Overview

overview

10

Static

static

10

2026-08-03...st.exe

windows10-2004-x64

9

2026-08-03...st.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    148s
  • max time network
    54s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 13:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_0efd2e4b9c80a76dbaa4cf479d9f8f57_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
  • Size 7.0MB
  • Sample260804-qa43naxvdt
  • SHA256 27a4184b97a12dfdfdd97b2d1a1c289ab9c723d63929e3058006ea69fc2bd7a5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
credential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Drops file in Drivers directory 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Discovers running processes 1 TTPs 2 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • Views/modifies file attributes 1 TTPs 4 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_0efd2e4b9c80a76dbaa4cf479d9f8f57_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_0efd2e4b9c80a76dbaa4cf479d9f8f57_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4348
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-03_0efd2e4b9c80a76dbaa4cf479d9f8f57_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
      2⤵
      • Views/modifies file attributes
      PID:3712
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
      2⤵
      • Views/modifies file attributes
      PID:4848
    • C:\Windows\system32\tasklist.exe
      tasklist
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:4856
    • C:\Windows\system32\tasklist.exe
      tasklist
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:2012
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\2026-08-03_0efd2e4b9c80a76dbaa4cf479d9f8f57_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:796
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Disables one or more Microsoft Defender components
      • Suspicious use of AdjustPrivilegeToken
      PID:4420
    • C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      2⤵
      • Drops file in Drivers directory
      • Views/modifies file attributes
      PID:5764
    • C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      2⤵
      • Drops file in Drivers directory
      • Views/modifies file attributes
      PID:2984
    • C:\Windows\System32\Wbem\wmic.exe
      wmic os get Caption
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4900
    • C:\Windows\System32\Wbem\wmic.exe
      wmic cpu get Name
      2⤵
        PID:4908
      • C:\Windows\System32\Wbem\wmic.exe
        wmic path win32_VideoController get name
        2⤵
        • Detects videocard installed
        PID:3932
      • C:\Windows\System32\Wbem\wmic.exe
        wmic csproduct get UUID
        2⤵
          PID:4696
        • C:\Windows\system32\netsh.exe
          netsh wlan show profiles
          2⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Network Configuration Discovery: Wi-Fi Discovery
          PID:5800
      • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:5460
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k GPSvcGroup
        1⤵
          PID:3340

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              1
              T1059

              PowerShell

              1
              T1059.001

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Event Triggered Execution

              1
              T1546

              Netsh Helper DLL

              1
              T1546.007

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Event Triggered Execution

              1
              T1546

              Netsh Helper DLL

              1
              T1546.007

              Defense Evasion

              Hide Artifacts

              1
              T1564

              Hidden Files and Directories

              1
              T1564.001

              Impair Defenses

              1
              T1562

              Disable or Modify Tools

              1
              T1562.001

              Modify Registry

              1
              T1112

              Credential Access

              Credentials from Password Stores

              1
              T1555

              Credentials from Web Browsers

              1
              T1555.003

              Unsecured Credentials

              4
              T1552

              Credentials In Files

              3
              T1552.001

              Credentials in Registry

              1
              T1552.002

              Discovery

              Process Discovery

              1
              T1057

              System Information Discovery

              1
              T1082

              System Network Configuration Discovery

              2
              T1016

              Internet Connection Discovery

              1
              T1016.001

              Wi-Fi Discovery

              1
              T1016.002

              Lateral Movement

              Collection

              Data from Local System

              3
              T1005

              Command and Control

              Web Service

              1
              T1102

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              __PSScriptPolicyTest_hxieboqa.rwa.ps1
              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hxieboqa.rwa.ps1
              • Size 60B
              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              SecurityHealthSystray.exe
              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
              • Size 7.0MB
              • SHA256 27a4184b97a12dfdfdd97b2d1a1c289ab9c723d63929e3058006ea69fc2bd7a5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              hosts
              • Path C:\Windows\System32\drivers\etc\hosts
              • Size 2KB
              • SHA256 ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              memory/796-6-0x00000127E8B00000-0x00000127E8B22000-memory.dmp
              Download

              memory/796-10-0x00000127E8D00000-0x00000127E8DB2000-memory.dmp
              Download

              memory/796-9-0x00000127E8BD0000-0x00000127E8BEE000-memory.dmp
              Download

              memory/796-11-0x00000127E8BC0000-0x00000127E8BCA000-memory.dmp
              Download

              memory/796-13-0x00000127E80C0000-0x00000127E8A64000-memory.dmp
              Download

              memory/4420-20-0x000001CAEEDE0000-0x000001CAEF784000-memory.dmp
              Download