Analysis
- max time kernel
149s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
15/08/2026, 09:29
General
- Target 2026-08-15_519598a2eec084abc4d6c337c40524d2_frostygoop_ghostlocker_glassworm_hijackloader_hive_luca-.exe
- Size 3.6MB
- Sample260815-lfyqlstbkf
- SHA256 e14643df90fbb28a1a747e726ab35fe6638b9c5f363aeb35977807b98312189b
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_519598a2eec084abc4d6c337c40524d2_frostygoop_ghostlocker_glassworm_hijackloader_hive_luca-.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_519598a2eec084abc4d6c337c40524d2_frostygoop_ghostlocker_glassworm_hijackloader_hive_luca-.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\6de92cc6\2dcf953653cb.exeC:\Users\Admin\AppData\Roaming\6de92cc6\2dcf953653cb.exe -Command "Invoke-Expression $(Get-Content -Raw -Path 'C:\Users\Admin\AppData\Local\Temp\ac957f636514122')"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rar.exe"C:\Users\Admin\AppData\Local\Temp\rar.exe" a -hpcvnCmo|RT}E0!6],UK9Gp$3eZ(ih<Y[w -m5 -v50m -ep1 -r -o+ -k -y -md256m C:\Users\Admin\AppData\Local\Temp\Archive_77f55183-e5b2-4f72-a33b-9869a0847e2b\Archive_77f55183-e5b2-4f72-a33b-9869a0847e2b.rar D:\TESTDATA3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ac957f636514122
rar.exe
2dcf953653cb.exe
Microsoft.Windows.Firewall.Commands.Resources.dll
memory/5788-1071-0x00007FFDCCF20000-0x00007FFDCD8C4000-memory.dmp
memory/5788-1072-0x00007FFDCCF20000-0x00007FFDCD8C4000-memory.dmp
memory/5788-1065-0x00007FFDCCF20000-0x00007FFDCD8C4000-memory.dmp
memory/5788-1066-0x00007FFDCCF20000-0x00007FFDCD8C4000-memory.dmp
memory/5788-1067-0x00007FFDCCF20000-0x00007FFDCD8C4000-memory.dmp
memory/5788-1068-0x00007FFDCCF20000-0x00007FFDCD8C4000-memory.dmp
memory/5788-1063-0x00007FFDCCF20000-0x00007FFDCD8C4000-memory.dmp
memory/5788-1070-0x00007FFDCCF20000-0x00007FFDCD8C4000-memory.dmp
memory/5788-1062-0x000002387B6C0000-0x000002387B6E2000-memory.dmp
memory/5788-1064-0x00007FFDCCF20000-0x00007FFDCD8C4000-memory.dmp
memory/5788-1073-0x00007FFDCCF20000-0x00007FFDCD8C4000-memory.dmp
memory/5788-1074-0x00007FFDCCF20000-0x00007FFDCD8C4000-memory.dmp
memory/5788-1075-0x000002387BC60000-0x000002387BE22000-memory.dmp
memory/5788-1076-0x00007FFDCCF20000-0x00007FFDCD8C4000-memory.dmp
memory/5788-1077-0x000002387C360000-0x000002387C888000-memory.dmp
memory/5788-1078-0x00007FFDCCF20000-0x00007FFDCD8C4000-memory.dmp
memory/5788-1079-0x00007FFDCCF20000-0x00007FFDCD8C4000-memory.dmp
memory/5788-1080-0x00007FFDCCF20000-0x00007FFDCD8C4000-memory.dmp
memory/5788-1089-0x00007FFDCCF20000-0x00007FFDCD8C4000-memory.dmp
memory/5788-1059-0x00007FFDCD0AF000-0x00007FFDCD0B0000-memory.dmp