Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/08/2026, 14:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-23_3483f875b3dc3e5ff116659e39707455_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-23_3483f875b3dc3e5ff116659e39707455_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target 2026-08-23_3483f875b3dc3e5ff116659e39707455_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver.exe
- Size 2.0MB
- Sample260824-rm5emadg86
- SHA256 57d9ed21810cb157c16e9e626f7b22bca244014d4d0247d625317e4afc4202f1
- MD5 3483f875b3dc3e5ff116659e39707455
- SHA1 f223d5d6190651a8113cd876782bc589b2b2698b
- SHA512 8b978646068d27bba4f08576d3e73cc9d2ee33d85a49c4c11098feadfe5bfc2c1a8d238249cc32e761f3319d093705cc718c20719be056261e8bc28fc1ddba41
- SSDEEP 49152:pZau5V2ETTRLvjSlLmCf/BEO7xn0JzhWLqJ+gKVHt6Hz1:fnLUJERJ6N
- TLSH T129A58C07BC91A4B9C4AAD2328A2692D176307C881B31A3D73B90B7FD2F767D41E79354
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Path
-
C:\ProgramData\Readme_Instructions.html
Ransom Note
- <!DOCTYPE HTML> <html><head><title>infected with ransomware virus</title> <meta http-equiv="X-UA-Compatible" content="IE=edge"> </head> <body style="margin: 0.4em; font-size: 14pt;"><p>!!! Your files are encrypted !!!<br><br>*All your files are protected with encryption*<br>*There is no public decryption software.*<br>*All files/documents/software with ".CRYPT" extension is encrypted*<br><br><br>###### Program and private key, What is the price? The price depends on how fast you can pay us.!######<br>1 day : 50 Bitcoin<br>2 day : 60 Bitcoin<br>3 day : 90 Bitcoin<br>4 day : 130 Bitcoin<br> 5 day : permanent data loss !!!!<br><br> ***How to contact our team through tox chat***<br><br>*Download tox chat from<br>*<a href="https://tox.chat/download.html">https://tox.chat/download.html</a><br>*send us friend request to tox chat id <br><br>7D8796EB86CBF29F53F8A8447EABAF310ED898D9DEFF97AE09C1864C2A6B3B14ED8F82AE9B9D<br><br>*Our team is waiting*<br><br>!!!!For immediate decryption!!!<br><br>write to our email:<br><br><a href="mailto:[email protected]">[email protected]</a><br><br> *After payment received, we will send private key to your IT department.!!!*<br><br> *Free decryption As a guarantee, you can send us up to 3 free decrypted files before payment.*<br><br>!!! We have downloaded all your files to our servers and will release data if you do not comply.!!!<br>!!! Do not attempt to decrypt your data using third-party software, this will result in permanent data loss.!!!</p></body></html>
Emails
-
href="mailto:[email protected]">[email protected]</a><br><br>
URLs
-
http-equiv="X-UA-Compatible"
Signatures
- Renames multiple (9239) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Readme_Instructions.html explorer.exe - Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5036 set thread context of 4712 5036 2026-08-23_3483f875b3dc3e5ff116659e39707455_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver.exe 86 - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote.gpd explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\[email protected] explorer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ru-ru\Readme_Instructions.html explorer.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml explorer.exe File created C:\Program Files\VideoLAN\VLC\hrtfs\Readme_Instructions.html explorer.exe File created C:\Program Files (x86)\Common Files\System\ado\ja-JP\Readme_Instructions.html explorer.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\javafx\glib.md explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ppd.xrm-ms explorer.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\Readme_Instructions.html explorer.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\VisualElements\LogoBeta.png explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ui-strings.js explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\new_icons.png explorer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\Readme_Instructions.html explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul-oob.xrm-ms explorer.exe File created C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\Readme_Instructions.html explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENFR\MSB1ENFR.ITS explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Schoolbook.xml explorer.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{1D3AEF70-1DB8-49F2-839D-DA72081B59A0}\Readme_Instructions.html explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.ONENOTE.16.1033.hxn explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons__retina_hiContrast_wob.png explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fill-sign-2x.png explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-140.png explorer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\plugins\Readme_Instructions.html explorer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\Readme_Instructions.html explorer.exe File opened for modification C:\Program Files\Google\Chrome\Application\initial_preferences explorer.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png explorer.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\ga.pak explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-pl.xrm-ms explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\APPTL.ICO explorer.exe File created C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\Readme_Instructions.html explorer.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\AdSelectionAttestationsPreloaded\Readme_Instructions.html explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected] explorer.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\main.css explorer.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\en-US.pak.DATA explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filter-down_32.svg explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\sfs_icons.png explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\main-selector.css explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fi-fi\ui-strings.js explorer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\hu-hu\Readme_Instructions.html explorer.exe File opened for modification C:\Program Files\WindowsPowerShell explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ul-oob.xrm-ms explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-pl.xrm-ms explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1036\MSO.ACL explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\DarkTheme.acrotheme explorer.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml explorer.exe File created C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\Readme_Instructions.html explorer.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\ta.pak explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-pl.xrm-ms explorer.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ja_MASCULINE.pak explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\PAPYRUS.TTF explorer.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\SYSTEM\MSMAPI\Readme_Instructions.html explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\as90.xsl explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\es-es\ui-strings.js explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ul-oob.xrm-ms explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Delete.White.png explorer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-ma\Readme_Instructions.html explorer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ko-kr\Readme_Instructions.html explorer.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md explorer.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\tr.pak.DATA explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons.png explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-gb\ui-strings.js explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ppd.xrm-ms explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ppd.xrm-ms explorer.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3976 cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe 4712 explorer.exe - Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeBackupPrivilege 4572 vssvc.exe Token: SeRestorePrivilege 4572 vssvc.exe Token: SeAuditPrivilege 4572 vssvc.exe Token: SeIncreaseQuotaPrivilege 2244 WMIC.exe Token: SeSecurityPrivilege 2244 WMIC.exe Token: SeTakeOwnershipPrivilege 2244 WMIC.exe Token: SeLoadDriverPrivilege 2244 WMIC.exe Token: SeSystemProfilePrivilege 2244 WMIC.exe Token: SeSystemtimePrivilege 2244 WMIC.exe Token: SeProfSingleProcessPrivilege 2244 WMIC.exe Token: SeIncBasePriorityPrivilege 2244 WMIC.exe Token: SeCreatePagefilePrivilege 2244 WMIC.exe Token: SeBackupPrivilege 2244 WMIC.exe Token: SeRestorePrivilege 2244 WMIC.exe Token: SeShutdownPrivilege 2244 WMIC.exe Token: SeDebugPrivilege 2244 WMIC.exe Token: SeSystemEnvironmentPrivilege 2244 WMIC.exe Token: SeRemoteShutdownPrivilege 2244 WMIC.exe Token: SeUndockPrivilege 2244 WMIC.exe Token: SeManageVolumePrivilege 2244 WMIC.exe Token: 33 2244 WMIC.exe Token: 34 2244 WMIC.exe Token: 35 2244 WMIC.exe Token: 36 2244 WMIC.exe Token: SeIncreaseQuotaPrivilege 2244 WMIC.exe Token: SeSecurityPrivilege 2244 WMIC.exe Token: SeTakeOwnershipPrivilege 2244 WMIC.exe Token: SeLoadDriverPrivilege 2244 WMIC.exe Token: SeSystemProfilePrivilege 2244 WMIC.exe Token: SeSystemtimePrivilege 2244 WMIC.exe Token: SeProfSingleProcessPrivilege 2244 WMIC.exe Token: SeIncBasePriorityPrivilege 2244 WMIC.exe Token: SeCreatePagefilePrivilege 2244 WMIC.exe Token: SeBackupPrivilege 2244 WMIC.exe Token: SeRestorePrivilege 2244 WMIC.exe Token: SeShutdownPrivilege 2244 WMIC.exe Token: SeDebugPrivilege 2244 WMIC.exe Token: SeSystemEnvironmentPrivilege 2244 WMIC.exe Token: SeRemoteShutdownPrivilege 2244 WMIC.exe Token: SeUndockPrivilege 2244 WMIC.exe Token: SeManageVolumePrivilege 2244 WMIC.exe Token: 33 2244 WMIC.exe Token: 34 2244 WMIC.exe Token: 35 2244 WMIC.exe Token: 36 2244 WMIC.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 5036 wrote to memory of 4712 5036 2026-08-23_3483f875b3dc3e5ff116659e39707455_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver.exe 86 PID 5036 wrote to memory of 4712 5036 2026-08-23_3483f875b3dc3e5ff116659e39707455_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver.exe 86 PID 5036 wrote to memory of 4712 5036 2026-08-23_3483f875b3dc3e5ff116659e39707455_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver.exe 86 PID 5036 wrote to memory of 4712 5036 2026-08-23_3483f875b3dc3e5ff116659e39707455_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver.exe 86 PID 5036 wrote to memory of 4712 5036 2026-08-23_3483f875b3dc3e5ff116659e39707455_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver.exe 86 PID 5036 wrote to memory of 4712 5036 2026-08-23_3483f875b3dc3e5ff116659e39707455_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver.exe 86 PID 5036 wrote to memory of 4712 5036 2026-08-23_3483f875b3dc3e5ff116659e39707455_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver.exe 86 PID 5036 wrote to memory of 4712 5036 2026-08-23_3483f875b3dc3e5ff116659e39707455_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver.exe 86 PID 4712 wrote to memory of 3976 4712 explorer.exe 90 PID 3976 wrote to memory of 2244 3976 cmd.exe 92 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_3483f875b3dc3e5ff116659e39707455_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-23_3483f875b3dc3e5ff116659e39707455_cobalt-strike_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Creates a file in the Startup directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BA86B02A-A1F4-4E02-A3B0-DFFA92F0CCAD}'" delete3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BA86B02A-A1F4-4E02-A3B0-DFFA92F0CCAD}'" delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2244
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4572
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Readme_Instructions.html
- Size 1KB
- SHA256 cef2395cc2ae718f07b84bdbae435752c0e7049aa6de8488ab045c07f5fd0b37
- MD5 9ae54b4efc9f30245782c6001f69b120
- SHA1 3de64c5e9732699b76510728e43f408c131a995e
- SHA512 fbbb0e2bf0d11756dba1d9bf0183a2f0ec94ee729d97740ed3ba47b3f99922188fc04fdbc255f51a3544fa3bfc7ed588d3aabb45de0ed59ed96ce6d15daeed75
- TLSH T17D3155DFBE241495065A16E931B495F37E137BC8B390CD510489880A64A17795A638D6
- MD5 SHA1 SHA512 TLSH