c6370515f367bc844aba13a9cc9ab188fb1df9b6149dc2559ae2540aa806a005

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 03:42

Target
2026-08-22_9ff67489dea55bc9d4f08ef9d0d7062a_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe
Size 8.3MB
Sample260823-d9qyvsdr21
SHA256 c6370515f367bc844aba13a9cc9ab188fb1df9b6149dc2559ae2540aa806a005
MD5 9ff67489dea55bc9d4f08ef9d0d7062a
SHA1 06b3f068dc648568f506223188e03e4fd4551f9b
SHA512 2335eefe0624c5bc8763a5aba46942db1ed26e18b3e2a4869a3e24088d664069f46681bfa9e439792fc29af9e6190821ebe14c81e4600c4c945aac565c07c452
SSDEEP 49152:pdfOSs68x/Srb/TuvO90d7HjmAFd4A64nsfJCwLQOWyZy7yOe7HkcmAytavAjubu:yR7Z0qa4jOvEiZGZBRA5RAE/WtUR
TLSH
T10E965B43F95482E9C1BAD234CA668262FA717C440B3063D72B50B7BA2F37BD45E7A354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4664	2026-08-22_9ff67489dea55bc9d4f08ef9d0d7062a_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe
5904	2026-08-22_9ff67489dea55bc9d4f08ef9d0d7062a_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 5904	4664	2026-08-22_9ff67489dea55bc9d4f08ef9d0d7062a_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-22_9ff67489dea55bc9d4f08ef9d0d7062a_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_9ff67489dea55bc9d4f08ef9d0d7062a_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_9ff67489dea55bc9d4f08ef9d0d7062a_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-22_9ff67489dea55bc9d4f08ef9d0d7062a_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe --foreground
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5904