b3b1b40a09c8b7f32ce5e43675500091e300962130d0a881dca34273ce7ac281

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 07:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 10.3MB
Sample260731-jfld6sysdx
SHA256 b3b1b40a09c8b7f32ce5e43675500091e300962130d0a881dca34273ce7ac281
MD5 3eac0ca11847844f7b223a1892bc62b6
SHA1 fb7c537686c19c0fa80ae7e390469afdd46c1b26
SHA512 07255e691d6d875074c494b3d8ba1a69fa50f7456f79f89d0d085b246b335eb9c365533b70fa80c3334912f3e48542e700983ee0a73ed0948ed348b19ab7bec7
SSDEEP 98304:spcJfdWCxfZkerNyYEMwH1ZmN6HV0ewFanjE:sWfWWfZRrzN6HKelw
TLSH
T1A7B63957E87541A5E0AED136C6669163BA713C88CF3863D72B90F7242F72BD06EB9700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
2	ip-api.com

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
2472	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5944	powershell.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	7	Go-http-client/1.1

Kills process with taskkill 6 IoCs

defense_evasion

pid	Process
2820	taskkill.exe
692	taskkill.exe
4808	taskkill.exe
5476	taskkill.exe
5692	taskkill.exe
4692	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5944	powershell.exe
5944	powershell.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	2820	taskkill.exe
Token: SeDebugPrivilege	692	taskkill.exe
Token: SeDebugPrivilege	4808	taskkill.exe
Token: SeDebugPrivilege	5476	taskkill.exe
Token: SeDebugPrivilege	5692	taskkill.exe
Token: SeDebugPrivilege	4692	taskkill.exe
Token: SeDebugPrivilege	5944	powershell.exe
Token: SeIncreaseQuotaPrivilege	5944	powershell.exe
Token: SeSecurityPrivilege	5944	powershell.exe
Token: SeTakeOwnershipPrivilege	5944	powershell.exe
Token: SeLoadDriverPrivilege	5944	powershell.exe
Token: SeSystemProfilePrivilege	5944	powershell.exe
Token: SeSystemtimePrivilege	5944	powershell.exe
Token: SeProfSingleProcessPrivilege	5944	powershell.exe
Token: SeIncBasePriorityPrivilege	5944	powershell.exe
Token: SeCreatePagefilePrivilege	5944	powershell.exe
Token: SeBackupPrivilege	5944	powershell.exe
Token: SeRestorePrivilege	5944	powershell.exe
Token: SeShutdownPrivilege	5944	powershell.exe
Token: SeDebugPrivilege	5944	powershell.exe
Token: SeSystemEnvironmentPrivilege	5944	powershell.exe
Token: SeRemoteShutdownPrivilege	5944	powershell.exe
Token: SeUndockPrivilege	5944	powershell.exe
Token: SeManageVolumePrivilege	5944	powershell.exe
Token: 33	5944	powershell.exe
Token: 34	5944	powershell.exe
Token: 35	5944	powershell.exe
Token: 36	5944	powershell.exe
Token: SeDebugPrivilege	2472	tasklist.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 2820	1300	2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	89
PID 1300 wrote to memory of 692	1300	2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	92
PID 1300 wrote to memory of 4808	1300	2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	94
PID 1300 wrote to memory of 5476	1300	2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	96
PID 1300 wrote to memory of 5692	1300	2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	98
PID 1300 wrote to memory of 4692	1300	2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	100
PID 1300 wrote to memory of 5944	1300	2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	102
PID 1300 wrote to memory of 1492	1300	2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	106
PID 1300 wrote to memory of 1492	1300	2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	106
PID 1300 wrote to memory of 6032	1300	2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	108
PID 1300 wrote to memory of 6032	1300	2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	108
PID 1300 wrote to memory of 2472	1300	2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_3eac0ca11847844f7b223a1892bc62b6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2820
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM msedge.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:692
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM brave.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4808
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM opera.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5476
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM vivaldi.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5692
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -c "$kb = try { (Get-WinUserLanguageList | % { $_.LocalizedName }) -join ' / ' } catch { 'Unknown' }; $p = Get-CimInstance Win32_Processor | Select -First 1; \"$kb\"; \"$($p.NumberOfCores)\"; \"$($p.NumberOfLogicalProcessors)\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:6032
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2472

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:248

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3544

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3344

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cd_1001572713.db

Path C:\Users\Admin\AppData\Local\Temp\cd_1001572713.db
Size 256KB
SHA256 b0c72944fc5bd02ac464a83ac972277e38d0dbc674f2a634c0d432bf882ef89a
MD5 b9ac2e3133012e6df701783726dd2e73
SHA1 2027d37725c5f18085038027fb7ccb6fc6568a24
SHA512 6fa34bb32da7171c554d4b3b2988e25598427f3f485632cbbecb12a545909563b01ec12a1393d4c3307652eaee787977a88538c639221a43d46d1e49411adc04
SSDEEP 384:K8NTRZyCSDnxTICYMEhIKyll7svbFKfk7:KoNZJSDniwyI1l7svbF9
TLSH
T16544640A7B747001EDE2D9725CB080771E3C616E8F26E6816DB654694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd_3480522209.db

Path C:\Users\Admin\AppData\Local\Temp\cd_3480522209.db
Size 138KB
SHA256 f02d21bc04af97d86c8d1d3849061cb55a03473099b5580aa72b237a245049f3
MD5 a97da95ef79dff7be4a0663616ea1ad4
SHA1 caefd602ee83089faa61d012465b789d1fd019f3
SHA512 f49a37d160dbecb1455db3a96341bd500ead73c40c9263c62c119c860350d38bf1b3d655138114db210224eb4cdca9b2a1bef82957211a082d611dadc33b6578
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2OQKSPkVum8nX:FnbZeMrv/hGtQKenX
TLSH
T195D3864B3A747002EDE59A721CE050BF5E3C716D8F5595D428B620688EF2863B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ck_1300_1785483432736489100.bin

Path C:\Users\Admin\AppData\Local\Temp\ck_1300_1785483432736489100.bin
Size 32B
SHA256 f36926ae958b4bd224c5e4500ee0f457752f38f893b5045d6e2682af03b5bd57
MD5 c241e2acc97537faa1d56bf123f1fcda
SHA1 02c906e34c51faffd6e9e1a8e42776f298afcdd5
SHA512 7ecccff136211c1df33138d5527133a64e14a1331b9e8c9bc69c31a1b3850db2c242bb89ced9f0e3e2cb83f4003819d7a37f25d58b3317071d46ef0370d53707
MD5 SHA1 SHA512

Submit Download

memory/5944-9-0x000001D761FE0000-0x000001D762002000-memory.dmp

Download

memory/5944-12-0x000001D77A2C0000-0x000001D77A2DE000-memory.dmp

Download

memory/5944-13-0x000001D77A340000-0x000001D77A3F2000-memory.dmp

Download

memory/5944-14-0x000001D77A2E0000-0x000001D77A2EA000-memory.dmp

Download

memory/5944-17-0x000001D77A400000-0x000001D77A424000-memory.dmp

Download

memory/5944-16-0x000001D77A400000-0x000001D77A42A000-memory.dmp

Download