Overview

overview

7

Static

static

3

2026-08-03...er.exe

windows10-2004-x64

7

2026-08-03...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 09:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_e2d8725834691b71c936b2d48e07109d_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
  • Size 2.4MB
  • Sample260804-k78t8agf86
  • SHA256 5980759de9a0249858f3140af6f4f47e06f3070a90262d1c837fccaa093af6e1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasionexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 8 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 8 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_e2d8725834691b71c936b2d48e07109d_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_e2d8725834691b71c936b2d48e07109d_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:5392
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\f2e48c87.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:2720
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdatef87640 /tr C:\Users\Admin\AppData\Local\Temp\2026-08-03_e2d8725834691b71c936b2d48e07109d_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:5772
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\4976efa9.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:2888
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command " $WshShell = New-Object -comObject WScript.Shell $Shortcut = $WshShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System4d0ef.lnk\") $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-08-03_e2d8725834691b71c936b2d48e07109d_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\" $Shortcut.Save() "
      2⤵
      • Creates a file in the Startup directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4220
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ff43f30d.exe
      2⤵
      • Views/modifies file attributes
      PID:3464
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\a88537eb.exe
      2⤵
      • Views/modifies file attributes
      PID:1448
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_e2d8725834691b71c936b2d48e07109d_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-03_e2d8725834691b71c936b2d48e07109d_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2360
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\faba3848.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:2068
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdatee80922 /tr C:\Users\Admin\AppData\Local\Temp\2026-08-03_e2d8725834691b71c936b2d48e07109d_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:3156
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\6ae3ee23.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:1432
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command " $WshShell = New-Object -comObject WScript.Shell $Shortcut = $WshShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systema88bd.lnk\") $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-08-03_e2d8725834691b71c936b2d48e07109d_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\" $Shortcut.Save() "
      2⤵
      • Creates a file in the Startup directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3212
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\29c2187a.exe
      2⤵
      • Views/modifies file attributes
      PID:3732
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\6c76c57a.exe
      2⤵
      • Views/modifies file attributes
      PID:2236

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        6c76c57a.exe
        • Path C:\Users\Admin\AppData\Local\Temp\6c76c57a.exe
        • Size 2.4MB
        • SHA256 fa497b2c6eeca3cf10e5af33b830d2ceac4ec268328ea535d6e3f8aabdb46a93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        a88537eb.exe
        • Path C:\Users\Admin\AppData\Local\Temp\a88537eb.exe
        • Size 2.4MB
        • SHA256 04ba3e670c803e20415886dd392ec0860b89872d15431af0e095f3f8dc6347cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        29c2187a.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\29c2187a.exe
        • Size 2.4MB
        • SHA256 2574e96b218a8e37161de171708e624aea84273f9384fca30f5046bb88a6a07b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ff43f30d.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ff43f30d.exe
        • Size 2.4MB
        • SHA256 fabfc7dee31f6b8234e5c96719da818cde154ae32528f346650424e7a63d81f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        4976efa9.exe
        • Path C:\Windows\SysWOW64\4976efa9.exe
        • Size 2.4MB
        • SHA256 7f31541c3d2d46c587e768f19d0f3a8c6b2788e3d483195f6a277993347fc509
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        6ae3ee23.exe
        • Path C:\Windows\SysWOW64\6ae3ee23.exe
        • Size 2.4MB
        • SHA256 5ffb7b6a7fcca833a5d21d51697d232c27f7566d2a9345a07fd030c006a4abfa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        f2e48c87.exe
        • Path C:\Windows\System32\f2e48c87.exe
        • Size 2.4MB
        • SHA256 3fed2993396ea18054863cd4bfb8ef42448adf9cccb8af517a0f62bef8b6b74c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        faba3848.exe
        • Path C:\Windows\System32\faba3848.exe
        • Size 2.4MB
        • SHA256 e03b51699edbfaa82c8be7074888f1b40cf06c7a53bb9498161289242ad90eb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4220-20-0x00007FF9D1D00000-0x00007FF9D26A4000-memory.dmp
        Download

        memory/4220-26-0x00007FF9D1D00000-0x00007FF9D26A4000-memory.dmp
        Download

        memory/4220-17-0x00007FF9D1D00000-0x00007FF9D26A4000-memory.dmp
        Download

        memory/4220-14-0x00007FF9D1D00000-0x00007FF9D26A4000-memory.dmp
        Download

        memory/4220-21-0x00007FF9D1D00000-0x00007FF9D26A4000-memory.dmp
        Download

        memory/4220-22-0x00007FF9D1D00000-0x00007FF9D26A4000-memory.dmp
        Download

        memory/4220-13-0x000001CCBBC50000-0x000001CCBBC72000-memory.dmp
        Download

        memory/4220-16-0x00007FF9D1D00000-0x00007FF9D26A4000-memory.dmp
        Download

        memory/4220-23-0x00007FF9D1D00000-0x00007FF9D26A4000-memory.dmp
        Download

        memory/4220-27-0x00007FF9D1D00000-0x00007FF9D26A4000-memory.dmp
        Download

        memory/4220-28-0x00007FF9D1D00000-0x00007FF9D26A4000-memory.dmp
        Download

        memory/4220-29-0x00007FF9D1D00000-0x00007FF9D26A4000-memory.dmp
        Download

        memory/4220-10-0x00007FF9D1D00000-0x00007FF9D26A4000-memory.dmp
        Download

        memory/4220-35-0x00007FF9D1D00000-0x00007FF9D26A4000-memory.dmp
        Download

        memory/4220-8-0x00007FF9D1D00000-0x00007FF9D26A4000-memory.dmp
        Download

        memory/4220-6-0x00007FF9D1E8F000-0x00007FF9D1E90000-memory.dmp
        Download