sparkrat | 8df194078cce0d7a5ce65973efbd041e3a6771f773b15b8c4347b3060c3891bf

General

Target
2026-08-16_4fb126d3888a10470c500dcb0f5f2f22_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 21.4MB
Sample260816-jsahfashng
SHA256 8df194078cce0d7a5ce65973efbd041e3a6771f773b15b8c4347b3060c3891bf
MD5 4fb126d3888a10470c500dcb0f5f2f22
SHA1 330e3f2d3fc69da81b53a2b244a7ce41463a33a0
SHA512 ef4bfac14cae3d71084bd182cdae1ddd867add3da02921371398316a6b8a83602f43f8afd4e948781a2f9df58172c9edf1708442bdbe6a51686c6df4e034aab2
SSDEEP 98304:WUsWPAE4wyXb42e/pLrJhFm6NnpeKvlp5QVk2sV6TOgn/G03CcfMtEyzoF:WU5DyL42eJ9hUoQVk2sCL/X3CcfM+yzU
TLSH
T10C374A43E9A505E8C4ADD534C6669223BB717C484B3427D72F64F6293FB7BC06ABA700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion execution sparkrat persistence

Malware Config

Signatures

Family: Sparkrat
Sparkrat is a cross-platfrom backdoor written in Golang.
backdoor sparkrat

family_sparkrat 1 IoCs

Detects Sparkrat payload

resource	yara_rule
behavioral2/files/0x000e00000001c4ca-2.dat	family_sparkrat

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c4ca-2.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Executes dropped EXE 5 IoCs

pid	Process
3680	UpdateService.exe
4172	UpdateService.exe
624	UpdateService.exe
1284	UpdateService.exe
4876	UpdateService.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5568	sc.exe
1572	sc.exe
2516	sc.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6112	cmd.exe
4724	cmd.exe
4560	cmd.exe
2960	cmd.exe
2660	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4452	timeout.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
2660	taskkill.exe
3992	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5816	schtasks.exe
1828	schtasks.exe
4296	schtasks.exe
4456	schtasks.exe
2560	schtasks.exe
5840	schtasks.exe
4404	schtasks.exe
3836	schtasks.exe
1472	schtasks.exe
1476	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
940	2026-08-16_4fb126d3888a10470c500dcb0f5f2f22_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
940	2026-08-16_4fb126d3888a10470c500dcb0f5f2f22_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
3680	UpdateService.exe
3680	UpdateService.exe
4172	UpdateService.exe
4172	UpdateService.exe
4172	UpdateService.exe
1284	UpdateService.exe
1284	UpdateService.exe
1284	UpdateService.exe
4876	UpdateService.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeShutdownPrivilege	940	2026-08-16_4fb126d3888a10470c500dcb0f5f2f22_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Token: SeDebugPrivilege	940	2026-08-16_4fb126d3888a10470c500dcb0f5f2f22_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Token: SeDebugPrivilege	2660	taskkill.exe
Token: SeShutdownPrivilege	3680	UpdateService.exe
Token: SeDebugPrivilege	3680	UpdateService.exe
Token: SeShutdownPrivilege	4172	UpdateService.exe
Token: SeDebugPrivilege	4172	UpdateService.exe
Token: SeDebugPrivilege	3992	taskkill.exe
Token: SeShutdownPrivilege	1284	UpdateService.exe
Token: SeDebugPrivilege	1284	UpdateService.exe
Token: SeShutdownPrivilege	4876	UpdateService.exe
Token: SeDebugPrivilege	4876	UpdateService.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 5816	940	2026-08-16_4fb126d3888a10470c500dcb0f5f2f22_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	89
PID 940 wrote to memory of 2660	940	2026-08-16_4fb126d3888a10470c500dcb0f5f2f22_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	91
PID 940 wrote to memory of 2940	940	2026-08-16_4fb126d3888a10470c500dcb0f5f2f22_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	94
PID 940 wrote to memory of 4296	940	2026-08-16_4fb126d3888a10470c500dcb0f5f2f22_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	96
PID 3680 wrote to memory of 260	3680	UpdateService.exe	101
PID 4172 wrote to memory of 4392	4172	UpdateService.exe	103
PID 940 wrote to memory of 6112	940	2026-08-16_4fb126d3888a10470c500dcb0f5f2f22_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	107
PID 4172 wrote to memory of 624	4172	UpdateService.exe	109
PID 3680 wrote to memory of 3992	3680	UpdateService.exe	110
PID 6112 wrote to memory of 4724	6112	cmd.exe	112
PID 4724 wrote to memory of 4452	4724	cmd.exe	113
PID 4560 wrote to memory of 5568	4560	cmd.exe	116
PID 1284 wrote to memory of 2028	1284	UpdateService.exe	118
PID 1284 wrote to memory of 4456	1284	UpdateService.exe	120
PID 1284 wrote to memory of 4876	1284	UpdateService.exe	122
PID 4876 wrote to memory of 1536	4876	UpdateService.exe	123
PID 1284 wrote to memory of 5840	1284	UpdateService.exe	126
PID 1284 wrote to memory of 4404	1284	UpdateService.exe	128
PID 1284 wrote to memory of 3836	1284	UpdateService.exe	130
PID 2960 wrote to memory of 1572	2960	cmd.exe	134
PID 1284 wrote to memory of 1472	1284	UpdateService.exe	135
PID 1284 wrote to memory of 1476	1284	UpdateService.exe	137
PID 1284 wrote to memory of 5816	1284	UpdateService.exe	139
PID 1284 wrote to memory of 1828	1284	UpdateService.exe	141
PID 2660 wrote to memory of 2516	2660	cmd.exe	145
PID 1284 wrote to memory of 2560	1284	UpdateService.exe	146

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-16_4fb126d3888a10470c500dcb0f5f2f22_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_4fb126d3888a10470c500dcb0f5f2f22_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\system32\cmd.exe
  cmd ver
  2⤵
  PID:5816
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM UpdateService.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2660
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /TN WinUpdateSvcWatchdog
  2⤵
  PID:2940
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4296
- C:\Windows\system32\cmd.exe
  cmd.exe /C start /b "" C:\Users\Admin\AppData\Local\Temp\svc_cleanup_1786866958163016300.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\svc_cleanup_1786866958163016300.bat
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4724
  - - C:\Windows\system32\timeout.exe
      timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4452

C:\ProgramData\Microsoft\Update\UpdateService.exe
C:\ProgramData\Microsoft\Update\UpdateService.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Windows\system32\cmd.exe
  cmd ver
  2⤵
  PID:4392
- C:\ProgramData\Microsoft\Update\UpdateService.exe
  "C:\ProgramData\Microsoft\Update\UpdateService.exe" --ui-only
  2⤵
  - Executes dropped EXE
  PID:624

C:\ProgramData\Microsoft\Update\UpdateService.exe
C:\ProgramData\Microsoft\Update\UpdateService.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Windows\system32\cmd.exe
  cmd ver
  2⤵
  PID:260
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM UpdateService.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3992

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:2064

C:\Windows\system32\cmd.exe
"cmd.exe" /C "C:\ProgramData\Microsoft\Update\start_service.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\System32\sc.exe
  sc start WinUpdateSvc
  2⤵
  - Launches sc.exe
  PID:5568

C:\ProgramData\Microsoft\Update\UpdateService.exe
C:\ProgramData\Microsoft\Update\UpdateService.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\system32\cmd.exe
  cmd ver
  2⤵
  PID:2028
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4456
- C:\ProgramData\Microsoft\Update\UpdateService.exe
  "C:\ProgramData\Microsoft\Update\UpdateService.exe" --ui-only
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Windows\system32\cmd.exe
    cmd ver
    3⤵
    PID:1536
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5840
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4404
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3836
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1472
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1476
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5816
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1828
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2560

C:\Windows\system32\cmd.exe
"cmd.exe" /C "C:\ProgramData\Microsoft\Update\start_service.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\System32\sc.exe
  sc start WinUpdateSvc
  2⤵
  - Launches sc.exe
  PID:1572

C:\Windows\system32\cmd.exe
"cmd.exe" /C "C:\ProgramData\Microsoft\Update\start_service.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\System32\sc.exe
  sc start WinUpdateSvc
  2⤵
  - Launches sc.exe
  PID:2516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UpdateService.exe

Path C:\ProgramData\Microsoft\Update\UpdateService.exe
Size 21.4MB
SHA256 8df194078cce0d7a5ce65973efbd041e3a6771f773b15b8c4347b3060c3891bf
MD5 4fb126d3888a10470c500dcb0f5f2f22
SHA1 330e3f2d3fc69da81b53a2b244a7ce41463a33a0
SHA512 ef4bfac14cae3d71084bd182cdae1ddd867add3da02921371398316a6b8a83602f43f8afd4e948781a2f9df58172c9edf1708442bdbe6a51686c6df4e034aab2
SSDEEP 98304:WUsWPAE4wyXb42e/pLrJhFm6NnpeKvlp5QVk2sV6TOgn/G03CcfMtEyzoF:WU5DyL42eJ9hUoQVk2sCL/X3CcfM+yzU
TLSH
T10C374A43E9A505E8C4ADD534C6669223BB717C484B3427D72F64F6293FB7BC06ABA700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client.log

Path C:\ProgramData\Microsoft\Update\client.log
Size 10KB
SHA256 5138ae9bec4007138988ff1ba7da167d9a8c89c21d9320dae210406ea4af1499
MD5 8d4867c083e36824af8185958ad5998e
SHA1 8960015bd3b1550123dca4ed2225cfc12c30089e
SHA512 dcc92989d427b469afd18cf34212236ef1369f223d73ba16352a5c157660dc5d546f3de08286b35a7492dd063256bb3848a109742d1fe95edef4a192d659e8bd
SSDEEP 192:Wn7PfHNf53lqX9RERhi6MmqXMQVFpIG5C:Wn7PfHx5369RERhi66XMQFpIG5C
TLSH
T1DA225C0770D97AF1AD998ACFCD5B021CA314F375B30DB860B3E50A89584985D2B3F9E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client.log

Path C:\ProgramData\Microsoft\Update\client.log
Size 12KB
SHA256 803eba5119ceff684284026c100b753818096531f803b8de592c589cc91bd81c
MD5 38b6818b9deccbf9229efb6e5e64c420
SHA1 43c5985f14bfae420426439239c03d11d2ce9fa7
SHA512 8104168e28c4f32e93948db3c2717c7a5fb0745d39e0caec6b05114093496e65581a6fb8a2a4644f899554c9a668e2a9aaf4fc03bf864ee34695895d30872d09
SSDEEP 192:Wn7PfHNf53lqX9RERhi6MmqXMQVFpIG5D9ZdRN:Wn7PfHx5369RERhi66XMQFpIG5pRN
TLSH
T12C52990770D97AF1ED998ACECD5B021CA314F375B30DB855B3E50A89884985A2B3F5E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client.log

Path C:\ProgramData\Microsoft\Update\client.log
Size 4KB
SHA256 7e7e678a465b56447d470a74f74a39288f316ef335d3cf2af445f17a7ca312f9
MD5 e1429bbdf23f5baf23ece04dfe4642fc
SHA1 e7610040765f0f5218517172b90c1821c902a65e
SHA512 76394b1945ee3cc41b426fa889414d3cf3a6d41ed4845e0d3bdeba328b3eace7c81f692303cf7e1089294607c83a069fd11a2908ce335355516a3e0b6a47cbab
SSDEEP 96:6lv/Ub/GnPfm4Nf5ZXzJn3S7JcWQoTt0Nd:Wn7PfHNf53lR
TLSH
T133913B0771E67AF1FE995BCECD5B421C6304F276A30CB92073EA06C854468196A3FAD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client.log

Path C:\ProgramData\Microsoft\Update\client.log
Size 6KB
SHA256 7212a033f8d590c9723b39017fe7796893106a51a97d2b703110edbb178c4258
MD5 4cb039b1128aafcd815e0bf2fcbb2aa5
SHA1 c710abf6f0c126352afae65bca3275fb3c8fc40a
SHA512 b101fc97fa1e78712114638ae1997e8ac38cebfcb691e70d88513a2a687402e33fe3e27d60fa89c77bb0bcf77f9c9d055e85ff023388292415e8e16ab4bdf902
SSDEEP 96:6lv/Ub/GnPfm4Nf5ZXzJn3S7JcWQoTt0NW/v93hMjRhivCs5LaGprj:Wn7PfHNf53lqX9RERhi6MH
TLSH
T1DEE14E0770E57EF2BE999BCECD5B431CA304F275A30DB92073E505C854468196A3F9E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

start_service.cmd

Path C:\ProgramData\Microsoft\Update\start_service.cmd
Size 44B
SHA256 288893fb4b5598c4904c5af6fe12662560e574e5cbd0734ac42d94268d2710e9
MD5 256fecaa188c1065ad336c6b1017404e
SHA1 3d89461b3229f57cc77c3d52a4937deb4ffadd3b
SHA512 e5fa37ed5d0e6dc671732ad71f04c4c680aba71d8fd6e043396e1ebe214417abb9d0037e51b870a8a43879370c3784f983031efb0a13f8aa2a3ef5d6838b3507
MD5 SHA1 SHA512

Submit Download

svc_cleanup_1786866958163016300.bat

Path C:\Users\Admin\AppData\Local\Temp\svc_cleanup_1786866958163016300.bat
Size 234B
SHA256 6e8c90cb143d26d8a45ceeead292d109c53c506532375998f1daf4d6ee35d865
MD5 d1c26eec36765a9a5f81a4e35797092d
SHA1 ce8e2d5fadfea0221e86d3987ff6423e8fbbe8f0
SHA512 43d5adb863a550cbdeea04f712510b3ed746b9eef357f32de1238f64f04765b8b56f9850be2b2dc28253c4149b674c99dce68e847bc47ef523ab7c8326771c30
TLSH
T152D0A70F3C598E94044332D944FF244546DE52D78D407BC1C3C2996DA81B21B5653FC8
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads