Overview

overview

10

Static

static

10

2026-08-03...st.exe

windows10-2004-x64

7

2026-08-03...st.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 12:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_3fbbc10c0c6cad1c57e9f979ac9e78c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
  • Size 35.9MB
  • Sample260804-pgxfqaah94
  • SHA256 cf3c3a1e4a7463fb4218b12cf5d902465791122bad180f1fdcf0cdd3f87b8b5b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverypersistenceprivilege_escalationtrojan

Malware Config

Signatures

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 12 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_3fbbc10c0c6cad1c57e9f979ac9e78c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_3fbbc10c0c6cad1c57e9f979ac9e78c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
    1⤵
    • Checks whether UAC is enabled
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4744
    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-03_3fbbc10c0c6cad1c57e9f979ac9e78c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=0.3.2 --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-03_3fbbc10c0c6cad1c57e9f979ac9e78c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.0" --mojo-named-platform-channel-pipe=4744.3956.4598353124006315079
      2⤵
      • Enumerates system info in registry
      • Suspicious use of WriteProcessMemory
      PID:4748
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\2026-08-03_3fbbc10c0c6cad1c57e9f979ac9e78c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\2026-08-03_3fbbc10c0c6cad1c57e9f979ac9e78c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffc2b50b078,0x7ffc2b50b084,0x7ffc2b50b090
        3⤵
          PID:3776
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.0" --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-03_3fbbc10c0c6cad1c57e9f979ac9e78c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-08-03_3fbbc10c0c6cad1c57e9f979ac9e78c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=0.3.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1740,i,5267396210904963826,360918917778458926,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:2
          3⤵
            PID:2996
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.0" --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-03_3fbbc10c0c6cad1c57e9f979ac9e78c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-08-03_3fbbc10c0c6cad1c57e9f979ac9e78c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=0.3.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2052,i,5267396210904963826,360918917778458926,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:3
            3⤵
              PID:1240
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.0" --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-03_3fbbc10c0c6cad1c57e9f979ac9e78c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-08-03_3fbbc10c0c6cad1c57e9f979ac9e78c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=0.3.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2320,i,5267396210904963826,360918917778458926,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:8
              3⤵
                PID:2364

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                settings.dat
                • Path C:\Users\Admin\AppData\Roaming\2026-08-03_3fbbc10c0c6cad1c57e9f979ac9e78c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Crashpad\settings.dat
                • Size 280B
                • SHA256 7e1ef1d4cf919f2faeb23b269b8b28dc5b4aa1b9244597c90d885205ac66839b
                • MD5 SHA1 SHA512
                Submit Download

                settings.dat
                • Path C:\Users\Admin\AppData\Roaming\2026-08-03_3fbbc10c0c6cad1c57e9f979ac9e78c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Crashpad\settings.dat
                • Size 280B
                • SHA256 6decc0f8d5185e0423e9ad0faa936b769dca54475f11beeedb8a6790c4aac10a
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                throttle_store.dat
                • Path C:\Users\Admin\AppData\Roaming\2026-08-03_3fbbc10c0c6cad1c57e9f979ac9e78c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Crashpad\throttle_store.dat
                • Size 20B
                • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                • MD5 SHA1 SHA512
                Submit Download

                MANIFEST-000001
                • Path C:\Users\Admin\AppData\Roaming\2026-08-03_3fbbc10c0c6cad1c57e9f979ac9e78c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Extension Rules\MANIFEST-000001
                • Size 41B
                • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                • MD5 SHA1 SHA512
                Submit Download

                SCT Auditing Pending Reports
                • Path C:\Users\Admin\AppData\Roaming\2026-08-03_3fbbc10c0c6cad1c57e9f979ac9e78c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
                • Size 2B
                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                • MD5 SHA1 SHA512
                Submit Download

                CURRENT
                • Path C:\Users\Admin\AppData\Roaming\2026-08-03_3fbbc10c0c6cad1c57e9f979ac9e78c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Site Characteristics Database\CURRENT
                • Size 16B
                • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                • MD5 SHA1 SHA512
                Submit Download

                data_0
                • Path C:\Users\Admin\AppData\Roaming\2026-08-03_3fbbc10c0c6cad1c57e9f979ac9e78c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\GraphiteDawnCache\data_0
                • Size 8KB
                • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                data_1
                • Path C:\Users\Admin\AppData\Roaming\2026-08-03_3fbbc10c0c6cad1c57e9f979ac9e78c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\GraphiteDawnCache\data_1
                • Size 264KB
                • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                data_2
                • Path C:\Users\Admin\AppData\Roaming\2026-08-03_3fbbc10c0c6cad1c57e9f979ac9e78c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\GraphiteDawnCache\data_2
                • Size 8KB
                • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                data_3
                • Path C:\Users\Admin\AppData\Roaming\2026-08-03_3fbbc10c0c6cad1c57e9f979ac9e78c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\GraphiteDawnCache\data_3
                • Size 8KB
                • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                Local State
                • Path C:\Users\Admin\AppData\Roaming\2026-08-03_3fbbc10c0c6cad1c57e9f979ac9e78c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Local State
                • Size 1KB
                • SHA256 8567e82415020dc4a8a102656689da26b8cb641e5c245b1d0fa3ce282ec50a7e
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Local State
                • Path C:\Users\Admin\AppData\Roaming\2026-08-03_3fbbc10c0c6cad1c57e9f979ac9e78c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Local State
                • Size 2KB
                • SHA256 094f6d6e5d1ebf563e58fb9c9a698243c8d0ec7b4979c57e465bb5a6e13eacd1
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Local State
                • Path C:\Users\Admin\AppData\Roaming\2026-08-03_3fbbc10c0c6cad1c57e9f979ac9e78c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Local State
                • Size 3KB
                • SHA256 4b7c1ee3b52c6041954a7fb439b4ebbe8e42d97cd95f45a8071c1efa48889901
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Local State
                • Path C:\Users\Admin\AppData\Roaming\2026-08-03_3fbbc10c0c6cad1c57e9f979ac9e78c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Local State
                • Size 3KB
                • SHA256 78253d7f49de179436d9a80275eebe547ac1e95559a43fa48cbc9f18e10f649a
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Local State~RFe5812f6.TMP
                • Path C:\Users\Admin\AppData\Roaming\2026-08-03_3fbbc10c0c6cad1c57e9f979ac9e78c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Local State~RFe5812f6.TMP
                • Size 1KB
                • SHA256 b0392b325f80f5d436b21c467644be2cf4f0709cc6afbf95b7fae4cb06000696
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                memory/2364-101-0x00007FFC470D0000-0x00007FFC470D1000-memory.dmp
                Download

                memory/2364-97-0x00007FFC480C0000-0x00007FFC480C1000-memory.dmp
                Download

                memory/2996-33-0x00007FFC47A80000-0x00007FFC47A81000-memory.dmp
                Download

                memory/2996-218-0x000002137C200000-0x000002137C32A000-memory.dmp
                Download

                memory/4744-0-0x000001446B4F0000-0x000001446B4F1000-memory.dmp
                Download

                memory/4744-3-0x000001446B810000-0x000001446BF74000-memory.dmp
                Download

                memory/4744-2-0x000001446B5E0000-0x000001446B5E1000-memory.dmp
                Download

                memory/4744-1-0x000001446B510000-0x000001446B516000-memory.dmp
                Download