Overview

overview

7

Static

static

3

2026-08-08...er.exe

windows10-2004-x64

7

2026-08-08...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    141s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 03:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_5ce203cce4b86022d818969fef7a5dd4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
  • Size 2.4MB
  • Sample260808-d3sh4sgr7t
  • SHA256 22ecb669163e4b77c1e4eb2101cadeac1d7ddf717e6f6cc7b2356677dcdfeafe
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasionexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 8 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 8 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_5ce203cce4b86022d818969fef7a5dd4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_5ce203cce4b86022d818969fef7a5dd4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:4560
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\973fcff5.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:3452
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn 722e425f /tr C:\Users\Admin\AppData\Local\Temp\2026-08-08_5ce203cce4b86022d818969fef7a5dd4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2652
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\726375f7.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:4712
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$s=New-Object -comObject WScript.Shell;$l=$s.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5da1ec.lnk\");$l.TargetPath=\"C:\Users\Admin\AppData\Local\Temp\2026-08-08_5ce203cce4b86022d818969fef7a5dd4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\";$l.Save()"
      2⤵
      • Creates a file in the Startup directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5176
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ddfc16ec.exe
      2⤵
      • Views/modifies file attributes
      PID:5960
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\100c8ed3.exe
      2⤵
      • Views/modifies file attributes
      PID:2308
  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_5ce203cce4b86022d818969fef7a5dd4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-08_5ce203cce4b86022d818969fef7a5dd4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:4312
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn b373f4af /tr C:\Users\Admin\AppData\Local\Temp\2026-08-08_5ce203cce4b86022d818969fef7a5dd4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:5952
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\7bb8130d.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:1080
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\c835d363.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:2624
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$s=New-Object -comObject WScript.Shell;$l=$s.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d763a1.lnk\");$l.TargetPath=\"C:\Users\Admin\AppData\Local\Temp\2026-08-08_5ce203cce4b86022d818969fef7a5dd4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\";$l.Save()"
      2⤵
      • Creates a file in the Startup directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:716
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\1bc47c69.exe
      2⤵
      • Views/modifies file attributes
      PID:2960
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\4f682d0f.exe
      2⤵
      • Views/modifies file attributes
      PID:5792

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        100c8ed3.exe
        • Path C:\Users\Admin\AppData\Local\Temp\100c8ed3.exe
        • Size 2.4MB
        • SHA256 a5d3fbbb9cabe36584fec26186f650febdfa50a99f994d94cb43cdfe3c2d7c57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        4f682d0f.exe
        • Path C:\Users\Admin\AppData\Local\Temp\4f682d0f.exe
        • Size 2.4MB
        • SHA256 18955fe4f2be25566e1f35f5a9f8100b7c4e870c155db1299b46b329feb676b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        1bc47c69.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\1bc47c69.exe
        • Size 2.4MB
        • SHA256 89eb23e2c3432a2e6d409fb1501cffa3111627c0289d4354cb2965f4cc568ec8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ddfc16ec.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ddfc16ec.exe
        • Size 2.4MB
        • SHA256 d19d912aeb68e7b55f6d79ea4db21e6b898d7e8844b2db2703c85bb837f5cd6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        726375f7.exe
        • Path C:\Windows\SysWOW64\726375f7.exe
        • Size 2.4MB
        • SHA256 04b061eef7e91670e6dbc7604408c9bf250b7445ce9102a795a9673a355c3faf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        c835d363.exe
        • Path C:\Windows\SysWOW64\c835d363.exe
        • Size 2.4MB
        • SHA256 9752fa7b9d807d81f557271683440166efb875a9957fa0fb572eabb8d0b38dad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7bb8130d.exe
        • Path C:\Windows\System32\7bb8130d.exe
        • Size 2.4MB
        • SHA256 2afe09935c696d150bdfbfed5b8f7113e318650b6a8112d3ead0bcf4f8510d49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        973fcff5.exe
        • Path C:\Windows\System32\973fcff5.exe
        • Size 2.4MB
        • SHA256 289b5cf07d675f25a63f0e6189982f6272becb395ef1503c8efc697f853c9660
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5176-20-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
        Download

        memory/5176-15-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
        Download

        memory/5176-17-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
        Download

        memory/5176-11-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
        Download

        memory/5176-19-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
        Download

        memory/5176-14-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
        Download

        memory/5176-23-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
        Download

        memory/5176-24-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
        Download

        memory/5176-12-0x000002401B960000-0x000002401B982000-memory.dmp
        Download

        memory/5176-7-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
        Download

        memory/5176-6-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
        Download

        memory/5176-5-0x00007FFF4B65F000-0x00007FFF4B660000-memory.dmp
        Download