Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 22:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_e1fae5f857e88fb04969a9074ab6a773_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_e1fae5f857e88fb04969a9074ab6a773_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-08_e1fae5f857e88fb04969a9074ab6a773_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_.exe
- Size 4.3MB
- Sample260808-1w26asfe87
- SHA256 a60ee326b23d9df56b07cc9b26ce7a8305bda66506c231162192c4fe2f1cd47e
- MD5 e1fae5f857e88fb04969a9074ab6a773
- SHA1 9e4144a772606a858c58624fb3fa78cef3a10c66
- SHA512 87b9d1911bf0c0d9be619537c96ba60afee9e6d836b0be83462ae437728e32a7222c9a75fcd76d47c61d44be2eedf22a746434b777aad14b09925aea53e58fd9
- SSDEEP 49152:pLElONsTn1BCEzqC3esk11wtbrw59uzPktyrseDYBy7EsVihRCcMn:pQnzMwdlb5IDhm
- TLSH T1EE266A43FD9148FAC0A5A73189B652527B35BC0D5B3233D32E60BAB82E367D19E35B14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects Windows executables referencing non-Windows User-Agents 2 IoCs
resource yara_rule behavioral2/memory/4576-1-0x0000000710000000-0x00000007101EF000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/4576-4-0x0000000710000000-0x00000007101EF000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4576 2026-08-08_e1fae5f857e88fb04969a9074ab6a773_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4576 2026-08-08_e1fae5f857e88fb04969a9074ab6a773_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_.exe 4576 2026-08-08_e1fae5f857e88fb04969a9074ab6a773_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_.exe 4576 2026-08-08_e1fae5f857e88fb04969a9074ab6a773_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_.exe 4576 2026-08-08_e1fae5f857e88fb04969a9074ab6a773_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_.exe 4576 2026-08-08_e1fae5f857e88fb04969a9074ab6a773_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_.exe 4576 2026-08-08_e1fae5f857e88fb04969a9074ab6a773_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_e1fae5f857e88fb04969a9074ab6a773_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_e1fae5f857e88fb04969a9074ab6a773_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4576