Analysis
- max time kernel
148s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/07/2026, 01:15
Behavioral task
behavioral1
Sample
2026-07-23_698ce57e5f0ecda7b41d2c6c1e7ca177_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_698ce57e5f0ecda7b41d2c6c1e7ca177_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target 2026-07-23_698ce57e5f0ecda7b41d2c6c1e7ca177_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe
- Size 3.9MB
- Sample260724-bmax1s1ard
- SHA256 dce2e5cc00eff2493f8ced546dc51f9d5ef78c5ee56805906ec642dfa77a1c70
- MD5 698ce57e5f0ecda7b41d2c6c1e7ca177
- SHA1 9e9cfecdae356761795f5c5f5655d1ec306e39d6
- SHA512 7c13790548529613884a0086c23d5f5a8eb4f7f1db7cf62d2e49452972992b2fb61ad5c508d46e9b7573804b1ff13fd4be030146b7a250a11b26f0939d1bffb0
- SSDEEP 49152:5qHzah/RgrT4p0wqIst442iZyDIj6qZB9fV4gRhes5E2kT9nwPDC7bODth5yx30G:5qTrtgug+E3TFwPD+8th5
- TLSH T169167B87FCA054F6C0AAA33189B695567A75BC441F3123DB2B90BE782F32BD0AD75710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5536 2026-07-23_698ce57e5f0ecda7b41d2c6c1e7ca177_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe 5536 2026-07-23_698ce57e5f0ecda7b41d2c6c1e7ca177_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe 5536 2026-07-23_698ce57e5f0ecda7b41d2c6c1e7ca177_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe 5536 2026-07-23_698ce57e5f0ecda7b41d2c6c1e7ca177_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5536 wrote to memory of 2584 5536 2026-07-23_698ce57e5f0ecda7b41d2c6c1e7ca177_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_698ce57e5f0ecda7b41d2c6c1e7ca177_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_698ce57e5f0ecda7b41d2c6c1e7ca177_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe"2⤵PID:2584
-