Analysis
- max time kernel
148s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/08/2026, 03:29
General
- Target 2026-08-22_ce1a4e6d398d3114cdbf17add1744894_frostygoop_ghostlocker_glassworm_hijackloader_hive_luca-.exe
- Size 3.6MB
- Sample260822-d18gjs1aje
- SHA256 3a08d55a358e65c0beb14bde592288821c059f2505ac07a0a09549e3d63260de
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-22_ce1a4e6d398d3114cdbf17add1744894_frostygoop_ghostlocker_glassworm_hijackloader_hive_luca-.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-22_ce1a4e6d398d3114cdbf17add1744894_frostygoop_ghostlocker_glassworm_hijackloader_hive_luca-.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\dad340ec\e95a2ca60644.exeC:\Users\Admin\AppData\Roaming\dad340ec\e95a2ca60644.exe -Command "Invoke-Expression $(Get-Content -Raw -Path 'C:\Users\Admin\AppData\Local\Temp\7945c73759921092')"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rar.exe"C:\Users\Admin\AppData\Local\Temp\rar.exe" a -hpL+K_isIHcl9Zh:o5ru^<DGQ2OXN1at}J -m5 -v50m -ep1 -r -o+ -k -y -md256m C:\Users\Admin\AppData\Local\Temp\Archive_8017e691-481f-42e1-bb88-ceeac92d7510\Archive_8017e691-481f-42e1-bb88-ceeac92d7510.rar D:\TESTDATA3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
7945c73759921092
rar.exe
Microsoft.Windows.Firewall.Commands.Resources.dll
e95a2ca60644.exe
memory/5876-1069-0x00007FFB288F0000-0x00007FFB29294000-memory.dmp
memory/5876-1073-0x00000204ABA90000-0x00000204ABFB8000-memory.dmp
memory/5876-1065-0x00007FFB288F0000-0x00007FFB29294000-memory.dmp
memory/5876-1066-0x00007FFB288F0000-0x00007FFB29294000-memory.dmp
memory/5876-1067-0x00007FFB288F0000-0x00007FFB29294000-memory.dmp
memory/5876-1063-0x0000020492860000-0x0000020492882000-memory.dmp
memory/5876-1060-0x00007FFB288F0000-0x00007FFB29294000-memory.dmp
memory/5876-1070-0x00007FFB288F0000-0x00007FFB29294000-memory.dmp
memory/5876-1071-0x00000204AB390000-0x00000204AB552000-memory.dmp
memory/5876-1064-0x00007FFB288F0000-0x00007FFB29294000-memory.dmp
memory/5876-1072-0x00007FFB288F0000-0x00007FFB29294000-memory.dmp
memory/5876-1074-0x00007FFB288F0000-0x00007FFB29294000-memory.dmp
memory/5876-1075-0x00007FFB288F0000-0x00007FFB29294000-memory.dmp
memory/5876-1076-0x00007FFB288F0000-0x00007FFB29294000-memory.dmp
memory/5876-1077-0x00007FFB288F0000-0x00007FFB29294000-memory.dmp
memory/5876-1078-0x00007FFB288F0000-0x00007FFB29294000-memory.dmp
memory/5876-1079-0x00007FFB288F0000-0x00007FFB29294000-memory.dmp
memory/5876-1059-0x00007FFB28A7F000-0x00007FFB28A80000-memory.dmp
memory/5876-1088-0x00007FFB288F0000-0x00007FFB29294000-memory.dmp