dmp
memory/4200-32-0x00007FF7A2600000-0x00007FF7A585A000-memory.dmp
memory/4200-12-0x00007FF7A2600000-0x00007FF7A585A000-memory.dmp
memory/4200-22-0x00007FF7A2600000-0x00007FF7A585A000-memory.dmp
memory/4200-38-0x00007FF7A2600000-0x00007FF7A585A000-memory.dmp
memory/4200-20-0x00007FF7A2600000-0x00007FF7A585A000-memory.dmp
memory/4200-44-0x00007FF7A2600000-0x00007FF7A585A000-memory.dmp