b06e852af247fbea47cfcf85237487ed7adc3ca249833fb5290c2046dba32893

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_852b474308672dcb7d598bc9333f42a8_akira_coinminer_frostygoop_glassworm_hive_knight_luca-st.exe
Size 9.0MB
Sample260809-tx7nva1hjc
SHA256 b06e852af247fbea47cfcf85237487ed7adc3ca249833fb5290c2046dba32893
MD5 852b474308672dcb7d598bc9333f42a8
SHA1 d6ed2be3526ceb618198cc7825add6bfbe95aedd
SHA512 3bc95eefedab67f4f6448d1d3c2d33e7a93d74ec3c099473e079d7a355734055f6c49ae617a7963c7a52a15afd2da53536425be86436a7410e80fdaf5ece9eb8
SSDEEP 98304:lJN70K0LPl1nHXnInTfnjT8hsF+bPVcjBaBv4R74DYya0:lb0a7nbzjBc4R74vt
TLSH
T16D96AE03F99144F9C0AAD63586679332BB31B8491B3573DB2A90EB742F72BD05E3A714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution persistence spyware stealer

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 7 IoCs

resource	yara_rule
behavioral2/memory/4276-59-0x0000000710000000-0x00000007101EF000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/4276-62-0x0000000710000000-0x00000007101EF000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/4276-63-0x0000000710000000-0x00000007101EF000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/4276-76-0x0000000710000000-0x00000007101EF000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/4276-77-0x0000000710000000-0x00000007101EF000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/4276-79-0x0000000710000000-0x00000007101EF000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/4276-80-0x0000000710000000-0x00000007101EF000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5024	powershell.exe
5024	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
5492	dGbzW.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\ibrowser = "\"\\\\?\\C:\\Users\\Admin\\AppData\\Local\\Packages\\Extensions\\F5CBE8EAE5E3EC544E6572B88A5B95CA0277F91D232E2739CBC41F3F546E8BA7-agent\\ibrowser.exe\""	dGbzW.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4276	2026-08-09_852b474308672dcb7d598bc9333f42a8_akira_coinminer_frostygoop_glassworm_hive_knight_luca-st.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 15 IoCs

