73f90d0b24dae33fd7aca5187ff4789b3b41738b18328981be7db528bf4ca945

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 23:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_9d19bd198d246995ca5a5c760161a547_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe
Size 7.0MB
Sample260825-226lcazeqd
SHA256 73f90d0b24dae33fd7aca5187ff4789b3b41738b18328981be7db528bf4ca945
MD5 9d19bd198d246995ca5a5c760161a547
SHA1 625dc3443aa1fd41a6db6d99a0657f94198bb7f9
SHA512 6691054db74a2a49f83073372a2f3b9093cb16465b56ba3ae948c6f0addb5c644dd59f0c87aaab300d7417b6243afbbd98b52a980fb793b46b5ed357571f5f0d
SSDEEP 98304:Oc73qiu3g8TIvjESButfoF+6UGzzFBLzA2PP8w:Zmh3g8TI4SnCGVBL02P0
TLSH
T10E767D47EC9545A9C0AAA230C9B29253BA717C485B3123D33B90F73C2F77BD4AA79354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-08-23_9d19bd198d246995ca5a5c760161a547_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe	2026-08-23_9d19bd198d246995ca5a5c760161a547_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	3	Go-http-client/1.1

C:\Users\Admin\AppData\Local\Temp\2026-08-23_9d19bd198d246995ca5a5c760161a547_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_9d19bd198d246995ca5a5c760161a547_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe"
1⤵
- Creates a file in the Startup directory
PID:884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads