7de0624df335738640198c17316c87d8183b805756271818366b6798705ad6fb

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_3e93a0141f0eb0118f851f477cbf29db_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
Size 2.5MB
Sample260804-phk43swwdv
SHA256 7de0624df335738640198c17316c87d8183b805756271818366b6798705ad6fb
MD5 3e93a0141f0eb0118f851f477cbf29db
SHA1 3edc26ce8fb6450a542b791046472f5ac349f025
SHA512 4c88c8a84f56311198a919814e2b30822c489431334fb0f3e458844988d891be1d61638db95f84ea16e91227a32b7b920558aaff300b9ddd0c1de226bc013577
SSDEEP 49152:jZGcyycLEJAAoGoed18jqT7IbrZxO0ech:jJ690d1QR
TLSH
T1FFC55B07FCA148E5C0AEA231896692567B75BC481F3223D72F50B7B82F72BE05E79744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
948	powershell.exe
2836	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b729ed9d.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6b2689f3.lnk	powershell.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\7c0753b1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-03_3e93a0141f0eb0118f851f477cbf29db_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe"	2026-08-03_3e93a0141f0eb0118f851f477cbf29db_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\cf81fb94 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-03_3e93a0141f0eb0118f851f477cbf29db_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe"	2026-08-03_3e93a0141f0eb0118f851f477cbf29db_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
936	schtasks.exe
6024	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
948	powershell.exe
948	powershell.exe
948	powershell.exe
2836	powershell.exe
2836	powershell.exe
2836	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	948	powershell.exe
Token: SeDebugPrivilege	2836	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 6056 wrote to memory of 4652	6056	2026-08-03_3e93a0141f0eb0118f851f477cbf29db_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	89
PID 6056 wrote to memory of 936	6056	2026-08-03_3e93a0141f0eb0118f851f477cbf29db_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	90
PID 6056 wrote to memory of 948	6056	2026-08-03_3e93a0141f0eb0118f851f477cbf29db_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	95
PID 6056 wrote to memory of 1752	6056	2026-08-03_3e93a0141f0eb0118f851f477cbf29db_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	94
PID 4624 wrote to memory of 3336	4624	2026-08-03_3e93a0141f0eb0118f851f477cbf29db_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	99
PID 4624 wrote to memory of 6024	4624	2026-08-03_3e93a0141f0eb0118f851f477cbf29db_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	100
PID 6056 wrote to memory of 2500	6056	2026-08-03_3e93a0141f0eb0118f851f477cbf29db_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	103
PID 4624 wrote to memory of 3520	4624	2026-08-03_3e93a0141f0eb0118f851f477cbf29db_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	105
PID 6056 wrote to memory of 1228	6056	2026-08-03_3e93a0141f0eb0118f851f477cbf29db_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	107
PID 4624 wrote to memory of 2836	4624	2026-08-03_3e93a0141f0eb0118f851f477cbf29db_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	109
PID 4624 wrote to memory of 2856	4624	2026-08-03_3e93a0141f0eb0118f851f477cbf29db_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	111
PID 6056 wrote to memory of 4156	6056	2026-08-03_3e93a0141f0eb0118f851f477cbf29db_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	113
PID 4624 wrote to memory of 556	4624	2026-08-03_3e93a0141f0eb0118f851f477cbf29db_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	115
PID 4624 wrote to memory of 3604	4624	2026-08-03_3e93a0141f0eb0118f851f477cbf29db_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 10 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1752	attrib.exe
2500	attrib.exe
3520	attrib.exe
1228	attrib.exe
2856	attrib.exe
3604	attrib.exe
4652	attrib.exe
3336	attrib.exe
4156	attrib.exe
556	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-03_3e93a0141f0eb0118f851f477cbf29db_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_3e93a0141f0eb0118f851f477cbf29db_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:6056
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Local\Temp\d3502d87.tmp
  2⤵
  - Views/modifies file attributes
  PID:4652
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn dc12f4de /tr C:\Users\Admin\AppData\Local\Temp\2026-08-03_3e93a0141f0eb0118f851f477cbf29db_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe /sc daily /st 00:00 /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:936
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Roaming\9a306192.dat
  2⤵
  - Views/modifies file attributes
  PID:1752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command " $a = New-Object -comObject WScript.Shell $b = $a.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6b2689f3.lnk\") $b.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-08-03_3e93a0141f0eb0118f851f477cbf29db_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe\" $b.Save() "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:948
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Local\aa2e1f84.bin
  2⤵
  - Views/modifies file attributes
  PID:2500
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Local\Temp\9a9dcd76.log
  2⤵
  - Views/modifies file attributes
  PID:1228
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\9a53edec.cache
  2⤵
  - Views/modifies file attributes
  PID:4156

C:\Users\Admin\AppData\Local\Temp\2026-08-03_3e93a0141f0eb0118f851f477cbf29db_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
C:\Users\Admin\AppData\Local\Temp\2026-08-03_3e93a0141f0eb0118f851f477cbf29db_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Local\Temp\4b453561.tmp
  2⤵
  - Views/modifies file attributes
  PID:3336
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn 158e1c00 /tr C:\Users\Admin\AppData\Local\Temp\2026-08-03_3e93a0141f0eb0118f851f477cbf29db_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe /sc daily /st 00:00 /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6024
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Roaming\08c74ba8.dat
  2⤵
  - Views/modifies file attributes
  PID:3520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command " $a = New-Object -comObject WScript.Shell $b = $a.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b729ed9d.lnk\") $b.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-08-03_3e93a0141f0eb0118f851f477cbf29db_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe\" $b.Save() "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2836
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Local\83da9077.bin
  2⤵
  - Views/modifies file attributes
  PID:2856
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Local\Temp\fd7094ce.log
  2⤵
  - Views/modifies file attributes
  PID:556
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\ccdfdfd7.cache
  2⤵
  - Views/modifies file attributes
  PID:3604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

83da9077.bin

Path C:\Users\Admin\AppData\Local\83da9077.bin
Size 2.5MB
SHA256 e4aaca8a965835f828e43b7dbfd32b462d64421121df16cdd799f4e421058e79
MD5 20821944eb779b2cb1732d2560f63d30
SHA1 3627d89c12e2c84102374d894fca14c1d4b1908a
SHA512 266877582dc8d0bfd63ace993aacc9132718a9b3cc11218ca6d4b80afba9de932f198655e2d29ae18e6ed0e90a72a9f2f7355b0e86d5aa25739f4666ae93bee9
SSDEEP 49152:jZGcyycLEJAAoGoed18jqT7IbrZxO0ech:jJ690d1Qx
TLSH
T137C55B07FCA148E5C0AEA231896692567B75BC481F3223D72F50B7B82F72BE05E79744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
MD5 836da308c17b18155d513895baff5404
SHA1 548067c779da32edfafb48a6f14e086ed6dac113
SHA512 178cf31b7fc6015878508f9727fbc9feeb029d245b759b27d74ce893732322acf0ecc0c3570ec7c87e62b9e6d58b374a4b529e3e47c42762cd1b8cfe74d73b6a
TLSH
T1AA115733B3CC8724DC9A403650CEAC1136B687DB409EDE6BBB84D549B82F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

4b453561.tmp

Path C:\Users\Admin\AppData\Local\Temp\4b453561.tmp
Size 2.5MB
SHA256 488809696c3190c0d0fc1d1f8d695a04226e99af64913fc657dd5c61984dd8e1
MD5 2cacae896a37f2a21512edf0e3e5a4e2
SHA1 d264f063a20c79759ca58e290bd90fd9165338b7
SHA512 9e0a5669f506d7baceb1a1927b143d99ff39f2b76a6f73bd1231f95867c174f6a77a5000c732906986290224f560c0f333285d396d69caff92a69011001e0f54
SSDEEP 49152:jZGcyycLEJAAoGoed18jqT7IbrZxO0eci:jJ690d1Qy
TLSH
T1C4C55B07FCA148E5C0AEA231896692567B75BC441F3223D72F50B7B82F72BE05E79744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a9dcd76.log

Path C:\Users\Admin\AppData\Local\Temp\9a9dcd76.log
Size 2.5MB
SHA256 2132de4bcf0fb25746efc992abfc1cbc29841ed08ca4d8ac0cc82048cf77b571
MD5 45cf38cd3219170123a132655e3bfb82
SHA1 9f7166eb692594a5e70633777cad3be96f5ace9a
SHA512 08f30ef9ac1051e3ab38b1b0c0a3222fc87381e6d2114ecef27b37e6809346aef0c84590f0edc711224c5b7a9a10fe0ef0c010bd97b3c7c713eda724e6697bf3
SSDEEP 49152:jZGcyycLEJAAoGoed18jqT7IbrZxO0ecq:jJ690d1Qa
TLSH
T19AC55B07FCA148E5C0AEA231896692567B75BC481F3223D72F50B7B82F72BE05E79744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3502d87.tmp

Path C:\Users\Admin\AppData\Local\Temp\d3502d87.tmp
Size 2.5MB
SHA256 c9884e8b070c9ea0a05c1e3fc19523c3e013b96990467f17c6c92560a0486b14
MD5 0f7b1d2217931a15ae7d877d3351a02b
SHA1 a1d8e72c2409d3df4d20e0a29862c603ddd4728e
SHA512 57d8732c75a80201cfb864e049c6a4ef191cea2d3f2117d8a20def839039d20bbf41165fb126a9846b1ab7d1c5c54f5db5ea017d96a819388696d139976cdedb
SSDEEP 49152:jZGcyycLEJAAoGoed18jqT7IbrZxO0ecD:jJ690d1Qz
TLSH
T1C3C55B07FCA148E5C0AEA231896692567B75BC481F3223D72F50B7B82F72BE05E79744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd7094ce.log

Path C:\Users\Admin\AppData\Local\Temp\fd7094ce.log
Size 2.5MB
SHA256 348344912defaf8e4a9228687c3ffccc7ab97815c85be92d788f031a2214045d
MD5 c8f4319a895a5a216cb3497c3d898384
SHA1 40e75cfac3d934f458bbf6981fd912357278c46a
SHA512 1723da82488e8cda0620eb070fe4b648fd35237931578aba13676ce506a5f50e174db740c21ed838e16dd6baed897c20a460444a7a1ed0f6dda2fa27eec6313a
SSDEEP 49152:jZGcyycLEJAAoGoed18jqT7IbrZxO0ecF:jJ690d1Q1
TLSH
T1C4C55B07FCA148E5C0AEA231896692567B75BC441F3223D72F60B7B82F72BE05E79744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa2e1f84.bin

Path C:\Users\Admin\AppData\Local\aa2e1f84.bin
Size 2.5MB
SHA256 0619b132a08cecd525eb31178b855bf6b29a7bae50e5cd66f1e58ae96b758454
MD5 ae824addc4aa4d5e0d2b298fa6e04977
SHA1 9fe55b6dfdba7440b1153e1706a5181987dd19f0
SHA512 113605218dcdf670f00cb59d830f51741db065f0de9a7fb00cd24d18cae79bc9109ebc6b00c282eae45b51f823dd30227845d10a956275aa1e39281fb66c1a1e
SSDEEP 49152:jZGcyycLEJAAoGoed18jqT7IbrZxO0ecl:jJ690d1Q1
TLSH
T184C55B07FCA148E5C0AEA231896692567B75BC441F3223D72F60B7B82F72BE05E79744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

08c74ba8.dat

Path C:\Users\Admin\AppData\Roaming\08c74ba8.dat
Size 2.5MB
SHA256 0d5e6bde99ddacde3b949a0f077bb5f2186fe3b4724a8ae0feeac35b62f22dc5
MD5 c42eeff50640ac8be4a5146d718a495e
SHA1 fa15f273fcfda91953059bd3715244a471673104
SHA512 e8235b5c801f91922f5cec30dcfa79cda0531a8e7eb43312407d383e2b197dd91a9ebb636b655d755da881a0b5d2703fbc3a5a4cee5b59ff23cc4d858fcb0e86
SSDEEP 49152:jZGcyycLEJAAoGoed18jqT7IbrZxO0ecU:jJ690d1Qk
TLSH
T19AC55B07FCA148E5C0AEA231896692567B75BC481F3223D72F50B7B82F72BE05E79744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a306192.dat

Path C:\Users\Admin\AppData\Roaming\9a306192.dat
Size 2.5MB
SHA256 f32bb6aab943d8f729bdd401cfe2153a2dfeec6871dadc7d1dbfd267e4b83db9
MD5 cf2b23f5510bcddf1010a2b7636ca46a
SHA1 47144382791e9b79394312a7ee78a57ecfef93af
SHA512 ea1e7e33c9db82f725cdf89223ccc7865af3998f5b21892b816c10af51ff296fae5195c15811b138dfd64692d117d3ac29dd722acf52ed4465d049262d1e4b48
SSDEEP 49152:jZGcyycLEJAAoGoed18jqT7IbrZxO0ecd:jJ690d1QN
TLSH
T152C55B07FCA148E5C0AEA231896692567B75BC441F3223D72F60B7B82F72BE05E79744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a53edec.cache

Path C:\Users\Admin\AppData\Roaming\Microsoft\9a53edec.cache
Size 2.5MB
SHA256 c38fe2688c24ec6e7d66c3931c6452d2255bfa20f3f1f07c3c24ff54d957bbe6
MD5 3c33d1d5f31e77a432be30f7337be712
SHA1 9468ff02d0fd4523ab796be820c32d7b20123b5a
SHA512 9c32611754a8807821aaa7fca775e8ec7bf1f217bfb8f372f1ea19b737c01456b6ca2ded9717fb75236094ac8c73bff6fafa4541d99575a333b82d03e77e8d2c
SSDEEP 49152:jZGcyycLEJAAoGoed18jqT7IbrZxO0ecX:jJ690d1Qn
TLSH
T141C55B07FCA148E5C0AEA231896692567B75BC481F3223D72F50B7B82F72BE05E79744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccdfdfd7.cache

Path C:\Users\Admin\AppData\Roaming\Microsoft\ccdfdfd7.cache
Size 2.5MB
SHA256 373435652250df709ec7e51b144f2427eabb51af8723fd8672336523eec1a622
MD5 798e35eb5d5bb8678bdacdd4f5c85a43
SHA1 2e8f961d86cce312391102a99afa54987ba2acf4
SHA512 4e16e28bc921463da3c8bc1213130458d35a94bf95c5faecb62b918e4f1cb106b37a6ea21e28e663f7a7304c109261256c9e73b7787efe3381aedf3aa3eebc48
SSDEEP 49152:jZGcyycLEJAAoGoed18jqT7IbrZxO0ec7:jJ690d1Qr
TLSH
T1E8C55B07FCA148E5C0AEA231896692567B75BC441F3223D72F60B7B82F72BE05E79744
MD5 SHA1 SHA512 SSDEEP TLSH