defense_evasion

pid	Process
2080	taskkill.exe
1284	taskkill.exe
4228	taskkill.exe
3940	taskkill.exe
1888	taskkill.exe
4644	taskkill.exe
6056	taskkill.exe
300	taskkill.exe
5572	taskkill.exe
4400	taskkill.exe
4592	taskkill.exe
1464	taskkill.exe
2884	taskkill.exe
3160	taskkill.exe
2380	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5492	dGbzW.exe
5492	dGbzW.exe
4276	2026-08-09_852b474308672dcb7d598bc9333f42a8_akira_coinminer_frostygoop_glassworm_hive_knight_luca-st.exe
4276	2026-08-09_852b474308672dcb7d598bc9333f42a8_akira_coinminer_frostygoop_glassworm_hive_knight_luca-st.exe
4276	2026-08-09_852b474308672dcb7d598bc9333f42a8_akira_coinminer_frostygoop_glassworm_hive_knight_luca-st.exe
4276	2026-08-09_852b474308672dcb7d598bc9333f42a8_akira_coinminer_frostygoop_glassworm_hive_knight_luca-st.exe
4276	2026-08-09_852b474308672dcb7d598bc9333f42a8_akira_coinminer_frostygoop_glassworm_hive_knight_luca-st.exe
4276	2026-08-09_852b474308672dcb7d598bc9333f42a8_akira_coinminer_frostygoop_glassworm_hive_knight_luca-st.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5024	powershell.exe
5024	powershell.exe
5024	powershell.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe
5492	dGbzW.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	5024	powershell.exe
Token: SeIncreaseQuotaPrivilege	5024	powershell.exe
Token: SeSecurityPrivilege	5024	powershell.exe
Token: SeTakeOwnershipPrivilege	5024	powershell.exe
Token: SeLoadDriverPrivilege	5024	powershell.exe
Token: SeSystemProfilePrivilege	5024	powershell.exe
Token: SeSystemtimePrivilege	5024	powershell.exe
Token: SeProfSingleProcessPrivilege	5024	powershell.exe
Token: SeIncBasePriorityPrivilege	5024	powershell.exe
Token: SeCreatePagefilePrivilege	5024	powershell.exe
Token: SeBackupPrivilege	5024	powershell.exe
Token: SeRestorePrivilege	5024	powershell.exe
Token: SeShutdownPrivilege	5024	powershell.exe
Token: SeDebugPrivilege	5024	powershell.exe
Token: SeSystemEnvironmentPrivilege	5024	powershell.exe
Token: SeRemoteShutdownPrivilege	5024	powershell.exe
Token: SeUndockPrivilege	5024	powershell.exe
Token: SeManageVolumePrivilege	5024	powershell.exe
Token: 33	5024	powershell.exe
Token: 34	5024	powershell.exe
Token: 35	5024	powershell.exe
Token: 36	5024	powershell.exe
Token: SeDebugPrivilege	3940	taskkill.exe
Token: SeDebugPrivilege	300	taskkill.exe
Token: SeDebugPrivilege	5572	taskkill.exe
Token: SeDebugPrivilege	1888	taskkill.exe
Token: SeDebugPrivilege	4644	taskkill.exe
Token: SeDebugPrivilege	6056	taskkill.exe
Token: SeDebugPrivilege	4400	taskkill.exe
Token: SeDebugPrivilege	4592	taskkill.exe
Token: SeDebugPrivilege	1464	taskkill.exe
Token: SeDebugPrivilege	2884	taskkill.exe
Token: SeDebugPrivilege	2080	taskkill.exe
Token: SeDebugPrivilege	1284	taskkill.exe
Token: SeDebugPrivilege	4228	taskkill.exe
Token: SeDebugPrivilege	3160	taskkill.exe
Token: SeDebugPrivilege	2380	taskkill.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 5492	4276	2026-08-09_852b474308672dcb7d598bc9333f42a8_akira_coinminer_frostygoop_glassworm_hive_knight_luca-st.exe	89
PID 5492 wrote to memory of 2492	5492	dGbzW.exe	90
PID 5492 wrote to memory of 5024	5492	dGbzW.exe	94
PID 5492 wrote to memory of 3940	5492	dGbzW.exe	96
PID 5492 wrote to memory of 300	5492	dGbzW.exe	98
PID 5492 wrote to memory of 5572	5492	dGbzW.exe	100
PID 5492 wrote to memory of 1888	5492	dGbzW.exe	102
PID 5492 wrote to memory of 4644	5492	dGbzW.exe	104
PID 5492 wrote to memory of 6056	5492	dGbzW.exe	106
PID 5492 wrote to memory of 4400	5492	dGbzW.exe	107
PID 5492 wrote to memory of 4592	5492	dGbzW.exe	110
PID 5492 wrote to memory of 1464	5492	dGbzW.exe	112
PID 5492 wrote to memory of 2884	5492	dGbzW.exe	114
PID 5492 wrote to memory of 2080	5492	dGbzW.exe	116
PID 5492 wrote to memory of 1284	5492	dGbzW.exe	118
PID 5492 wrote to memory of 4228	5492	dGbzW.exe	120
PID 5492 wrote to memory of 3160	5492	dGbzW.exe	122
PID 5492 wrote to memory of 2380	5492	dGbzW.exe	124
PID 5492 wrote to memory of 2532	5492	dGbzW.exe	128
PID 5492 wrote to memory of 2532	5492	dGbzW.exe	128
PID 5492 wrote to memory of 1152	5492	dGbzW.exe	130
PID 5492 wrote to memory of 1152	5492	dGbzW.exe	130

C:\Users\Admin\AppData\Local\Temp\2026-08-09_852b474308672dcb7d598bc9333f42a8_akira_coinminer_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_852b474308672dcb7d598bc9333f42a8_akira_coinminer_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Users\Admin\AppData\Local\Temp\dGbzW.exe
  "C:\Users\Admin\AppData\Local\Temp\dGbzW.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5492
- - C:\Windows\system32\getmac.exe
    "getmac" /fo csv /nh
    3⤵
    PID:2492
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object -ExpandProperty displayName"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5024
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3940
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:300
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5572
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedgewebview2.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1888
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM MicrosoftEdgeUpdate.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4644
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6056
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4400
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4592
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedgewebview2.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1464
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM MicrosoftEdgeUpdate.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2884
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2080
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1284
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4228
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedgewebview2.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3160
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM MicrosoftEdgeUpdate.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2380
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google/Chrome/Application/chrome.exe"
    3⤵
    PID:2532
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google/Chrome/Application/chrome.exe"
    3⤵
    PID:1152

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2896

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4396

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1960

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Users\Admin\AppData\Local\Packages\Extensions\F5CBE8EAE5E3EC544E6572B88A5B95CA0277F91D232E2739CBC41F3F546E8BA7\e0\manifest.json
Size 1KB
SHA256 a68297b6ff8218690abddc5ef63de45cd126695a4e677e3e3a2be087a7c6ac2c
MD5 ac45ab511f5530abc94313434adaf432
SHA1 febec023387908b6be72a9dfba895d886ed1e60e
SHA512 f7aeb6110d091b0ebcd5f19d50588eeb84980fa7fbe80238cb99458d52189709a417c9f3b2e2393b89fe08b66f8b6e87f3881431e1acb452e4f90e796b1d6e05
TLSH
T19D310025D9685C6B03CCAB302DFA4987A50509879D947C1C7ADE800C8FBD61F02FBB9C
MD5 SHA1 SHA512 TLSH

Submit Download

ck_5492_1786292852859360300.bin

Path C:\Users\Admin\AppData\Local\Temp\ck_5492_1786292852859360300.bin
Size 32B
SHA256 fbf3219bda30a827b540dee085b9a0c5ce8e0abdb05c1da7fb752ca52e2d1a87
MD5 8214a46974c9a5223d64281b4b9301dc
SHA1 97dd746b247624c239a88b50704dde51f2df9e97
SHA512 dbe9f832f46f09a0482dced6c85a2ce9075aa0df9444ed199fc82d7274d246b55ef062d986d9dfbde17ad4547472bd1d30e52bdac41e7cde328678ad3997d9b9
MD5 SHA1 SHA512

Submit Download

dGbzW.exe

Path C:\Users\Admin\AppData\Local\Temp\dGbzW.exe
Size 3.6MB
SHA256 50e61dc7624cdd79f3d44eaf7fa2f7b8ac71348f0e3982b964e4251d94fb4c79
MD5 04efec76cfefafa308c76f8add5af770
SHA1 d3ffb4658a30dc9dde49bee7f488e8062e9480db
SHA512 375c834dcb3f91822d158e6fcad24d1fabb6ec74e8b5a901b8deb8835d5a843ef0253529b6b6a0646a5c7b07e6ef4f3347c4c545893cceade5383eeb7cae164b
SSDEEP 49152:b1nHd0D+KMEEIiGJzJDZJ+FpHgB4hMtP/jJzdHeRI4XsK5VIdIIU6ib:ZnHXnInTfnjT8hsF+b
TLSH
T12D067D03E69581F9C46EC174835B9733FA32B8895534B69F2BD4DB213E22F50AB0E719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4276-63-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4276-47-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4276-80-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4276-79-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4276-77-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4276-76-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4276-59-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4276-62-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/5024-55-0x00000217F2CB0000-0x00000217F2CBA000-memory.dmp

Download

memory/5024-50-0x00000217F2560000-0x00000217F2582000-memory.dmp

Download

memory/5024-56-0x00000217F2E40000-0x00000217F2E6A000-memory.dmp

Download

memory/5024-54-0x00000217F2BF0000-0x00000217F2CA2000-memory.dmp

Download

memory/5024-57-0x00000217F2E40000-0x00000217F2E64000-memory.dmp

Download

memory/5024-53-0x00000217F2880000-0x00000217F289E000-memory.dmp

Download

memory/5492-83-0x00007FF7720C0000-0x00007FF772469000-memory.dmp

Download

memory/5492-78-0x00007FF7720C0000-0x00007FF772469000-memory.dmp

Download

memory/5492-84-0x00007FF7720C0000-0x00007FF772469000-memory.dmp

Download

memory/5492-85-0x00007FF7720C0000-0x00007FF772469000-memory.dmp

Download

memory/5492-86-0x00007FF7720C0000-0x00007FF772469000-memory.dmp

Download

memory/5492-88-0x00007FF7720C0000-0x00007FF772469000-memory.dmp

Download

memory/5492-89-0x00007FF7720C0000-0x00007FF772469000-memory.dmp

Download

memory/5492-91-0x00007FF7720C0000-0x00007FF772469000-memory.dmp

Download

memory/5492-92-0x00007FF7720C0000-0x00007FF772469000-memory.dmp

Download

memory/5492-93-0x00007FF7720C0000-0x00007FF772469000-memory.dmp

Download