96f8f54a7a8d8adc71e6401dafe76b2bd1314526a38edb2f7853aef813773648

General

Target
2026-08-04_99851132bfb431b853380bdd8ec3406e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 5.1MB
Sample260804-gw6zpsseqc
SHA256 96f8f54a7a8d8adc71e6401dafe76b2bd1314526a38edb2f7853aef813773648
MD5 99851132bfb431b853380bdd8ec3406e
SHA1 ae4163cffcb1e96ff6d64ea56dd531898f0eecf7
SHA512 d916e99f8f43aaa31306c2b999fc6495c2f1aa53ca3db7fef6013965e0aa40ae9ee92efcf3c6b9d85b64aaccd1d5bd1722e7714fd1585684890fdd2bff839a1a
SSDEEP 49152:q/eT20SpimMjMA/PAWTsxRIlB5VicJYWCXM5EnPCqZ0AboZBuN:ZoRAn7scVic3En+Ac
TLSH
T1A9465B07FC9555E8C0AED235C9628263BA717C494B3563D72BA0F7382F72BD0AA79740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3328	powershell.exe
3672	powershell.exe
1572	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4700	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2760	timeout.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1816	reg.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3328	powershell.exe
3328	powershell.exe
3672	powershell.exe
3672	powershell.exe
1572	powershell.exe
1572	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3328	powershell.exe
Token: SeDebugPrivilege	3672	powershell.exe
Token: SeDebugPrivilege	1572	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 3328	5000	2026-08-04_99851132bfb431b853380bdd8ec3406e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	84
PID 5000 wrote to memory of 3672	5000	2026-08-04_99851132bfb431b853380bdd8ec3406e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	89
PID 5000 wrote to memory of 1816	5000	2026-08-04_99851132bfb431b853380bdd8ec3406e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	91
PID 5000 wrote to memory of 1572	5000	2026-08-04_99851132bfb431b853380bdd8ec3406e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	93
PID 5000 wrote to memory of 4700	5000	2026-08-04_99851132bfb431b853380bdd8ec3406e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	95
PID 4700 wrote to memory of 2760	4700	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-08-04_99851132bfb431b853380bdd8ec3406e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_99851132bfb431b853380bdd8ec3406e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName PresentationFramework; Write-Output ([System.Windows.MessageBox]::Show('NestMaster 2D를 이 컴퓨터에서 제거하시겠습니까? 사용자가 별도로 저장한 .nmp, DXF, HTML, CSV 파일은 삭제되지 않습니다.','제거 확인','YesNo','Question'))"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command " $desktop=[Environment]::GetFolderPath('Desktop') $start=[Environment]::GetFolderPath('Programs') Remove-Item -LiteralPath (Join-Path $desktop 'NestMaster 2D.lnk') -Force -ErrorAction SilentlyContinue Remove-Item -LiteralPath (Join-Path $start 'NestMaster 2D.lnk') -Force -ErrorAction SilentlyContinue "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3672
- C:\Windows\system32\reg.exe
  reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\NestMaster2D /f
  2⤵
  - Modifies registry key
  PID:1816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName PresentationFramework; Write-Output ([System.Windows.MessageBox]::Show('NestMaster 2D 제거를 완료합니다.','제거 완료','OK','Information'))"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1572
- C:\Windows\system32\cmd.exe
  cmd /C "timeout /t 2 /nobreak >nul & rmdir /s /q \"C:\Users\Admin\AppData\Local\Programs\NestMaster2D\""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

PowerShell

1

T1059.001

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 6fe24bb702382039b2a689e254335733c0b468063ad6f041b33189cb805889b6
MD5 94e865d99f07697306269702125ba932
SHA1 0163f174a13856de2a0f3394e1d80594c6ac0f0b
SHA512 5208e3988d4b1b4fe6a83acd45910a321e2768d7baa2c0d427ddffb20aee8be9438b946ab98b6193c0c19c0096dca8dec8f0bc3e476f07cc2f41770ed4cb0d38
TLSH
T1B681EF323275B1D8C9167F071A6C158463BF4355FA54AF58B25C625EE92600B9F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2e5c13529cee3b4abcbc23a80c6ce288a5491576a4b0b7564a92442597dd4eee
MD5 b18655b571d0e091c713f0a072cedac8
SHA1 0270ddb590b69774b035877d2bfe41734e70ac26
SHA512 78023d57fd4ebffda12aa2e947e3d7737831bef2533088c68d225578670b78a96394b3e64fc65c178cab7a6df0bea4d61832cd27ff856c603bad57f22059fd70
TLSH
T1FC21A927F39C8A21CC96013A109DAD1032B2C6E380DECF8BAFC4C618E17F494CF62590
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 91ebe002c75425d65ef09b7692db5bfcd0150a9cd56e909e773b0657c49741fc
MD5 d7deee7618235e759c8437a20e539d39
SHA1 d680de536f127115cb591051aa4c7c8dbda99eb8
SHA512 0d9b3a68f5c7846d747c52f7b0067014689f99e3af5dc6934e0dc6a11e89dd872c9de7e73c744afd9585482a52ec570b5da645acb829461ecaa4746a026740e7
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_srelc4wv.ftu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_srelc4wv.ftu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3328-1-0x0000025D1ACB0000-0x0000025D1ACC0000-memory.dmp

Download

memory/3328-0-0x0000025D1ACB0000-0x0000025D1ACC0000-memory.dmp

Download

memory/3328-2-0x0000025D1CDA0000-0x0000025D1CDC2000-memory.dmp

Download

memory/3672-13-0x00000293364D0000-0x00000293364E0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads