sparkrat | 36ab07248912467cb53538702ceda155937d09492ed146213cf8ce889aebe76b

General

Target
2026-08-21_eb2046d8e87ac87c22f69c95ee39c15d_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 21.4MB
Sample260821-eb17lssbrd
SHA256 36ab07248912467cb53538702ceda155937d09492ed146213cf8ce889aebe76b
MD5 eb2046d8e87ac87c22f69c95ee39c15d
SHA1 d35fe777477e81a17eb7cecbb8c1777b3e831609
SHA512 014228a6199291b193f39309ac97ed93b6f04d33641bf74e13ac1cf448bdd8f9f54742ebacaeab5841799136c95d0431b2ce3862da5aeebffdc11c11876b0f1f
SSDEEP 98304:vO3fTdpvQzxS2ngmqehxnCJNzVOHNG9b74+tV6TOgn/G0NCofMtE5zN9:vq/QtS2nhhpu9b74+tCL/XNCofM+5zb
TLSH
T19B374943E9A505E8C4ADD534C6A69322BB717C484B3427C72F64F6293F77BC06ABA740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion execution sparkrat persistence

Malware Config

Signatures

Family: Sparkrat
Sparkrat is a cross-platfrom backdoor written in Golang.
backdoor sparkrat

family_sparkrat 1 IoCs

Detects Sparkrat payload

resource	yara_rule
behavioral2/files/0x001100000001c528-2.dat	family_sparkrat

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
behavioral2/files/0x001100000001c528-2.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Executes dropped EXE 5 IoCs

pid	Process
3328	UpdateService.exe
976	UpdateService.exe
2656	UpdateService.exe
680	UpdateService.exe
2052	UpdateService.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5344	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3888	cmd.exe
2420	cmd.exe
5608	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1332	timeout.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
4888	taskkill.exe
3392	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2436	schtasks.exe
1296	schtasks.exe
4920	schtasks.exe
3940	schtasks.exe
4808	schtasks.exe
4376	schtasks.exe
2748	schtasks.exe
5260	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4324	2026-08-21_eb2046d8e87ac87c22f69c95ee39c15d_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
4324	2026-08-21_eb2046d8e87ac87c22f69c95ee39c15d_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
976	UpdateService.exe
3328	UpdateService.exe
976	UpdateService.exe
976	UpdateService.exe
3328	UpdateService.exe
680	UpdateService.exe
680	UpdateService.exe
680	UpdateService.exe
2052	UpdateService.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4324	2026-08-21_eb2046d8e87ac87c22f69c95ee39c15d_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Token: SeDebugPrivilege	4324	2026-08-21_eb2046d8e87ac87c22f69c95ee39c15d_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Token: SeDebugPrivilege	4888	taskkill.exe
Token: SeShutdownPrivilege	3328	UpdateService.exe
Token: SeShutdownPrivilege	976	UpdateService.exe
Token: SeDebugPrivilege	976	UpdateService.exe
Token: SeDebugPrivilege	3328	UpdateService.exe
Token: SeShutdownPrivilege	2656	UpdateService.exe
Token: SeDebugPrivilege	3392	taskkill.exe
Token: SeShutdownPrivilege	680	UpdateService.exe
Token: SeDebugPrivilege	680	UpdateService.exe
Token: SeShutdownPrivilege	2052	UpdateService.exe
Token: SeDebugPrivilege	2052	UpdateService.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 3344	4324	2026-08-21_eb2046d8e87ac87c22f69c95ee39c15d_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	88
PID 4324 wrote to memory of 4888	4324	2026-08-21_eb2046d8e87ac87c22f69c95ee39c15d_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	90
PID 4324 wrote to memory of 236	4324	2026-08-21_eb2046d8e87ac87c22f69c95ee39c15d_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	93
PID 4324 wrote to memory of 4920	4324	2026-08-21_eb2046d8e87ac87c22f69c95ee39c15d_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	95
PID 3328 wrote to memory of 2424	3328	UpdateService.exe	102
PID 976 wrote to memory of 2260	976	UpdateService.exe	103
PID 976 wrote to memory of 3940	976	UpdateService.exe	106
PID 4324 wrote to memory of 3888	4324	2026-08-21_eb2046d8e87ac87c22f69c95ee39c15d_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	107
PID 976 wrote to memory of 2656	976	UpdateService.exe	110
PID 2656 wrote to memory of 1564	2656	UpdateService.exe	111
PID 3328 wrote to memory of 3392	3328	UpdateService.exe	113
PID 3888 wrote to memory of 2420	3888	cmd.exe	115
PID 2420 wrote to memory of 1332	2420	cmd.exe	116
PID 5608 wrote to memory of 5344	5608	cmd.exe	120
PID 680 wrote to memory of 4976	680	UpdateService.exe	122
PID 680 wrote to memory of 4808	680	UpdateService.exe	124
PID 680 wrote to memory of 2052	680	UpdateService.exe	126
PID 2052 wrote to memory of 5136	2052	UpdateService.exe	127
PID 680 wrote to memory of 4376	680	UpdateService.exe	129
PID 680 wrote to memory of 2748	680	UpdateService.exe	131
PID 680 wrote to memory of 5260	680	UpdateService.exe	133
PID 680 wrote to memory of 2436	680	UpdateService.exe	135
PID 680 wrote to memory of 1296	680	UpdateService.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-21_eb2046d8e87ac87c22f69c95ee39c15d_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_eb2046d8e87ac87c22f69c95ee39c15d_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Windows\system32\cmd.exe
  cmd ver
  2⤵
  PID:3344
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM UpdateService.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4888
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /TN WinUpdateSvcWatchdog
  2⤵
  PID:236
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4920
- C:\Windows\system32\cmd.exe
  cmd.exe /C start /b "" C:\Users\Admin\AppData\Local\Temp\svc_cleanup_1787284038077160000.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\svc_cleanup_1787284038077160000.bat
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2420
  - - C:\Windows\system32\timeout.exe
      timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1332

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4300

C:\ProgramData\Microsoft\Update\UpdateService.exe
C:\ProgramData\Microsoft\Update\UpdateService.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:976
- C:\Windows\system32\cmd.exe
  cmd ver
  2⤵
  PID:2260
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3940
- C:\ProgramData\Microsoft\Update\UpdateService.exe
  "C:\ProgramData\Microsoft\Update\UpdateService.exe" --ui-only
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\system32\cmd.exe
    cmd ver
    3⤵
    PID:1564

C:\ProgramData\Microsoft\Update\UpdateService.exe
C:\ProgramData\Microsoft\Update\UpdateService.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\system32\cmd.exe
  cmd ver
  2⤵
  PID:2424
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM UpdateService.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3392

C:\Windows\system32\cmd.exe
"cmd.exe" /C "C:\ProgramData\Microsoft\Update\start_service.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5608
- C:\Windows\System32\sc.exe
  sc start WinUpdateSvc
  2⤵
  - Launches sc.exe
  PID:5344

C:\ProgramData\Microsoft\Update\UpdateService.exe
C:\ProgramData\Microsoft\Update\UpdateService.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:680
- C:\Windows\system32\cmd.exe
  cmd ver
  2⤵
  PID:4976
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4808
- C:\ProgramData\Microsoft\Update\UpdateService.exe
  "C:\ProgramData\Microsoft\Update\UpdateService.exe" --ui-only
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\system32\cmd.exe
    cmd ver
    3⤵
    PID:5136
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4376
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2748
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5260
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2436
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /F /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /TN WinUpdateSvcWatchdog /TR "cmd.exe /C \"C:\ProgramData\Microsoft\Update\start_service.cmd\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UpdateService.exe

Path C:\ProgramData\Microsoft\Update\UpdateService.exe
Size 21.4MB
SHA256 36ab07248912467cb53538702ceda155937d09492ed146213cf8ce889aebe76b
MD5 eb2046d8e87ac87c22f69c95ee39c15d
SHA1 d35fe777477e81a17eb7cecbb8c1777b3e831609
SHA512 014228a6199291b193f39309ac97ed93b6f04d33641bf74e13ac1cf448bdd8f9f54742ebacaeab5841799136c95d0431b2ce3862da5aeebffdc11c11876b0f1f
SSDEEP 98304:vO3fTdpvQzxS2ngmqehxnCJNzVOHNG9b74+tV6TOgn/G0NCofMtE5zN9:vq/QtS2nhhpu9b74+tCL/XNCofM+5zb
TLSH
T19B374943E9A505E8C4ADD534C6A69322BB717C484B3427C72F64F6293F77BC06ABA740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client.log

Path C:\ProgramData\Microsoft\Update\client.log
Size 10KB
SHA256 cafd39c08bff5ee00ee305b73ab63207c4ec95fb43310d69df0045ef1c44368f
MD5 ba2417d0909ea7d7ea7f2f21ee8eff69
SHA1 69238a0c585d6751421d60bf512f0c2ee41b7799
SHA512 1bbaa235e1aa113911d4e9359df9355224f8a37dc307daa10c64caf750a7e0df08b140fb4492f25dac3fd794181df30de08cf60bed56de16cb7813f5e1bd6f82
SSDEEP 96:p3rPOfL6ng2Y81pms5L1sB54IT2fEjWK4DfdHeiJjkS7a12j1MLhLJd6c+EZtKNE:OAf06zDfd+6kX1aOozSVJXYQJR6SzSm
TLSH
T150226C277AD974F2DD0989EFCD13011B125CB875B20CA970A3E70A8854ABC5B7B7E1E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client.log

Path C:\ProgramData\Microsoft\Update\client.log
Size 13KB
SHA256 586233934c45b0dcf6cc7ac176cc2d2169aaeb027a9179df53f242522868a0b1
MD5 65d8534e71ce63eb52e9513fdf7b05c9
SHA1 cc2fe2b8306c2695550059014ccc575759bd885a
SHA512 fce0c3a7153ac27cdb22044962344123841b374f83eac280978dd472b42f37384a84120a50f04c36f6890177c7259765f1e007a03901af732a009b882eb527f8
SSDEEP 192:OAf06zDfd+6kX1aOozSVJXYQJR6SzSU1w9f1xk7J:OAf06zDd+6kNvXYwR6SuJ9s7J
TLSH
T1E9529A2B7ADD70F2DD098CEFCD12015B1358F975B208A970A3E60A88556BC5B7B3E1E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client.log

Path C:\ProgramData\Microsoft\Update\client.log
Size 4KB
SHA256 eba0e4467fc12a98091837d5e9fbcf4ed276830fd26e991abff05bbef9958750
MD5 e39f2aa2ea631368c9c6ad59cf77d2f6
SHA1 5f088b1ad3b2cee9166c841a8a580b6ed7621e86
SHA512 b372ab8132b6cefa6559d23f1419bfe4cfa1f5c8f199424a931e7a0f444429a48b14ccc643bde1012f916b02f6569aa00f0ba3412061ed60bbad325f511d8fd2
SSDEEP 96:p3rPOfL6ng2Y81pms5L1sB54IT2fEjWK4DfdHeiJjkS7a1h:OAf06zDfd+6kX1h
TLSH
T1EC918B2B7AD974F29D0D89AFCD43451B130CB875B20CA93063E7098854A7C5B3B7E5E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client.log

Path C:\ProgramData\Microsoft\Update\client.log
Size 6KB
SHA256 012ad37053d9e62d73c2fc343a790211738cb70a693ca13b32385518aeebe088
MD5 2326fa6ec135d58c0798bc8abde21e02
SHA1 9117c12d06e0d594a7aac2952e11a6edb363f8f6
SHA512 d2bf3fab663db23cd2f8e0c9dc602d663321f6ad3077633836fabf4eaf8ad5e516d888b505ea41410f070d13eec421aa00e99b3e69856e2bf0ae288223ebab35
SSDEEP 96:p3rPOfL6ng2Y81pms5L1sB54IT2fEjWK4DfdHeiJjkS7a12j1MLhLJd6c+EZtKNZ:OAf06zDfd+6kX1aOozSE
TLSH
T16DE18A2B7AD974F2DD0989AFCD43451B121CF875B20CA93063E70A88546BC5B3B7E1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

start_service.cmd

Path C:\ProgramData\Microsoft\Update\start_service.cmd
Size 44B
SHA256 288893fb4b5598c4904c5af6fe12662560e574e5cbd0734ac42d94268d2710e9
MD5 256fecaa188c1065ad336c6b1017404e
SHA1 3d89461b3229f57cc77c3d52a4937deb4ffadd3b
SHA512 e5fa37ed5d0e6dc671732ad71f04c4c680aba71d8fd6e043396e1ebe214417abb9d0037e51b870a8a43879370c3784f983031efb0a13f8aa2a3ef5d6838b3507
MD5 SHA1 SHA512

Submit Download

svc_cleanup_1787284038077160000.bat

Path C:\Users\Admin\AppData\Local\Temp\svc_cleanup_1787284038077160000.bat
Size 234B
SHA256 5a23bec78038f3740b4754fc60c79c5c365fd0a39cbb6c6e2413164368b7d224
MD5 527a8ef36e7256bfeb3e98376cd75489
SHA1 692d9f0049fb92d93b6eca04364eba1bf1ebc393
SHA512 b30cc8b32e543f5b88155b5fcaaf46e6a4aad971d90de57b7543ca4fc8e70f459f5328d44ccd70b78c63667c193c9e5fbd27ebba5e1f40352677d4cebb46f4a1
TLSH
T1C0D0970F6858CF44000A30C280FE005242DE23838D007BC382D1C46CB04B68B29D3ECC
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads