b3b1b40a09c8b7f32ce5e43675500091e300962130d0a881dca34273ce7ac281

General

Target
2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 10.3MB
Sample260731-jfld6sysdx
SHA256 b3b1b40a09c8b7f32ce5e43675500091e300962130d0a881dca34273ce7ac281
MD5 3eac0ca11847844f7b223a1892bc62b6
SHA1 fb7c537686c19c0fa80ae7e390469afdd46c1b26
SHA512 07255e691d6d875074c494b3d8ba1a69fa50f7456f79f89d0d085b246b335eb9c365533b70fa80c3334912f3e48542e700983ee0a73ed0948ed348b19ab7bec7
SSDEEP 98304:spcJfdWCxfZkerNyYEMwH1ZmN6HV0ewFanjE:sWfWWfZRrzN6HKelw
TLSH
T1A7B63957E87541A5E0AED136C6669163BA713C88CF3863D72B90F7242F72BD06EB9700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
11	ip-api.com

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
3876	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5712	powershell.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	12	Go-http-client/1.1

Kills process with taskkill 6 IoCs

defense_evasion

pid	Process
2416	taskkill.exe
6136	taskkill.exe
936	taskkill.exe
1804	taskkill.exe
5796	taskkill.exe
4524	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5712	powershell.exe
5712	powershell.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	2416	taskkill.exe
Token: SeDebugPrivilege	6136	taskkill.exe
Token: SeDebugPrivilege	936	taskkill.exe
Token: SeDebugPrivilege	1804	taskkill.exe
Token: SeDebugPrivilege	5796	taskkill.exe
Token: SeDebugPrivilege	4524	taskkill.exe
Token: SeDebugPrivilege	5712	powershell.exe
Token: SeIncreaseQuotaPrivilege	5712	powershell.exe
Token: SeSecurityPrivilege	5712	powershell.exe
Token: SeTakeOwnershipPrivilege	5712	powershell.exe
Token: SeLoadDriverPrivilege	5712	powershell.exe
Token: SeSystemProfilePrivilege	5712	powershell.exe
Token: SeSystemtimePrivilege	5712	powershell.exe
Token: SeProfSingleProcessPrivilege	5712	powershell.exe
Token: SeIncBasePriorityPrivilege	5712	powershell.exe
Token: SeCreatePagefilePrivilege	5712	powershell.exe
Token: SeBackupPrivilege	5712	powershell.exe
Token: SeRestorePrivilege	5712	powershell.exe
Token: SeShutdownPrivilege	5712	powershell.exe
Token: SeDebugPrivilege	5712	powershell.exe
Token: SeSystemEnvironmentPrivilege	5712	powershell.exe
Token: SeRemoteShutdownPrivilege	5712	powershell.exe
Token: SeUndockPrivilege	5712	powershell.exe
Token: SeManageVolumePrivilege	5712	powershell.exe
Token: 33	5712	powershell.exe
Token: 34	5712	powershell.exe
Token: 35	5712	powershell.exe
Token: 36	5712	powershell.exe
Token: SeDebugPrivilege	3876	tasklist.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 2416	4832	2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	86
PID 4832 wrote to memory of 6136	4832	2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	89
PID 4832 wrote to memory of 936	4832	2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	91
PID 4832 wrote to memory of 1804	4832	2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	93
PID 4832 wrote to memory of 5796	4832	2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	95
PID 4832 wrote to memory of 4524	4832	2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	97
PID 4832 wrote to memory of 5712	4832	2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	101
PID 4832 wrote to memory of 1720	4832	2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	104
PID 4832 wrote to memory of 1720	4832	2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	104
PID 4832 wrote to memory of 2656	4832	2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	106
PID 4832 wrote to memory of 2656	4832	2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	106
PID 4832 wrote to memory of 4688	4832	2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	110
PID 4832 wrote to memory of 4688	4832	2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	110
PID 4832 wrote to memory of 5516	4832	2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	112
PID 4832 wrote to memory of 5516	4832	2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	112
PID 4832 wrote to memory of 3876	4832	2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2416
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM msedge.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6136
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM brave.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:936
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM opera.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1804
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM vivaldi.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5796
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -c "$kb = try { (Get-WinUserLanguageList | % { $_.LocalizedName }) -join ' / ' } catch { 'Unknown' }; $p = Get-CimInstance Win32_Processor | Select -First 1; \"$kb\"; \"$($p.NumberOfCores)\"; \"$($p.NumberOfLogicalProcessors)\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:1720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:5516
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3876

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4236

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:668

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5696

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5656

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3804

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3576

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

5

T1552

Credentials In Files

4

T1552.001

Credentials in Registry

1

T1552.002

Discovery

Browser Information Discovery

Process Discovery

Query Registry

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Data from Local System

4

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_gzyd0gzl.zdh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gzyd0gzl.zdh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cd_1162543582.db

Path C:\Users\Admin\AppData\Local\Temp\cd_1162543582.db
Size 224KB
SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
MD5 710df06c7732247ac90a924171429a31
SHA1 74ca20f5987e39ea08d3765803fa25a9638eddea
SHA512 446dcaa944760f53b09f2112d434f8436ccaffcd7e6e270f699068161a7113f9c0b71de8f4e634bdccebb2364c6976c818fae12adb83c006fe1cce421a690c02
SSDEEP 192:f+xj3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:2B3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DD24640A7B787001EDE3D9725CB080771E3CA16D8F22A6915DB654694EB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd_2782672283.db

Path C:\Users\Admin\AppData\Local\Temp\cd_2782672283.db
Size 138KB
SHA256 338e96cc3bc89036a4e3297db198bbd06c1f4dc75e236e6833611d3df68e6de7
MD5 22600193ddd961a61cb0e17a73b21620
SHA1 d022b81e72736bd475606191302f06b7bc8c9d82
SHA512 37d341d18376bf3892de164d4d8374a605d52c8e11420ab31c961471f305a9128032b01155b8e7ee756cdb5f9f637f0bd0b34cd5d6cf50788ee4969964b1d57e
SSDEEP 192:9B+XuvBnl3JsueMEGvIW1/rcP2OlDpX6Uyq+UVumLvmwkc:zeuvBnhJsueMEGvIW1DcP2Oj3Vumqnc
TLSH
T160D3884B3A743002EDE59A726CE050BB5E3CB16D4F55A5D428B620688EF2953B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ck_4832_1785483414790564800.bin

Path C:\Users\Admin\AppData\Local\Temp\ck_4832_1785483414790564800.bin
Size 32B
SHA256 c39679e062ad0abe79e4bc9e52091b2237f1ea2be589b2705f6d275935053f03
MD5 8e850aa732cb33a908ddb4a9de7c7801
SHA1 7796d27825176eec715c74288c212f53ac601441
SHA512 f367add8b49d0a697b0fc187a3384139cfdb4ff8d6b28db41114f8c1bfb31474a627275282300eadeb28fb8c35d2b63c0c69da8ae76406a978d3be2bf86472b0
MD5 SHA1 SHA512

Submit Download

ck_4832_1785483415534306500.bin

Path C:\Users\Admin\AppData\Local\Temp\ck_4832_1785483415534306500.bin
Size 32B
SHA256 969f60581aaa9ea773da8dcb56bd63ec82089d1e5e9e464a1978f607db6dcff3
MD5 aa573fafd5927cf33ad571614e47f74b
SHA1 7f1061d88cee462ed161cd9b66760ec0c272ad36
SHA512 b36f429a52226a299d406e04e8838560c60ecf82087cf6a5fcf6b45f3ab9f1670f824f07bd92bbc7e3f1f8240296e622afdff8cdd5c07a27a5a8429872ad0fd3
MD5 SHA1 SHA512

Submit Download

memory/5712-8-0x000001D475100000-0x000001D475122000-memory.dmp

Download

memory/5712-16-0x000001D475600000-0x000001D47562A000-memory.dmp

Download

memory/5712-17-0x000001D475600000-0x000001D475624000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads