Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
31/08/2026, 03:38
General
- Target 2026-08-30_d56138851d29f05cac0d1718f731d333_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
- Size 10.1MB
- Sample260831-d65mvathmh
- SHA256 625692f2b62e65e7bd6a961803e8898adf80dc1b13a941a65f898d87e65599b5
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-30_d56138851d29f05cac0d1718f731d333_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-30_d56138851d29f05cac0d1718f731d333_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN WinMgmtTask /TR C:\Users\Admin\AppData\Local\Temp\2026-08-30_d56138851d29f05cac0d1718f731d333_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe /SC ONLOGON /RL HIGHEST /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command " $filter = ([wmiclass]\"\.\root\subscription:__EventFilter\").CreateInstance() $filter.QueryLanguage = \"WQL\" $filter.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $filter.Name = \"WinMgmtFilter\" $filter.EventNamespace = 'root\cimv2' $filter.Put() | Out-Null $consumer = ([wmiclass]\"\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $consumer.Name = 'WinMgmtConsumer' $consumer.CommandLineTemplate = 'C:\Users\Admin\AppData\Local\Temp\2026-08-30_d56138851d29f05cac0d1718f731d333_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe' $consumer.Put() | Out-Null $bind = ([wmiclass]\"\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $bind.Filter = $filter $bind.Consumer = $consumer $bind.Put() | Out-Null "2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-30_d56138851d29f05cac0d1718f731d333_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exeC:\Users\Admin\AppData\Local\Temp\2026-08-30_d56138851d29f05cac0d1718f731d333_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN WinMgmtTask /TR C:\Users\Admin\AppData\Local\Temp\2026-08-30_d56138851d29f05cac0d1718f731d333_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe /SC ONLOGON /RL HIGHEST /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command " $filter = ([wmiclass]\"\.\root\subscription:__EventFilter\").CreateInstance() $filter.QueryLanguage = \"WQL\" $filter.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" $filter.Name = \"WinMgmtFilter\" $filter.EventNamespace = 'root\cimv2' $filter.Put() | Out-Null $consumer = ([wmiclass]\"\.\root\subscription:CommandLineEventConsumer\").CreateInstance() $consumer.Name = 'WinMgmtConsumer' $consumer.CommandLineTemplate = 'C:\Users\Admin\AppData\Local\Temp\2026-08-30_d56138851d29f05cac0d1718f731d333_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe' $consumer.Put() | Out-Null $bind = ([wmiclass]\"\.\root\subscription:__FilterToConsumerBinding\").CreateInstance() $bind.Filter = $filter $bind.Consumer = $consumer $bind.Put() | Out-Null "2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
memory/5668-10-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp
memory/5668-13-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp
memory/5668-5-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp
memory/5668-6-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp
memory/5668-7-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp
memory/5668-8-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp
memory/5668-2-0x0000019A0EB70000-0x0000019A0EB92000-memory.dmp
memory/5668-11-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp
memory/5668-9-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp
memory/5668-12-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp
memory/5668-0-0x00007FFE3558F000-0x00007FFE35590000-memory.dmp
memory/5668-15-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp
memory/5668-16-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp
memory/5668-1-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp
memory/5668-21-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp