Overview

overview

7

Static

static

3

2026-08-03...er.exe

windows10-2004-x64

7

2026-08-03...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/08/2026, 02:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_4af10b2dc2838e10b2c1de9549e40a90_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
  • Size 2.4MB
  • Sample260803-c723nsbb75
  • SHA256 09d7546de25d8384ea9abaec4033648e6bc1573d2e8a48994939f86cbfadcca4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasionexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 8 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 8 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_4af10b2dc2838e10b2c1de9549e40a90_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_4af10b2dc2838e10b2c1de9549e40a90_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2580
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\ba8a7da3.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:4488
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn Updateba41ce /tr C:\Users\Admin\AppData\Local\Temp\2026-08-03_4af10b2dc2838e10b2c1de9549e40a90_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:3140
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\9bb76a3e.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:6120
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command " $s = New-Object -comObject WScript.Shell $l = $s.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systema11a3.lnk\") $l.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-08-03_4af10b2dc2838e10b2c1de9549e40a90_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\" $l.Save() "
      2⤵
      • Creates a file in the Startup directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2948
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\b0f8efb1.exe
      2⤵
      • Views/modifies file attributes
      PID:4560
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\83032ec5.exe
      2⤵
      • Views/modifies file attributes
      PID:4148
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_4af10b2dc2838e10b2c1de9549e40a90_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-03_4af10b2dc2838e10b2c1de9549e40a90_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:5788
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn Update5f1caf /tr C:\Users\Admin\AppData\Local\Temp\2026-08-03_4af10b2dc2838e10b2c1de9549e40a90_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:3860
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\96a136f6.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:4800
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\97d4c63b.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:1136
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command " $s = New-Object -comObject WScript.Shell $l = $s.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System2980a.lnk\") $l.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-08-03_4af10b2dc2838e10b2c1de9549e40a90_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\" $l.Save() "
      2⤵
      • Creates a file in the Startup directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:616
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\0da6cc49.exe
      2⤵
      • Views/modifies file attributes
      PID:2224
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\8a8d5a64.exe
      2⤵
      • Views/modifies file attributes
      PID:3492

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 d835a32e38e0dfee8f8d93d9837e02eb505417d8456b0dbe5cd4da204dd9d4c7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        83032ec5.exe
        • Path C:\Users\Admin\AppData\Local\Temp\83032ec5.exe
        • Size 2.4MB
        • SHA256 8a1bce2e35e67bb51b88ffcb8bf529a4a52fe41655678d45293f38c514799f24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        8a8d5a64.exe
        • Path C:\Users\Admin\AppData\Local\Temp\8a8d5a64.exe
        • Size 2.4MB
        • SHA256 fb4e4048ec916c3f8a63503e36deda5053c24901a19ea7122676e6a6420d8c50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        0da6cc49.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\0da6cc49.exe
        • Size 2.4MB
        • SHA256 1ce48428c419540459acd75de521c206c24c50305ab389bb132cb61321d16639
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        b0f8efb1.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\b0f8efb1.exe
        • Size 2.4MB
        • SHA256 7ef088001de7e467a1ecbfb2902163ba2b34cadbb6d0b8bccdcbf72f47b09466
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        97d4c63b.exe
        • Path C:\Windows\SysWOW64\97d4c63b.exe
        • Size 2.4MB
        • SHA256 69888125a6c9981e17683c64f231fb2bbc8c2c75c83fa03f741fbdd5f8065cff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        9bb76a3e.exe
        • Path C:\Windows\SysWOW64\9bb76a3e.exe
        • Size 2.4MB
        • SHA256 cbf891aa1b8a62c311b7742ae2bbd32049aef8982b1ed7f72abc373865a0dc9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        96a136f6.exe
        • Path C:\Windows\System32\96a136f6.exe
        • Size 2.4MB
        • SHA256 09cd44aabdc19c3dc5c504dfbc50a60bff8b73c54fb1477fcbf48aa3c4505e3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ba8a7da3.exe
        • Path C:\Windows\System32\ba8a7da3.exe
        • Size 2.4MB
        • SHA256 071a0aff9a7484f7adced1c573778ceb1ba8d49227c14fefb80544a4a9e23f4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/616-42-0x00000236D61F0000-0x00000236D6B94000-memory.dmp
        Download

        memory/2948-20-0x000002B190AB0000-0x000002B191454000-memory.dmp
        Download

        memory/2948-25-0x000002B190AB0000-0x000002B191454000-memory.dmp
        Download

        memory/2948-17-0x000002B190AB0000-0x000002B191454000-memory.dmp
        Download

        memory/2948-13-0x000002B190AB0000-0x000002B191454000-memory.dmp
        Download

        memory/2948-21-0x000002B190AB0000-0x000002B191454000-memory.dmp
        Download

        memory/2948-22-0x000002B190AB0000-0x000002B191454000-memory.dmp
        Download

        memory/2948-16-0x000002B190AB0000-0x000002B191454000-memory.dmp
        Download

        memory/2948-23-0x000002B190AB0000-0x000002B191454000-memory.dmp
        Download

        memory/2948-24-0x000002B190AB0000-0x000002B191454000-memory.dmp
        Download

        memory/2948-18-0x000002B190AB0000-0x000002B191454000-memory.dmp
        Download

        memory/2948-26-0x000002B190AB0000-0x000002B191454000-memory.dmp
        Download

        memory/2948-32-0x000002B190AB0000-0x000002B191454000-memory.dmp
        Download

        memory/2948-14-0x000002B190AB0000-0x000002B191454000-memory.dmp
        Download

        memory/2948-10-0x000002B1A9700000-0x000002B1A9722000-memory.dmp
        Download

        memory/2948-11-0x000002B190AB0000-0x000002B191454000-memory.dmp
        Download

        memory/2948-6-0x000002B190AB0000-0x000002B191454000-memory.dmp
        Download

        memory/2948-5-0x000002B19124C000-0x000002B19124D000-memory.dmp
        Download