Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
31/08/2026, 19:51
General
- Target 2026-08-31_5c392756b47f654da73b60d91e3d01e6_coinminer_frostygoop_hive_knight_luca-stealer_poet-rat_s.exe
- Size 19.4MB
- Sample260831-yk52psyfne
- SHA256 5aad8ccb792216d4bee81738bc02e070bccf54a5cb721a2353dbfa78bd54aaf2
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-31_5c392756b47f654da73b60d91e3d01e6_coinminer_frostygoop_hive_knight_luca-stealer_poet-rat_s.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-31_5c392756b47f654da73b60d91e3d01e6_coinminer_frostygoop_hive_knight_luca-stealer_poet-rat_s.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile Get-StartApps2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5888-0-0x00007FFD36F6F000-0x00007FFD36F70000-memory.dmp
memory/5888-3-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/5888-4-0x000001A9F5180000-0x000001A9F51A2000-memory.dmp
memory/5888-5-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/5888-6-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/5888-7-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/5888-8-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/5888-9-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/5888-10-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/5888-13-0x000001A9F5210000-0x000001A9F522E000-memory.dmp
memory/5888-14-0x000001A9F5440000-0x000001A9F54F2000-memory.dmp
memory/5888-15-0x000001A9F5500000-0x000001A9F550A000-memory.dmp
memory/5888-16-0x000001A9F5780000-0x000001A9F579E000-memory.dmp
memory/5888-17-0x000001A9F5760000-0x000001A9F576A000-memory.dmp
memory/5888-18-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/5888-19-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/5888-20-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/5888-21-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/5888-22-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/5888-23-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/5888-24-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/5888-25-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/5888-27-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp