Overview

overview

8

Static

static

3

2026-08-15...er.exe

windows10-2004-x64

8

2026-08-15...er.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    118s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/08/2026, 09:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-15_91040a1d0ba4a696636cb8a7f50e8c94_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
  • Size 2.5MB
  • Sample260815-k6bs4ashmd
  • SHA256 929b74d2341965c0fedb309bd877383a187aedf339334366aa23e2743977eee5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasionexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 8 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 8 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-15_91040a1d0ba4a696636cb8a7f50e8c94_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-15_91040a1d0ba4a696636cb8a7f50e8c94_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:4480
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\706daede.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:4100
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\5cd7966c.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:1200
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdatedbe375 /tr C:\Users\Admin\AppData\Local\Temp\2026-08-15_91040a1d0ba4a696636cb8a7f50e8c94_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:5408
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ece15e20.exe
      2⤵
      • Views/modifies file attributes
      PID:5328
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command " $WshShell = New-Object -comObject WScript.Shell $Shortcut = $WshShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System6e17e.lnk\") $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-08-15_91040a1d0ba4a696636cb8a7f50e8c94_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe\" $Shortcut.Save() "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Creates a file in the Startup directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5556
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\a41e38d5.exe
      2⤵
      • Views/modifies file attributes
      PID:1644
  • C:\Users\Admin\AppData\Local\Temp\2026-08-15_91040a1d0ba4a696636cb8a7f50e8c94_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-15_91040a1d0ba4a696636cb8a7f50e8c94_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:5744
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\e1ff53eb.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:4260
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdate13926c /tr C:\Users\Admin\AppData\Local\Temp\2026-08-15_91040a1d0ba4a696636cb8a7f50e8c94_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:1784
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\aed74072.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:4076
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command " $WshShell = New-Object -comObject WScript.Shell $Shortcut = $WshShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systemc624c.lnk\") $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-08-15_91040a1d0ba4a696636cb8a7f50e8c94_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe\" $Shortcut.Save() "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Creates a file in the Startup directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1500
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\4d92f721.exe
      2⤵
      • Views/modifies file attributes
      PID:3836
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\ee8e8489.exe
      2⤵
      • Views/modifies file attributes
      PID:4744

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 44baa73a092dddf1166cea2dae686d27a4af181d4e407f8e4de4d61ad670be93
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        a41e38d5.exe
        • Path C:\Users\Admin\AppData\Local\Temp\a41e38d5.exe
        • Size 2.5MB
        • SHA256 79f709a27ef2a356aebf6c88b2eca3b2fe388374ee0055c7cc69fa42e11a6b3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ee8e8489.exe
        • Path C:\Users\Admin\AppData\Local\Temp\ee8e8489.exe
        • Size 2.5MB
        • SHA256 8ee499bad1f53de5f06fd42a59b0b28d62d69510de992efa426df41df37737bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        4d92f721.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\4d92f721.exe
        • Size 2.5MB
        • SHA256 4add6e283205865ca26f69f71a36ef4d607200f20fdbf79cd67baa94720c1f5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ece15e20.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ece15e20.exe
        • Size 2.5MB
        • SHA256 1e92e0ba0f6f724af2e5454c08830c86e6d91bf78df731e75f9700acb3f17f92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        5cd7966c.exe
        • Path C:\Windows\SysWOW64\5cd7966c.exe
        • Size 2.5MB
        • SHA256 8efabd97701aa7c65db32b2ed63247b1df8ea44af69f2dbf64d65a2a528fe7cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        aed74072.exe
        • Path C:\Windows\SysWOW64\aed74072.exe
        • Size 2.5MB
        • SHA256 d3df77cc25c50cf6e32964415847dda298f31bd518cd66b3252224d9c7b91afe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        706daede.exe
        • Path C:\Windows\System32\706daede.exe
        • Size 2.5MB
        • SHA256 c093416f6de2690226fda4ba4ee7f97df8d8d69fe2736f9552cc0dd3b92eafd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e1ff53eb.exe
        • Path C:\Windows\System32\e1ff53eb.exe
        • Size 2.5MB
        • SHA256 2211ebc347df80b8fccddf4ad14f49a12a1d3d36ed1af1b69f920a4d7f0e3ac0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5556-25-0x00007FFCC5CA0000-0x00007FFCC6644000-memory.dmp
        Download

        memory/5556-14-0x00007FFCC5CA0000-0x00007FFCC6644000-memory.dmp
        Download

        memory/5556-19-0x00007FFCC5CA0000-0x00007FFCC6644000-memory.dmp
        Download

        memory/5556-20-0x00007FFCC5CA0000-0x00007FFCC6644000-memory.dmp
        Download

        memory/5556-21-0x00007FFCC5CA0000-0x00007FFCC6644000-memory.dmp
        Download

        memory/5556-22-0x00007FFCC5CA0000-0x00007FFCC6644000-memory.dmp
        Download

        memory/5556-23-0x00007FFCC5CA0000-0x00007FFCC6644000-memory.dmp
        Download

        memory/5556-24-0x00007FFCC5CA0000-0x00007FFCC6644000-memory.dmp
        Download

        memory/5556-18-0x00007FFCC5CA0000-0x00007FFCC6644000-memory.dmp
        Download

        memory/5556-28-0x00007FFCC5CA0000-0x00007FFCC6644000-memory.dmp
        Download

        memory/5556-17-0x00007FFCC5CA0000-0x00007FFCC6644000-memory.dmp
        Download

        memory/5556-29-0x00007FFCC5CA0000-0x00007FFCC6644000-memory.dmp
        Download

        memory/5556-26-0x00007FFCC5CA0000-0x00007FFCC6644000-memory.dmp
        Download

        memory/5556-13-0x0000023279BC0000-0x0000023279BE2000-memory.dmp
        Download

        memory/5556-38-0x00007FFCC5CA0000-0x00007FFCC6644000-memory.dmp
        Download

        memory/5556-11-0x00007FFCC5CA0000-0x00007FFCC6644000-memory.dmp
        Download

        memory/5556-8-0x00007FFCC5E2F000-0x00007FFCC5E30000-memory.dmp
        Download