Overview

overview

8

Static

static

3

2026-08-09...er.exe

windows10-2004-x64

8

2026-08-09...er.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/08/2026, 02:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_a4a37e3a041d0577c4f90bcf574b3478_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
  • Size 2.5MB
  • Sample260809-c8lgbaswfy
  • SHA256 c16c6c34c86b5ab6d1b093e0f21bdbce45ffafd799d3dc15ce376889c0400ece
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasionexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 8 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 8 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_a4a37e3a041d0577c4f90bcf574b3478_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_a4a37e3a041d0577c4f90bcf574b3478_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:4968
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\c5d55f66.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:4340
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\5da979ec.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:4728
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ba576850.exe
      2⤵
      • Views/modifies file attributes
      PID:4752
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdatee40f5f /tr C:\Users\Admin\AppData\Local\Temp\2026-08-09_a4a37e3a041d0577c4f90bcf574b3478_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:3032
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\e86d003b.exe
      2⤵
      • Views/modifies file attributes
      PID:4720
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command " $WshShell = New-Object -comObject WScript.Shell $Shortcut = $WshShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System7023b.lnk\") $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-08-09_a4a37e3a041d0577c4f90bcf574b3478_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe\" $Shortcut.Save() "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Creates a file in the Startup directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4520
  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_a4a37e3a041d0577c4f90bcf574b3478_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-09_a4a37e3a041d0577c4f90bcf574b3478_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2596
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\fdd4fffc.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:448
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateafdcb3 /tr C:\Users\Admin\AppData\Local\Temp\2026-08-09_a4a37e3a041d0577c4f90bcf574b3478_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:3168
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\1bf11b08.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:3288
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command " $WshShell = New-Object -comObject WScript.Shell $Shortcut = $WshShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System474ee.lnk\") $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-08-09_a4a37e3a041d0577c4f90bcf574b3478_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe\" $Shortcut.Save() "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Creates a file in the Startup directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2344
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\4fa420c9.exe
      2⤵
      • Views/modifies file attributes
      PID:4452
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\34ec95fd.exe
      2⤵
      • Views/modifies file attributes
      PID:4784

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        powershell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        • Size 2KB
        • SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 2669540fe56bb0ab3bfea86b40bb8b5df0e87d469d69b6c3456136b24d67216f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        34ec95fd.exe
        • Path C:\Users\Admin\AppData\Local\Temp\34ec95fd.exe
        • Size 2.5MB
        • SHA256 c67bb3921e9507d174b71bc46a7cd876ae59e9e099c4c8b8ea0224defd406a60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_4aznilyf.zxz.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4aznilyf.zxz.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        e86d003b.exe
        • Path C:\Users\Admin\AppData\Local\Temp\e86d003b.exe
        • Size 2.5MB
        • SHA256 14df9e4576b2de317be1740a586362e220a750054d6d760076583be28be1f283
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        4fa420c9.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\4fa420c9.exe
        • Size 2.5MB
        • SHA256 c791811d2896d72b6140c9ab3a64218e8232d0d2f4d374179895fc58741d7a6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ba576850.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ba576850.exe
        • Size 2.5MB
        • SHA256 8e0a178cea482b4668d53b44f247f130eef9d5c5899c745612bd62fc453e445b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        1bf11b08.exe
        • Path C:\Windows\SysWOW64\1bf11b08.exe
        • Size 2.5MB
        • SHA256 ae682571751545dbde5e28cbd4214ab99c609ee75c540115a1eaa26eb4078ec3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        5da979ec.exe
        • Path C:\Windows\SysWOW64\5da979ec.exe
        • Size 2.5MB
        • SHA256 1c87f51ae6d8a5a7ea96b0e8b8e34d1a7b367177ea191ba80d829a19f9c8e90b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        c5d55f66.exe
        • Path C:\Windows\System32\c5d55f66.exe
        • Size 2.5MB
        • SHA256 4beb8abf1d4c300ae783a0efb35436228fd2bf5d1dc15c184a58d2802bbe12f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fdd4fffc.exe
        • Path C:\Windows\System32\fdd4fffc.exe
        • Size 2.5MB
        • SHA256 4eae6a32262d4005ba0904abeec5fa9d8479339c21c307390f2bfffb36e3031b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4520-18-0x0000021CF1F50000-0x0000021CF1F72000-memory.dmp
        Download

        memory/4520-9-0x0000021CF1FD0000-0x0000021CF1FE0000-memory.dmp
        Download

        memory/4520-10-0x0000021CF1FD0000-0x0000021CF1FE0000-memory.dmp
        Download