Overview

overview

7

Static

static

3

2026-08-07...er.exe

windows10-2004-x64

7

2026-08-07...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/08/2026, 15:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_fd3a0a5ce0299b7df6a58b1f653bfd68_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
  • Size 2.4MB
  • Sample260807-sdwlssgd68
  • SHA256 603577fbb73ac28c37b3a9b3eb2c2896db73eaf95197f5f371db857f670a292c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasionexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 8 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 8 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_fd3a0a5ce0299b7df6a58b1f653bfd68_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_fd3a0a5ce0299b7df6a58b1f653bfd68_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:3000
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn Updatee21a03 /tr C:\Users\Admin\AppData\Local\Temp\2026-08-07_fd3a0a5ce0299b7df6a58b1f653bfd68_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:5816
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\20a47307.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:2228
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command " $s = New-Object -comObject WScript.Shell $l = $s.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systeme3a42.lnk\") $l.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-08-07_fd3a0a5ce0299b7df6a58b1f653bfd68_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\" $l.Save() "
      2⤵
      • Creates a file in the Startup directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3548
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\e845abec.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:5464
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\18f7a71b.exe
      2⤵
      • Views/modifies file attributes
      PID:5876
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\f7400570.exe
      2⤵
      • Views/modifies file attributes
      PID:936
  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_fd3a0a5ce0299b7df6a58b1f653bfd68_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-07_fd3a0a5ce0299b7df6a58b1f653bfd68_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:4104
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn Update4aba83 /tr C:\Users\Admin\AppData\Local\Temp\2026-08-07_fd3a0a5ce0299b7df6a58b1f653bfd68_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:3964
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\eb3cb181.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:1440
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\7958944b.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:2340
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command " $s = New-Object -comObject WScript.Shell $l = $s.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System43b98.lnk\") $l.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-08-07_fd3a0a5ce0299b7df6a58b1f653bfd68_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\" $l.Save() "
      2⤵
      • Creates a file in the Startup directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1580
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\6ae15930.exe
      2⤵
      • Views/modifies file attributes
      PID:4248
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\06efff19.exe
      2⤵
      • Views/modifies file attributes
      PID:3912

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 452eb598b2884fd99242cb5db005e3ac8e31bc9e3d58fe88ad0dd79ba08fbfd1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        06efff19.exe
        • Path C:\Users\Admin\AppData\Local\Temp\06efff19.exe
        • Size 2.4MB
        • SHA256 3475ec92fef85249ddf6fe6c2f3a34be92fa23b25a8cdfb390bea8b95d9144cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        f7400570.exe
        • Path C:\Users\Admin\AppData\Local\Temp\f7400570.exe
        • Size 2.4MB
        • SHA256 eb21e52b21a2ae74b777d72b7c1c7bd9dcf489e2f23f70ece14d263e813b900c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        18f7a71b.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\18f7a71b.exe
        • Size 2.4MB
        • SHA256 e918a25a218c53c5f528db4c963cd1e85b36df376b21756984ba012a47808b5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        6ae15930.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\6ae15930.exe
        • Size 2.4MB
        • SHA256 e4199241863df73750463a7b90f457b41739102b99f6766cb5b3aee5cf3725ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7958944b.exe
        • Path C:\Windows\SysWOW64\7958944b.exe
        • Size 2.4MB
        • SHA256 564251b133e02599fe6510583460d69541e7dfcc50f5306c51ed6acdddc1a211
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e845abec.exe
        • Path C:\Windows\SysWOW64\e845abec.exe
        • Size 2.4MB
        • SHA256 4e3efcc6aaea4200b9ffc477486c5cf0bdea883bd1317cf1227cf4fee70ada8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        20a47307.exe
        • Path C:\Windows\System32\20a47307.exe
        • Size 2.4MB
        • SHA256 fc96b0b3cb716a2c4d222d26cfaf441d01e7fd16a87e51f65cf2ed8b3d24abe8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        eb3cb181.exe
        • Path C:\Windows\System32\eb3cb181.exe
        • Size 2.4MB
        • SHA256 0f2972ebc63470cc2333b8998e89227e92d27a7d1a2a647de6e7828135e60444
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3548-12-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp
        Download

        memory/3548-23-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp
        Download

        memory/3548-18-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp
        Download

        memory/3548-19-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp
        Download

        memory/3548-20-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp
        Download

        memory/3548-21-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp
        Download

        memory/3548-22-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp
        Download

        memory/3548-14-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp
        Download

        memory/3548-25-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp
        Download

        memory/3548-11-0x00000234A0300000-0x00000234A0322000-memory.dmp
        Download

        memory/3548-31-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp
        Download

        memory/3548-30-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp
        Download

        memory/3548-26-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp
        Download

        memory/3548-7-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp
        Download

        memory/3548-6-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp
        Download

        memory/3548-3-0x00007FFBA7BCF000-0x00007FFBA7BD0000-memory.dmp
        Download