ca2bf305f6ab3b9f113efed673cce527886f4d3ce91fe7d263f3a593a9b1a022 | Triage™

Login
Reports

Overview

overview

Static

static

2026-07-18...la.exe

windows10-2004-x64

7

2026-07-18...la.exe

windows11-ltsc_2024-x64

7

Analysis

max time kernel
150s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 06:40

Sharing

Copy URL Twitter E-mail

Static task

static1

4 signatures

Behavioral task

behavioral1

Sample

2026-07-18_afc60208e1104033341d79322265f0ab_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

2 signatures

150 seconds

spyware stealer

Behavioral task

behavioral2

Sample

2026-07-18_afc60208e1104033341d79322265f0ab_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

spyware stealer

Report Analysis Logs

General

Target
2026-07-18_afc60208e1104033341d79322265f0ab_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe
Size 12.3MB
Sample260718-he9vpsev9v
SHA256 ca2bf305f6ab3b9f113efed673cce527886f4d3ce91fe7d263f3a593a9b1a022
MD5 afc60208e1104033341d79322265f0ab
SHA1 d48e1c3c41ae21401252792582dbe442264e7686
SHA512 6478938fe82bcfa96205728f42204c42c02dd2d050a09e0a649297fe44ceb52eab1818012fdc90701f6219079223fae5e8f33b66bfdda5de5d674f87bd1ce0d2
SSDEEP 196608:Yw64p8UAnZbVCQpsyHGfvRTAU9oy0PHx1WYPox:myOnZbVC4GfJYywHx0YPU
TLSH
T1C2D67B43E87552A0D2E9C176C676C192BA703C894B3063D37B51FABA2F73BC46A79344
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Processes

C:\Users\Admin\AppData\Local\Temp\2026-07-18_afc60208e1104033341d79322265f0ab_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_afc60208e1104033341d79322265f0ab_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"
1⤵
PID:4852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

© 2018-2026

Terms | Privacy