Analysis
- max time kernel
149s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
25/08/2026, 15:00
General
- Target 2026-08-24_3d931737297aedbc39fe61ff8aad67a6_frostygoop_ghostlocker_glassworm_hijackloader_hive_luca-.exe
- Size 3.6MB
- Sample260825-sdgsms1sa1
- SHA256 f2ce07b0b41246e194900f52c9594e53a5951c9ff6a451ea6d0a17bb570a7e96
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_3d931737297aedbc39fe61ff8aad67a6_frostygoop_ghostlocker_glassworm_hijackloader_hive_luca-.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_3d931737297aedbc39fe61ff8aad67a6_frostygoop_ghostlocker_glassworm_hijackloader_hive_luca-.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\0a356e1e\d366c4998b82.exeC:\Users\Admin\AppData\Roaming\0a356e1e\d366c4998b82.exe -Command "Invoke-Expression $(Get-Content -Raw -Path 'C:\Users\Admin\AppData\Local\Temp\c0a9db419380049')"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rar.exe"C:\Users\Admin\AppData\Local\Temp\rar.exe" a -hpJsygt=47+.Q%KZ*X&kYjV-)$NvB8D0oG -m5 -v50m -ep1 -r -o+ -k -y -md256m C:\Users\Admin\AppData\Local\Temp\Archive_ba1e9a08-3969-44c3-ab6e-09f17582e60e\Archive_ba1e9a08-3969-44c3-ab6e-09f17582e60e.rar D:\TESTDATA3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
c0a9db419380049
rar.exe
Microsoft.Windows.Firewall.Commands.Resources.dll
d366c4998b82.exe
memory/3564-1069-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp
memory/3564-1072-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp
memory/3564-1065-0x000002B29ADA0000-0x000002B29ADC2000-memory.dmp
memory/3564-1066-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp
memory/3564-1067-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp
memory/3564-1068-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp
memory/3564-1061-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp
memory/3564-1070-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp
memory/3564-1071-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp
memory/3564-1064-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp
memory/3564-1073-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp
memory/3564-1074-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp
memory/3564-1075-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp
memory/3564-1060-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp
memory/3564-1077-0x000002B2B3610000-0x000002B2B37D2000-memory.dmp
memory/3564-1078-0x000002B2B3D10000-0x000002B2B4238000-memory.dmp
memory/3564-1059-0x00007FF89765F000-0x00007FF897660000-memory.dmp
memory/3564-1087-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp