3517252c744c7cddcec2178245a76279ffa2bc7c21edc82c8a527cb30dbace8f

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_65e7099cc2fc41ea688ffc0b264e6b87_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
Size 5.8MB
Sample260806-sty2vsytes
SHA256 3517252c744c7cddcec2178245a76279ffa2bc7c21edc82c8a527cb30dbace8f
MD5 65e7099cc2fc41ea688ffc0b264e6b87
SHA1 41c5d3d0a4eb6bec6e3b4af1955e96fcebebf0f1
SHA512 2255eb59d32e406c73c0ef807677ecbb808ceefaedf47522bc7c61811bad1a78648f5eb89e18a07ca567df23aba71914054ab5e15d402f8a5a9dd9b9bd4017b6
SSDEEP 49152:j5WC0h8MaB7boshWQTm4sGt3HB3rCgEOEYRtld0ujV5Eo+vgIQ9n7y8vBH:JM6NK7Gtx7PBEBMnm
TLSH
T14E563A47F8A505A8C0EED631C9729252BA717C484F3563DB2B60F7392F76BD0AAB5310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2444	cmd.exe
1604	cmd.exe
6048	cmd.exe
4704	cmd.exe
4644	cmd.exe
4616	cmd.exe

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	3	Go-http-client/1.1
HTTP User-Agent header	4	Go-http-client/1.1

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 4644	3416	2026-08-06_65e7099cc2fc41ea688ffc0b264e6b87_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	89
PID 3416 wrote to memory of 4616	3416	2026-08-06_65e7099cc2fc41ea688ffc0b264e6b87_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	91
PID 3416 wrote to memory of 2444	3416	2026-08-06_65e7099cc2fc41ea688ffc0b264e6b87_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	94
PID 3416 wrote to memory of 1604	3416	2026-08-06_65e7099cc2fc41ea688ffc0b264e6b87_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	96
PID 3416 wrote to memory of 6048	3416	2026-08-06_65e7099cc2fc41ea688ffc0b264e6b87_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	98
PID 3416 wrote to memory of 4704	3416	2026-08-06_65e7099cc2fc41ea688ffc0b264e6b87_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-06_65e7099cc2fc41ea688ffc0b264e6b87_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_65e7099cc2fc41ea688ffc0b264e6b87_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Windows\system32\cmd.exe
  cmd /c ver
  2⤵
  - Executes a command shell one-liner
  PID:4644
- C:\Windows\system32\cmd.exe
  cmd /c ver
  2⤵
  - Executes a command shell one-liner
  PID:4616
- C:\Windows\system32\cmd.exe
  cmd /c ver
  2⤵
  - Executes a command shell one-liner
  PID:2444
- C:\Windows\system32\cmd.exe
  cmd /c ver
  2⤵
  - Executes a command shell one-liner
  PID:1604
- C:\Windows\system32\cmd.exe
  cmd /c ver
  2⤵
  - Executes a command shell one-liner
  PID:6048
- C:\Windows\system32\cmd.exe
  cmd /c ver
  2⤵
  - Executes a command shell one-liner
  PID:4704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads