3517252c744c7cddcec2178245a76279ffa2bc7c21edc82c8a527cb30dbace8f

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_65e7099cc2fc41ea688ffc0b264e6b87_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
Size 5.8MB
Sample260806-sty2vsytes
SHA256 3517252c744c7cddcec2178245a76279ffa2bc7c21edc82c8a527cb30dbace8f
MD5 65e7099cc2fc41ea688ffc0b264e6b87
SHA1 41c5d3d0a4eb6bec6e3b4af1955e96fcebebf0f1
SHA512 2255eb59d32e406c73c0ef807677ecbb808ceefaedf47522bc7c61811bad1a78648f5eb89e18a07ca567df23aba71914054ab5e15d402f8a5a9dd9b9bd4017b6
SSDEEP 49152:j5WC0h8MaB7boshWQTm4sGt3HB3rCgEOEYRtld0ujV5Eo+vgIQ9n7y8vBH:JM6NK7Gtx7PBEBMnm
TLSH
T14E563A47F8A505A8C0EED631C9729252BA717C484F3563DB2B60F7392F76BD0AAB5310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1636	cmd.exe
1084	cmd.exe
1248	cmd.exe
3752	cmd.exe
648	cmd.exe
4428	cmd.exe

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	3	Go-http-client/1.1
HTTP User-Agent header	4	Go-http-client/1.1

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 1084	3068	2026-08-06_65e7099cc2fc41ea688ffc0b264e6b87_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	88
PID 3068 wrote to memory of 1248	3068	2026-08-06_65e7099cc2fc41ea688ffc0b264e6b87_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	90
PID 3068 wrote to memory of 3752	3068	2026-08-06_65e7099cc2fc41ea688ffc0b264e6b87_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	100
PID 3068 wrote to memory of 648	3068	2026-08-06_65e7099cc2fc41ea688ffc0b264e6b87_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	103
PID 3068 wrote to memory of 4428	3068	2026-08-06_65e7099cc2fc41ea688ffc0b264e6b87_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	105
PID 3068 wrote to memory of 1636	3068	2026-08-06_65e7099cc2fc41ea688ffc0b264e6b87_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-06_65e7099cc2fc41ea688ffc0b264e6b87_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_65e7099cc2fc41ea688ffc0b264e6b87_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\system32\cmd.exe
  cmd /c ver
  2⤵
  - Executes a command shell one-liner
  PID:1084
- C:\Windows\system32\cmd.exe
  cmd /c ver
  2⤵
  - Executes a command shell one-liner
  PID:1248
- C:\Windows\system32\cmd.exe
  cmd /c ver
  2⤵
  - Executes a command shell one-liner
  PID:3752
- C:\Windows\system32\cmd.exe
  cmd /c ver
  2⤵
  - Executes a command shell one-liner
  PID:648
- C:\Windows\system32\cmd.exe
  cmd /c ver
  2⤵
  - Executes a command shell one-liner
  PID:4428
- C:\Windows\system32\cmd.exe
  cmd /c ver
  2⤵
  - Executes a command shell one-liner
  PID:1636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads