c6370515f367bc844aba13a9cc9ab188fb1df9b6149dc2559ae2540aa806a005

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/08/2026, 03:42

Target
2026-08-22_9ff67489dea55bc9d4f08ef9d0d7062a_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe
Size 8.3MB
Sample260823-d9qyvsdr21
SHA256 c6370515f367bc844aba13a9cc9ab188fb1df9b6149dc2559ae2540aa806a005
MD5 9ff67489dea55bc9d4f08ef9d0d7062a
SHA1 06b3f068dc648568f506223188e03e4fd4551f9b
SHA512 2335eefe0624c5bc8763a5aba46942db1ed26e18b3e2a4869a3e24088d664069f46681bfa9e439792fc29af9e6190821ebe14c81e4600c4c945aac565c07c452
SSDEEP 49152:pdfOSs68x/Srb/TuvO90d7HjmAFd4A64nsfJCwLQOWyZy7yOe7HkcmAytavAjubu:yR7Z0qa4jOvEiZGZBRA5RAE/WtUR
TLSH
T10E965B43F95482E9C1BAD234CA668262FA717C440B3063D72B50B7BA2F37BD45E7A354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4732	2026-08-22_9ff67489dea55bc9d4f08ef9d0d7062a_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe
1848	2026-08-22_9ff67489dea55bc9d4f08ef9d0d7062a_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 1848	4732	2026-08-22_9ff67489dea55bc9d4f08ef9d0d7062a_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-22_9ff67489dea55bc9d4f08ef9d0d7062a_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_9ff67489dea55bc9d4f08ef9d0d7062a_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_9ff67489dea55bc9d4f08ef9d0d7062a_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-22_9ff67489dea55bc9d4f08ef9d0d7062a_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe --foreground
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1848