f2ce07b0b41246e194900f52c9594e53a5951c9ff6a451ea6d0a17bb570a7e96

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_3d931737297aedbc39fe61ff8aad67a6_frostygoop_ghostlocker_glassworm_hijackloader_hive_luca-.exe
Size 3.6MB
Sample260825-sdgsms1sa1
SHA256 f2ce07b0b41246e194900f52c9594e53a5951c9ff6a451ea6d0a17bb570a7e96
MD5 3d931737297aedbc39fe61ff8aad67a6
SHA1 45fc96a968bfd206b5bee190d496f78d055ba974
SHA512 c678f9e7a1ca171d0322669ba7a79880a32dd6bbb1844232c9da3c6d5ea0e93a9808cd70f89190a5ee8459671bcec9d61b67fc21a0194ca082a3f1298fd2a6f8
SSDEEP 49152:nobKqQJfUIW741aRNd4mhmxidhRlgH9XySl5XBdH35:omqTA8C5yAZBpJ
TLSH
T1F0068D02BF8019AAD09A5633C4A962567772BF44CB3273CF2B51B23B2A7EFD45634744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1988	574e650d4dab.exe
1376	rar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1988	574e650d4dab.exe
1988	574e650d4dab.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1988	574e650d4dab.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 1988	3504	2026-08-24_3d931737297aedbc39fe61ff8aad67a6_frostygoop_ghostlocker_glassworm_hijackloader_hive_luca-.exe	86
PID 1988 wrote to memory of 1376	1988	574e650d4dab.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-24_3d931737297aedbc39fe61ff8aad67a6_frostygoop_ghostlocker_glassworm_hijackloader_hive_luca-.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_3d931737297aedbc39fe61ff8aad67a6_frostygoop_ghostlocker_glassworm_hijackloader_hive_luca-.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Users\Admin\AppData\Roaming\2ef7e550\574e650d4dab.exe
  C:\Users\Admin\AppData\Roaming\2ef7e550\574e650d4dab.exe -Command "Invoke-Expression $(Get-Content -Raw -Path 'C:\Users\Admin\AppData\Local\Temp\e9f8351158263444')"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Users\Admin\AppData\Local\Temp\rar.exe
    "C:\Users\Admin\AppData\Local\Temp\rar.exe" a -hp&K2TQi70k*xPDIjAw3)U<!1hdz%+X;EO -m5 -v50m -ep1 -r -o+ -k -y -md256m C:\Users\Admin\AppData\Local\Temp\Archive_ce43842a-e4b4-40aa-8506-baa94ff30fcd\Archive_ce43842a-e4b4-40aa-8506-baa94ff30fcd.rar D:\TESTDATA
    3⤵
    - Executes dropped EXE
    PID:1376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_wuuon23j.s0r.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wuuon23j.s0r.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

e9f8351158263444

Path C:\Users\Admin\AppData\Local\Temp\e9f8351158263444
Size 857KB
SHA256 628ccc2f3e47e3fbf4713784853a4f2d36f902afd5de6a4ef6f6f170ea7a906f
MD5 0ee382d30e743ab3867b94515c6ce066
SHA1 97877fa31296132c4f8c33f1482a7c30ad7b1949
SHA512 9a39fafe5587f256595140033fe249cb8e6b432d936f56dfe6db8683d851ad1b532579ead67876674f8758800cc6ca60734f799118e5e5118914f65829cdcd97
SSDEEP 12288:BmH8ds1o2BB3QpvT0RIzgwfuBpn02KbNq8IBQEq3uHNIsmzI5lVodi2Vfbb/tOmj:ddv2BZsAIswfuBB0Zh2r/FmzIQXXk0
TLSH
T154158E3A8A57BCED26781C80D4162E496E2C36435668829DFDCC60FF67F8DA4CE1D970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\rar.exe
Size 629KB
SHA256 d1144b0fb4e1e8e5104c8bb90b54efcf964ce4fca482ee2f00698f871af9cb72
MD5 857c878011a55ddd434d0d27dbbdb0d1
SHA1 796f754090a9dfa44edf60ee4ee4475c6c51ba18
SHA512 1f2cda79f4d50d671fcb4fc9250a53e94ca4991c08ffba72a08b74df8b18c18d426537db8e13a3b46abc28e690509f6504cfca829b628245bc9bad552b1944a0
SSDEEP 12288:1p9b5mS6iKkwsKPlLyzgJxCryhi8W14MQY2Y9e3Pbojv:mPiKvsK9LwCAyhnOQVY9Abojv
TLSH
T14FD48E46A7E800F4F1B7E638CA664517F7B7784516708A4F03E9865B2F237A09F39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

574e650d4dab.exe

Path C:\Users\Admin\AppData\Roaming\2ef7e550\574e650d4dab.exe
Size 442KB
SHA256 6639a4a8125decca568bdecd4ae57108bb87bb9447a72d2abd2429090055cb2d
MD5 2b2b64b1a81b47d46e7d1aa472e507c1
SHA1 bf4e6df4fe7f4210c75d276911106a182c9d21fa
SHA512 4e544571e2b10d57f2e61d0cc4ad0104b6d0d22f1a495493f83551f724d17a185954426a9d2916052d809eaaa243510d5aee20bc7f4d2209f92151ba7426553e
SSDEEP 6144:r2fdXxswSX0z/YWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO6:qVXqXEgW2KXzJ4pdd3klnnWosPhnzq5
TLSH
T16BA45A976BD432D5D83AC435C83344520722BCB9DB919BDB99D8B23D0E712C09E3EA67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Windows.Firewall.Commands.Resources.dll

Path C:\Users\Admin\AppData\Roaming\2ef7e550\Modules\NetSecurity\it\Microsoft.Windows.Firewall.Commands.Resources.dll
Size 5KB
SHA256 d763a02a6b08ad1a4c0b5d4cebe6840e425bb69cffe084c27874386be5366572
MD5 d8fbcf4494a827061d390a8b26f30946
SHA1 c707a5f072498a3d2c09ba026cf46bcc48245f64
SHA512 0280e212b957d42b507e0f71651c7c061b44cca977af4f0f135fe6fe4129ee4e0caf9323539b7c459875cd00ccd7f214dad99bbbff99bfc10dc4365f6aad885e
SSDEEP 96:PkllUvXUTTp7DzD9Kx0IfeWj7af7lhxG45CR+W27W:c20EeWKT1GX8W27W
TLSH
T140C17641A7FC0626FDF31F716C739A4526BBF812DC22DB1E4890121A7C72A248A72F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1988-973-0x000001D877C20000-0x000001D877C30000-memory.dmp

Download

memory/1988-972-0x000001D877C20000-0x000001D877C30000-memory.dmp

Download

memory/1988-981-0x000001D879ED0000-0x000001D879EF2000-memory.dmp

Download

memory/1988-983-0x000001D87AD40000-0x000001D87AF02000-memory.dmp

Download

memory/1988-984-0x000001D87B440000-0x000001D87B968000-memory.dmp

Download

memory/1988-986-0x000001D877C20000-0x000001D877C30000-memory.dmp

Download