96f8f54a7a8d8adc71e6401dafe76b2bd1314526a38edb2f7853aef813773648

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 06:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_99851132bfb431b853380bdd8ec3406e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 5.1MB
Sample260804-gw6zpsseqc
SHA256 96f8f54a7a8d8adc71e6401dafe76b2bd1314526a38edb2f7853aef813773648
MD5 99851132bfb431b853380bdd8ec3406e
SHA1 ae4163cffcb1e96ff6d64ea56dd531898f0eecf7
SHA512 d916e99f8f43aaa31306c2b999fc6495c2f1aa53ca3db7fef6013965e0aa40ae9ee92efcf3c6b9d85b64aaccd1d5bd1722e7714fd1585684890fdd2bff839a1a
SSDEEP 49152:q/eT20SpimMjMA/PAWTsxRIlB5VicJYWCXM5EnPCqZ0AboZBuN:ZoRAn7scVic3En+Ac
TLSH
T1A9465B07FC9555E8C0AED235C9628263BA717C494B3563D72BA0F7382F72BD0AA79740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5384	powershell.exe
5792	powershell.exe
5500	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3032	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5864	timeout.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4596	reg.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5384	powershell.exe
5384	powershell.exe
5792	powershell.exe
5792	powershell.exe
5500	powershell.exe
5500	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5384	powershell.exe
Token: SeDebugPrivilege	5792	powershell.exe
Token: SeDebugPrivilege	5500	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 5384	1644	2026-08-04_99851132bfb431b853380bdd8ec3406e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	89
PID 1644 wrote to memory of 5792	1644	2026-08-04_99851132bfb431b853380bdd8ec3406e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	91
PID 1644 wrote to memory of 4596	1644	2026-08-04_99851132bfb431b853380bdd8ec3406e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	93
PID 1644 wrote to memory of 5500	1644	2026-08-04_99851132bfb431b853380bdd8ec3406e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	95
PID 1644 wrote to memory of 3032	1644	2026-08-04_99851132bfb431b853380bdd8ec3406e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	97
PID 3032 wrote to memory of 5864	3032	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-08-04_99851132bfb431b853380bdd8ec3406e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_99851132bfb431b853380bdd8ec3406e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName PresentationFramework; Write-Output ([System.Windows.MessageBox]::Show('NestMaster 2D를 이 컴퓨터에서 제거하시겠습니까? 사용자가 별도로 저장한 .nmp, DXF, HTML, CSV 파일은 삭제되지 않습니다.','제거 확인','YesNo','Question'))"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command " $desktop=[Environment]::GetFolderPath('Desktop') $start=[Environment]::GetFolderPath('Programs') Remove-Item -LiteralPath (Join-Path $desktop 'NestMaster 2D.lnk') -Force -ErrorAction SilentlyContinue Remove-Item -LiteralPath (Join-Path $start 'NestMaster 2D.lnk') -Force -ErrorAction SilentlyContinue "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5792
- C:\Windows\system32\reg.exe
  reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\NestMaster2D /f
  2⤵
  - Modifies registry key
  PID:4596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName PresentationFramework; Write-Output ([System.Windows.MessageBox]::Show('NestMaster 2D 제거를 완료합니다.','제거 완료','OK','Information'))"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5500
- C:\Windows\system32\cmd.exe
  cmd /C "timeout /t 2 /nobreak >nul & rmdir /s /q \"C:\Users\Admin\AppData\Local\Programs\NestMaster2D\""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c70f7b663ab51f0e2f8ed09b04b5857ab4dc9c9ee960706938b3d3920a8eff03
MD5 277b8f2b521d836b7ef20377418bb688
SHA1 c72176c062dd34a5f83475d7650c6b6e33ab4a9f
SHA512 cd951247e0a3dc6248248cf0804c4d95f605303d0a83f6c88ca7bde12a547e054bd8ef4f7328a54cf331bee07192f8ec876b0b37215c49dc8c4d80ea2406c764
TLSH
T14E21A827F3CC8329C89A403620CEAC1836B687E740DE8E57A785D248B53F199DF61150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_llg25bs5.lv4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_llg25bs5.lv4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5384-15-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5384-5-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5384-7-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5384-8-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5384-9-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5384-10-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5384-11-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5384-12-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5384-13-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5384-0-0x00007FF8998AF000-0x00007FF8998B0000-memory.dmp

Download

memory/5384-3-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5384-6-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5384-4-0x00000204EC730000-0x00000204EC752000-memory.dmp

Download

memory/5792-21-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5792-22-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5792-23-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5792-24-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5792-25-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5792-26-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5792-28-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5792-29-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5792-20-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5792-16-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download