08cca18d9cc0e51276cbaab7e37c5bc5ebc3e68401bf6005b18e969485916f50

Analysis

max time kernel
147s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 03:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_d7026169de8902baea245cef1d7f2c53_cobalt-strike_coinminer_dosia_ghostlocker_glassworm_luca.exe
Size 16.1MB
Sample260817-dxep3asyay
SHA256 08cca18d9cc0e51276cbaab7e37c5bc5ebc3e68401bf6005b18e969485916f50
MD5 d7026169de8902baea245cef1d7f2c53
SHA1 c53331298d972d7fcfb3a09e2691c6028adc0f01
SHA512 c22ff330ec355b2543d81beef6f5c21a0a7d05ab3b6a835cacad0770ccd1e63eb9aec5487a8525306d979bc06ab76fe907ae2cc43c5d2ff38448ce393855bf66
SSDEEP 98304:G4hVD+9Ir8EfHvb6YJkCLEniUTNIbi5nEhXMHIRMo6DQOWPTkVaVATjp5KQTqpE0:G2VD+9Ir1fzRJkhZRIb4EhcHI9k8
TLSH
T126074A06FA5649EBCA6452358CAF07863734EC442F27A7C71A15B63C7C732CA9EB8345
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion

Malware Config

Signatures

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2896	sc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 1468	2608	2026-08-17_d7026169de8902baea245cef1d7f2c53_cobalt-strike_coinminer_dosia_ghostlocker_glassworm_luca.exe	90
PID 2608 wrote to memory of 5828	2608	2026-08-17_d7026169de8902baea245cef1d7f2c53_cobalt-strike_coinminer_dosia_ghostlocker_glassworm_luca.exe	91
PID 2608 wrote to memory of 2896	2608	2026-08-17_d7026169de8902baea245cef1d7f2c53_cobalt-strike_coinminer_dosia_ghostlocker_glassworm_luca.exe	92

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5828	attrib.exe
1468	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-17_d7026169de8902baea245cef1d7f2c53_cobalt-strike_coinminer_dosia_ghostlocker_glassworm_luca.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_d7026169de8902baea245cef1d7f2c53_cobalt-strike_coinminer_dosia_ghostlocker_glassworm_luca.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\windowssystem
  2⤵
  - Views/modifies file attributes
  PID:1468
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\windowssystem\starter.exe
  2⤵
  - Views/modifies file attributes
  PID:5828
- C:\Windows\system32\sc.exe
  sc failure Nitrune "reset= 0" "actions= restart/5000"
  2⤵
  - Launches sc.exe
  PID:2896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

starter.exe

Path C:\Users\windowssystem\starter.exe
Size 16.1MB
SHA256 08cca18d9cc0e51276cbaab7e37c5bc5ebc3e68401bf6005b18e969485916f50
MD5 d7026169de8902baea245cef1d7f2c53
SHA1 c53331298d972d7fcfb3a09e2691c6028adc0f01
SHA512 c22ff330ec355b2543d81beef6f5c21a0a7d05ab3b6a835cacad0770ccd1e63eb9aec5487a8525306d979bc06ab76fe907ae2cc43c5d2ff38448ce393855bf66
SSDEEP 98304:G4hVD+9Ir8EfHvb6YJkCLEniUTNIbi5nEhXMHIRMo6DQOWPTkVaVATjp5KQTqpE0:G2VD+9Ir1fzRJkhZRIb4EhcHI9k8
TLSH
T126074A06FA5649EBCA6452358CAF07863734EC442F27A7C71A15B63C7C732CA9EB8345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2608-1-0x00007FF6408A0000-0x00007FF641892000-memory.dmp

Download