59ba5ff4bc846dc241fd6ab5a90b347c68ab367d2d7862f61619bf25345fb8b5

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 01:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_6b6e9466c90a7f853f430c963ded4d04_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 6.2MB
Sample260811-bm5sdsbf96
SHA256 59ba5ff4bc846dc241fd6ab5a90b347c68ab367d2d7862f61619bf25345fb8b5
MD5 6b6e9466c90a7f853f430c963ded4d04
SHA1 daf6fb53d7f6ed45d6f6b8476c9dba682a5a3947
SHA512 d383baa1de955c4b628b40d80cecf11e4787531096d9442eb08da6befa66ac40410ca41d023222aae95ff3579f6b8502d816ff47034b6ffd407914bfed960e40
SSDEEP 49152:30pjz7qERUNxHNItXTSKTudNYDARS3L9N2bqqnq3+bg+EUVbpg5VhokOAJwfKiKN:3omOh6cNvqny+bLNy+dBLBE
TLSH
T15D664A07ECA155E8C0AAE23589739212BBB17C485B3523D72B90F7382F76BD06E79750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
3	ipapi.co
5	ipapi.co

Discovers running processes 1 TTPs 5 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4156	tasklist.exe
1192	tasklist.exe
5300	tasklist.exe
1436	tasklist.exe
612	tasklist.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5320	2026-08-10_6b6e9466c90a7f853f430c963ded4d04_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
5320	2026-08-10_6b6e9466c90a7f853f430c963ded4d04_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
5320	2026-08-10_6b6e9466c90a7f853f430c963ded4d04_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
5320	2026-08-10_6b6e9466c90a7f853f430c963ded4d04_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
5320	2026-08-10_6b6e9466c90a7f853f430c963ded4d04_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
5320	2026-08-10_6b6e9466c90a7f853f430c963ded4d04_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
5320	2026-08-10_6b6e9466c90a7f853f430c963ded4d04_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
5320	2026-08-10_6b6e9466c90a7f853f430c963ded4d04_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
5320	2026-08-10_6b6e9466c90a7f853f430c963ded4d04_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
5320	2026-08-10_6b6e9466c90a7f853f430c963ded4d04_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	5320	2026-08-10_6b6e9466c90a7f853f430c963ded4d04_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Token: SeDebugPrivilege	4156	tasklist.exe
Token: SeDebugPrivilege	1192	tasklist.exe
Token: SeDebugPrivilege	5300	tasklist.exe
Token: SeDebugPrivilege	1436	tasklist.exe
Token: SeDebugPrivilege	612	tasklist.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5320 wrote to memory of 4156	5320	2026-08-10_6b6e9466c90a7f853f430c963ded4d04_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	90
PID 5320 wrote to memory of 1192	5320	2026-08-10_6b6e9466c90a7f853f430c963ded4d04_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	93
PID 5320 wrote to memory of 5300	5320	2026-08-10_6b6e9466c90a7f853f430c963ded4d04_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	95
PID 5320 wrote to memory of 1436	5320	2026-08-10_6b6e9466c90a7f853f430c963ded4d04_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	97
PID 5320 wrote to memory of 612	5320	2026-08-10_6b6e9466c90a7f853f430c963ded4d04_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-08-10_6b6e9466c90a7f853f430c963ded4d04_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_6b6e9466c90a7f853f430c963ded4d04_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5320
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4156
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1192
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5300
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1436
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads