Overview

overview

7

Static

static

3

2026-08-13...er.exe

windows10-2004-x64

7

2026-08-13...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/08/2026, 12:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-13_c2d057c0099c606b6c41b44fd7eacc1e_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
  • Size 2.4MB
  • Sample260813-pdg7max1cv
  • SHA256 71e10f91e1fc40dfe804c5cc8a7b24c420e4fa9616d8d0a85809f1646703eb62
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasionexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 8 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 8 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_c2d057c0099c606b6c41b44fd7eacc1e_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_c2d057c0099c606b6c41b44fd7eacc1e_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:5884
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\38d63a14.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:5476
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn Updateab5c1b /tr C:\Users\Admin\AppData\Local\Temp\2026-08-13_c2d057c0099c606b6c41b44fd7eacc1e_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4436
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\0a01850f.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:3148
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command " $s = New-Object -comObject WScript.Shell $l = $s.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System01c3c.lnk\") $l.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-08-13_c2d057c0099c606b6c41b44fd7eacc1e_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\" $l.Save() "
      2⤵
      • Creates a file in the Startup directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:8
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ede92c97.exe
      2⤵
      • Views/modifies file attributes
      PID:1112
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\14bfd280.exe
      2⤵
      • Views/modifies file attributes
      PID:3736
  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_c2d057c0099c606b6c41b44fd7eacc1e_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-13_c2d057c0099c606b6c41b44fd7eacc1e_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:5904
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn Update1f82e0 /tr C:\Users\Admin\AppData\Local\Temp\2026-08-13_c2d057c0099c606b6c41b44fd7eacc1e_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:5604
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\f1426d99.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:1236
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\5a900e0f.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:5728
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command " $s = New-Object -comObject WScript.Shell $l = $s.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System82da8.lnk\") $l.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-08-13_c2d057c0099c606b6c41b44fd7eacc1e_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\" $l.Save() "
      2⤵
      • Creates a file in the Startup directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2364
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\bda6ecb5.exe
      2⤵
      • Views/modifies file attributes
      PID:2072
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\3cb6ac18.exe
      2⤵
      • Views/modifies file attributes
      PID:4316

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 ffe2eff7096648637433bd1e36282223f7adcebb39f0b84c613636216767178a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        14bfd280.exe
        • Path C:\Users\Admin\AppData\Local\Temp\14bfd280.exe
        • Size 2.4MB
        • SHA256 997be7c8ad6461024f8871250b8f2d97a70b626fb689a80f40f69c51cb4ce7d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        3cb6ac18.exe
        • Path C:\Users\Admin\AppData\Local\Temp\3cb6ac18.exe
        • Size 2.4MB
        • SHA256 dd4579a15cea81a6c1c2e49a44a30b9f5780706912e0a55cb361a0bba9f3f5d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bda6ecb5.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\bda6ecb5.exe
        • Size 2.4MB
        • SHA256 7e69de82c8a498c2543bf44eb7b3afaa0a8cddf8adbe74d99f34634430f16346
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ede92c97.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ede92c97.exe
        • Size 2.4MB
        • SHA256 b6286ffebb368dd51dd3cda6bff059dfa235d3799528796b0c5f468415c85c59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        0a01850f.exe
        • Path C:\Windows\SysWOW64\0a01850f.exe
        • Size 2.4MB
        • SHA256 5aed0b1b60596c834a34e72e862a3cd792552b4bda98e15ed14e0a4b0340c20e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        5a900e0f.exe
        • Path C:\Windows\SysWOW64\5a900e0f.exe
        • Size 2.4MB
        • SHA256 bb78104a2e968e6f95389f913300b4cc15607becc1cb5cb8b4bfa48ac644ff0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        38d63a14.exe
        • Path C:\Windows\System32\38d63a14.exe
        • Size 2.4MB
        • SHA256 213d1e307377f5159ccf97fae4161830051608267cb0da59b8fc996be8d10d64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        f1426d99.exe
        • Path C:\Windows\System32\f1426d99.exe
        • Size 2.4MB
        • SHA256 5349686b09ab453a6eaa860afc5850fdaf96752b12916a433bfa554dcf3302ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/8-19-0x00007FFD38D10000-0x00007FFD396B4000-memory.dmp
        Download

        memory/8-16-0x00007FFD38D10000-0x00007FFD396B4000-memory.dmp
        Download

        memory/8-13-0x00007FFD38D10000-0x00007FFD396B4000-memory.dmp
        Download

        memory/8-20-0x00007FFD38D10000-0x00007FFD396B4000-memory.dmp
        Download

        memory/8-12-0x00007FFD38D10000-0x00007FFD396B4000-memory.dmp
        Download

        memory/8-21-0x00007FFD38D10000-0x00007FFD396B4000-memory.dmp
        Download

        memory/8-23-0x00007FFD38D10000-0x00007FFD396B4000-memory.dmp
        Download

        memory/8-25-0x00007FFD38D10000-0x00007FFD396B4000-memory.dmp
        Download

        memory/8-27-0x00007FFD38D10000-0x00007FFD396B4000-memory.dmp
        Download

        memory/8-10-0x000001B7B6350000-0x000001B7B6372000-memory.dmp
        Download

        memory/8-11-0x00007FFD38D10000-0x00007FFD396B4000-memory.dmp
        Download

        memory/8-7-0x00007FFD38D10000-0x00007FFD396B4000-memory.dmp
        Download

        memory/8-5-0x00007FFD38E9F000-0x00007FFD38EA0000-memory.dmp
        Download