Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
16/08/2026, 15:23
General
- Target 2026-08-16_0d61b59b6bd704d9e66ca35de4e8dafa_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe
- Size 12.8MB
- Sample260816-ssl1xa1cnd
- SHA256 213fc869bd323b3173ba685b5213b31cbadca736e5e3921da9ccfe3bbd7ce15a
Score
7/10
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_0d61b59b6bd704d9e66ca35de4e8dafa_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_0d61b59b6bd704d9e66ca35de4e8dafa_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe"1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-16_0d61b59b6bd704d9e66ca35de4e8dafa_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\AutoVPNRouter\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5756.3684.8175329374946500633 /pfhostedapp:d132326477eb1fa0f8db7d553f419d7318692e572⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\AutoVPNRouter\webview\EBWebView /prefetch:4 /pfhostedapp:d132326477eb1fa0f8db7d553f419d7318692e57 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\AutoVPNRouter\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x120,0x194,0x7ff9616e5fd8,0x7ff9616e5fe4,0x7ff9616e5ff03⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\AutoVPNRouter\webview\EBWebView" --webview-exe-name=2026-08-16_0d61b59b6bd704d9e66ca35de4e8dafa_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1772 --field-trial-handle=1776,i,3529223916644453490,9296251803687915105,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:d132326477eb1fa0f8db7d553f419d7318692e573⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\AutoVPNRouter\webview\EBWebView" --webview-exe-name=2026-08-16_0d61b59b6bd704d9e66ca35de4e8dafa_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2052 --field-trial-handle=1776,i,3529223916644453490,9296251803687915105,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:d132326477eb1fa0f8db7d553f419d7318692e573⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\AutoVPNRouter\webview\EBWebView" --webview-exe-name=2026-08-16_0d61b59b6bd704d9e66ca35de4e8dafa_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2232 --field-trial-handle=1776,i,3529223916644453490,9296251803687915105,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:d132326477eb1fa0f8db7d553f419d7318692e573⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\AutoVPNRouter\webview\EBWebView" --webview-exe-name=2026-08-16_0d61b59b6bd704d9e66ca35de4e8dafa_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3536 --field-trial-handle=1776,i,3529223916644453490,9296251803687915105,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:d132326477eb1fa0f8db7d553f419d7318692e57 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=proxy_resolver.mojom.ProxyResolverFactory --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\AutoVPNRouter\webview\EBWebView" --webview-exe-name=2026-08-16_0d61b59b6bd704d9e66ca35de4e8dafa_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=3972 --field-trial-handle=1776,i,3529223916644453490,9296251803687915105,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:d132326477eb1fa0f8db7d553f419d7318692e573⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\AutoVPNRouter\webview\EBWebView" --webview-exe-name=2026-08-16_0d61b59b6bd704d9e66ca35de4e8dafa_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1068 --field-trial-handle=1776,i,3529223916644453490,9296251803687915105,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:d132326477eb1fa0f8db7d553f419d7318692e573⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\pacjsworker.exeC:\Windows\system32\pacjsworker.exe d657fcc0-0293-4e3d-93c0-97df79ba21e2 56b05182-84fa-4522-8f8f-d2feb1eb0aff1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
settings.dat
settings.dat
throttle_store.dat
the-real-index
the-real-index~RFe59207e.TMP
Network Persistent State
Network Persistent State~RFe59f766.TMP
SCT Auditing Pending Reports
Preferences
MANIFEST-000001
ffecbbeb-877b-4d58-a15a-22e8d839e1eb.tmp
000001.dbtmp
data_0
data_1
data_2
data_3
Local State
Local State
Local State
Local State
Local State
Local State~RFe58cef3.TMP
memory/1220-230-0x000001C6ED830000-0x000001C6ED9F3000-memory.dmp
memory/1220-223-0x000001C6ED830000-0x000001C6ED9F3000-memory.dmp
memory/1220-71-0x00007FF982FD0000-0x00007FF982FD1000-memory.dmp
memory/2648-174-0x00007FF983800000-0x00007FF983801000-memory.dmp
memory/2648-173-0x00007FF9831A0000-0x00007FF9831A1000-memory.dmp
memory/5388-166-0x00007FF982FD0000-0x00007FF982FD1000-memory.dmp
memory/5444-289-0x000002EC901B0000-0x000002EC901B1000-memory.dmp
memory/5444-291-0x000002EC901B0000-0x000002EC901B1000-memory.dmp
memory/5444-298-0x000002EC901B0000-0x000002EC901B1000-memory.dmp
memory/5444-300-0x000002EC901B0000-0x000002EC901B1000-memory.dmp
memory/5444-297-0x000002EC901B0000-0x000002EC901B1000-memory.dmp
memory/5444-296-0x000002EC901B0000-0x000002EC901B1000-memory.dmp
memory/5444-295-0x000002EC901B0000-0x000002EC901B1000-memory.dmp
memory/5444-299-0x000002EC901B0000-0x000002EC901B1000-memory.dmp
memory/5756-9-0x000001EF507C0000-0x000001EF507E8000-memory.dmp