f644e9f664386857d47e74a2b6da30239f2f0e757b0a8934bb6a1bd45666ed57

General

Target
2026-08-24_ce7b2544b4a0bd6fcd16d226758cf24c_coinminer_elex_frostygoop_ghostlocker_glassworm_hive_poe.exe
Size 35.6MB
Sample260825-a3wc8a1vgz
SHA256 f644e9f664386857d47e74a2b6da30239f2f0e757b0a8934bb6a1bd45666ed57
MD5 ce7b2544b4a0bd6fcd16d226758cf24c
SHA1 67bf0228c0fed4e8feecb19c010642fcb228f18c
SHA512 30354746099ec9c62abdc0054cab1ac0b0011a1b2eebb1475b9ff2835573444c259a93d436175f8a207ff8fe4f7fb0cad5ddb7ec2797d65902b2e57f20e4b12a
SSDEEP 393216:EHpSKRD66oYxAE7ApUs74AoiXGkHKAzDsghTEBcBD:EHlxbTxl7ApR74AZHbsGfl
TLSH
T10C876C90E89B13F5EE03483084AF626F27346A04DB15DECBD614BE76F8379D3067A196
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation spyware trojan

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ExpressConnector2.lnk	2026-08-24_ce7b2544b4a0bd6fcd16d226758cf24c_coinminer_elex_frostygoop_ghostlocker_glassworm_hive_poe.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
8	api.ipify.org

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3368	tasklist.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 2 IoCs

pid	Process
4140	ExpressConnector2.exe
4324	ExpressConnector2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4656	cmd.exe
5244	cmd.exe
3908	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_ce7b2544b4a0bd6fcd16d226758cf24c_coinminer_elex_frostygoop_ghostlocker_glassworm_hive_poe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExpressConnector2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5996	timeout.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	ExpressConnector2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	ExpressConnector2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	ExpressConnector2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3368	tasklist.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 3368	1932	2026-08-24_ce7b2544b4a0bd6fcd16d226758cf24c_coinminer_elex_frostygoop_ghostlocker_glassworm_hive_poe.exe	90
PID 1932 wrote to memory of 5244	1932	2026-08-24_ce7b2544b4a0bd6fcd16d226758cf24c_coinminer_elex_frostygoop_ghostlocker_glassworm_hive_poe.exe	92
PID 5244 wrote to memory of 4140	5244	cmd.exe	94
PID 4140 wrote to memory of 3908	4140	ExpressConnector2.exe	95
PID 3908 wrote to memory of 4656	3908	cmd.exe	97
PID 4656 wrote to memory of 5996	4656	cmd.exe	99
PID 4656 wrote to memory of 692	4656	cmd.exe	100
PID 4656 wrote to memory of 4324	4656	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-24_ce7b2544b4a0bd6fcd16d226758cf24c_coinminer_elex_frostygoop_ghostlocker_glassworm_hive_poe.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_ce7b2544b4a0bd6fcd16d226758cf24c_coinminer_elex_frostygoop_ghostlocker_glassworm_hive_poe.exe"
1⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq ExpressConnector2.exe"
  2⤵
  - Discovers running processes
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3368
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C Start "Running Express Connector 2.0 ..." C:\Users\Admin\AppData\Local\KDK-ExpressConnector\ExpressConnector2.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5244
- - C:\Users\Admin\AppData\Local\KDK-ExpressConnector\ExpressConnector2.exe
    C:\Users\Admin\AppData\Local\KDK-ExpressConnector\ExpressConnector2.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4140
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C Start "Update Express Connector 2.0" C:/Users/Admin/AppData/Local/KDK-ExpressConnector/installU.bat 1547593329_tmpec2u
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3908
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:/Users/Admin/AppData/Local/KDK-ExpressConnector/installU.bat 1547593329_tmpec2u
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4656
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 2 /nobreak
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:5996
      - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\KDK-ExpressConnector\1547593329_tmpec2u\*.*" "C:\Users\Admin\AppData\Local\KDK-ExpressConnector\" /S /E /Y
        6⤵
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:692
      - C:\Users\Admin\AppData\Local\KDK-ExpressConnector\ExpressConnector2.exe
        
        "C:\Users\Admin\AppData\Local\KDK-ExpressConnector\ExpressConnector2.exe" cu=N dt="C:\Users\Admin\AppData\Local\KDK-ExpressConnector\1547593329_tmpec2u" db="C:/Users/Admin/AppData/Local/KDK-ExpressConnector/installU.bat"
        6⤵
        Executes dropped EXE
        Modifies system certificate store
        
        PID:4324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Process Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ExpressConnector2.exe

Path C:\Users\Admin\AppData\Local\KDK-ExpressConnector\1547593329_tmpec2u\ExpressConnector2.exe
Size 36.6MB
SHA256 e5813e77c12e27c9f5ec8480a507bbcdeb5e211304674de947b87eba25c23c45
MD5 e19355e5c31d73e6c8d05956c81933c9
SHA1 b05d85f99b9c36376a6f5206eeaa420dc559903b
SHA512 b3f5018071532e1fc4177b5a140dac4e71706d36d0cf419e7b4cda2e93c32eabbc325aa31dc354052b5d137e3a7b4e5057999773ab915661e9f4013f17c45e95
SSDEEP 393216:lioqV6J2AEWqlYIs3+FCg1Phi3/AMF/E8gxJZ:oPsICg1P4/AiE8gxP
TLSH
T1DF876C87E89551A8CAD9C130C56942127F713C859B303BDB2B61FAB42E33BD45BBE394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExpressConnector2.exe

Path C:\Users\Admin\AppData\Local\KDK-ExpressConnector\ExpressConnector2.exe
Size 35.6MB
SHA256 f644e9f664386857d47e74a2b6da30239f2f0e757b0a8934bb6a1bd45666ed57
MD5 ce7b2544b4a0bd6fcd16d226758cf24c
SHA1 67bf0228c0fed4e8feecb19c010642fcb228f18c
SHA512 30354746099ec9c62abdc0054cab1ac0b0011a1b2eebb1475b9ff2835573444c259a93d436175f8a207ff8fe4f7fb0cad5ddb7ec2797d65902b2e57f20e4b12a
SSDEEP 393216:EHpSKRD66oYxAE7ApUs74AoiXGkHKAzDsghTEBcBD:EHlxbTxl7ApR74AZHbsGfl
TLSH
T10C876C90E89B13F5EE03483084AF626F27346A04DB15DECBD614BE76F8379D3067A196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installU.bat

Path C:\Users\Admin\AppData\Local\KDK-ExpressConnector\installU.bat
Size 167B
SHA256 ef6c38b265f5019aac5aa9eeb13c2cdad42a987957d13a9aa74e4de788453a52
MD5 429047d832664af5b82e10e7fbcc6fb9
SHA1 e533998442a17273ae46225f01eda0bca1d6802d
SHA512 06d1a39e636067327cc39c1bb1130d8fbdfaf356e31c8ecd702ce3e551f54c6ccb24f656961139c35b39ecce80915e784b83f1ad25fc4ad3af6b48610f42617f
TLSH
T121C08C11000D4222764785530615BE02A0BAD1E7FA0202E1B060B06FA52F19578C9ACD
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-25.log

Path C:\Users\Admin\AppData\Roaming\kdk-express-connector2\logs\2026-08-25.log
Size 247B
SHA256 f4a48b3b20217eadacaae9b508c4b5ebc9d288e0faea57c0d763b5169e9daade
MD5 d81b017b0869a07b58bd59f94e94a99e
SHA1 77414a1ee996916728d890db406a4fb91af54cca
SHA512 aa15b6e33e2b6630908e620887e51666753ae92761303b4f2035adbf989f7fd6f242ab33ae7ab342215d4089d8205b61a0b93805f61985f1b46cf46a10833908
TLSH
T1CAD092D7836620FB3EE394A3ED84A1C310193B4CB9AC8A643033925281348BB13071E0
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-25.log

Path C:\Users\Admin\AppData\Roaming\kdk-express-connector2\logs\2026-08-25.log
Size 119B
SHA256 549fcdd2e6a0cb21bf4f3494f57e8668c59e824767d817329a4eca867842b040
MD5 b783cffb3fe8c030a987365b2cc8cfe2
SHA1 d34eef23446742284ea1e65cbe00605a0edcf158
SHA512 7d624fd6a0dd147735719896e54543cedbae0347fab93bcffa87ae5fe1bc563d2e69c7c4a7973291fa095a2fd573f54d005f44306cfa1908f9b315e328354fc7
TLSH
T144B00297C35610E72ED354A3EC916193445D364DA94C96A83576A116857846703470A1
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads