ae520fbcc16ecf2aad705a5f4c4f83720efc1d574a94f03f8a3c8ae10d95158a

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 00:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_ac2b858266a77b2521815e1ca9ebcb42_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
Size 11.7MB
Sample260905-azbjmsck81
SHA256 ae520fbcc16ecf2aad705a5f4c4f83720efc1d574a94f03f8a3c8ae10d95158a
MD5 ac2b858266a77b2521815e1ca9ebcb42
SHA1 920df1e33a6b3a4478f1afc6bd0e578e6237a013
SHA512 fae799e8a68824866e42cd37a373f478b9a866f984b8cf3ec74abf04db7a8d4519d65e3e401483512383b41caf8917dd0c9f70b533d3f5fd04f0ed4a6a6c2c29
SSDEEP 24576:nUnu/Tz1YimUCEVI0LHow5rU32EG/ysW4DO0dNGxuPNWhd8gW0mqiC/npnkWtisb:dLz1YzUc6yAruRsi
TLSH
T118C6AFB875047CE6E66F537BCA96ACD913723A229B8765CF4064B7C305733B5EE22804
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3552	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	2026-09-04_ac2b858266a77b2521815e1ca9ebcb42_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe

Executes dropped EXE 1 IoCs

pid	Process
2264	SgrmBroker_f67.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3552	powershell.exe
3552	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2264	SgrmBroker_f67.exe
Token: SeDebugPrivilege	3552	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3712 wrote to memory of 2264	3712	2026-09-04_ac2b858266a77b2521815e1ca9ebcb42_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe	86
PID 2264 wrote to memory of 3552	2264	SgrmBroker_f67.exe	87
PID 3552 wrote to memory of 4588	3552	powershell.exe	89
PID 4588 wrote to memory of 1480	4588	csc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-04_ac2b858266a77b2521815e1ca9ebcb42_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_ac2b858266a77b2521815e1ca9ebcb42_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\SgrmBroker_f67.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\SgrmBroker_f67.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -f C:\Users\Admin\AppData\Local\Temp\~4486354294b0a47f.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3552
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\n4inbc1l\n4inbc1l.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4588
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES46A9.tmp" "c:\Users\Admin\AppData\Local\Temp\n4inbc1l\CSC2730B381F52C4A81814EEF6938BC07C.TMP"
        5⤵
        
        PID:1480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SgrmBroker_f67.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\SgrmBroker_f67.exe
Size 5.1MB
SHA256 ed63c96a6a38c1fe5d429290fa17fc9cce28d488d92a86a68c839b8819d23f34
MD5 7649b0bca3ee24d6a45df06d325df017
SHA1 7bce8ffaffd4723e9691266dcc555369ddcb4b11
SHA512 964ac6aba0960dcd0add9966810cf79468b907d6be1c1b0ad48d5269fae3cc4015e4bf5464ea4a779773fe28ea115623c87e93b0bf7fffacdea6cc80edc69a99
SSDEEP 49152:sfkhu6huz0chw/EyF6pucLbn82K1VadjVljU5EObmHZGKPNc9g3qfBJV:CzzicRb824REOKhVgp
TLSH
T179364A17EC9545E8C0EED6318A628263BA717C484B3027D72F90F7382F76BD06A7A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES46A9.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES46A9.tmp
Size 1KB
SHA256 37b3b6581f09c0aebc8b85980dfc42617782584edc01f44a0377f1d92e59a8b7
MD5 6c1c6e05278b4ab130d67c17dc41c41e
SHA1 37c332aa6582cdfa4e8ad3a2609fb418416e5e6e
SHA512 0f451cd6fa8422d891f57069e955ccc990e3810866ee193dea4539052575a32df1a064191f091648e68d154de38ceec530cc8f85c9703c6bff0beef8d27b9a4a
TLSH
T12021AB0553ED4B1FF0B747327DFA172BA679FD94FF62936B854042282C51504EEA0AB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_pyfbuh5z.koz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pyfbuh5z.koz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

n4inbc1l.dll

Path C:\Users\Admin\AppData\Local\Temp\n4inbc1l\n4inbc1l.dll
Size 9KB
SHA256 231e14f6e889d4984ec6ba83d83891b90edadddc940114cf02fae5fd99cd33b6
MD5 8de156edd64f3cc049acc3cc2fde62d6
SHA1 5e6057ce4cedd61f8978b63db7de51cc76e5da9b
SHA512 307ddbd2168e72883e7d3182492ce6a6f788ad9b686e46eca2b00068374f555969f2a785b1b628dd660e0e7af87a7e40adf2cd4c5330090226316d15f89db192
SSDEEP 192:aXOU9TrlS1r55kBxV4Y4QDBvrgk1atxVB6Cw:aeGT85kBYvy8k1ajVcL
TLSH
T1C712932563FC8A17D6FA5775A573171005B2F969D332D38F0CA321ED4CF27984A12BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~4486354294b0a47f.ps1

Path C:\Users\Admin\AppData\Local\Temp\~4486354294b0a47f.ps1
Size 4KB
SHA256 b457db4de25c28e524027c33bc018992b78bfb2b10e6681be49a0c509d58587a
MD5 4feaed868a3b8741629b1d37259e701a
SHA1 657876c44322d4cb0efd8d0dedda8554a4ff3e8a
SHA512 e1e869f48d72915dfd2677253dc07543fdba8127835bf20a89a8eadf4ca6e6cbe648c373304653abf243bbed06d346de00be0909ed1a16ad4a2b1e4f772435c6
SSDEEP 96:D5VzJ7E2t4O4vOM4PL34r5UEbRLqBdBsvdgMcZjf9uW/V:TW2t4O4mM4PL34r5UEbx+Mcdf9usV
TLSH
T127A1451A427DC6BBD3B34C1F76C289541F67301DEB4529B2924BAC56C88364E123371D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC2730B381F52C4A81814EEF6938BC07C.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\n4inbc1l\CSC2730B381F52C4A81814EEF6938BC07C.TMP
Size 652B
SHA256 6813e7ba56c6de9e2e5a4913e0ac6666e9cfc7025aa0b9215618d2c3db05e2b1
MD5 d75c9c020c1ea961b2c9b9cd9bd2325e
SHA1 b3e08354c7247d75121839e089e852f9e97d7929
SHA512 c8ccc8415d918fee73ab4d3dcbf506957eaee0b3b9839b61d98cc46924fea9dcccf8a1e10c7840abcd8c57600553dd69a21432313eb83658f88873ecf2baeb50
TLSH
T1E1F05E0963F8020EF0F34B31BEF643A395A9FC64DE3293ED2440031928649108A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

n4inbc1l.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\n4inbc1l\n4inbc1l.0.cs
Size 4KB
SHA256 7e93bae292b301f21cc08eef16d842ce231eed83053c564836764b2c2a9f2db5
MD5 de0b6275a2a70889d6eb15e856ee97fa
SHA1 e1fdcac51628f91c0bbd977a9fcac2ec5b5ac68a
SHA512 7cf4bbdeef5c100b2b29b0576aeeec9df49f7d7d4773d5cd20d27db3909c28a8547cb41e0d76183ee32079af31ee4e3757858857227bf5a91222a1184c324e4a
SSDEEP 96:JVzJ7E2t4O4vOM4PL34r5UEbRL8BvBsvdgMcVzjY:vW2t4O4mM4PL34r5UEbh+Mc9Y
TLSH
T136A1531B427DCABBE3B34C1F77C289681F57305DEB4529B2A2476866888374E223371D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

n4inbc1l.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\n4inbc1l\n4inbc1l.cmdline
Size 607B
SHA256 f600a591e45de001735a62a668ecac05bd96f43bdf5713e4903783a897a284d8
MD5 1c727408e762981c492ea191c8d3c716
SHA1 e414d391e3297465d585b6547d238faee99c373d
SHA512 e4c7efbd9798e489311293a29aae035110c010c13b0b66f19ff2230141bbb0cd46815707c493ac70f00d1e61f3181ee1e3cca66ff28fa4a291b91a5bd4636545
TLSH
T176F0AC35233BC5BE45EA340F196F8A9CC237135B3482BF486989889EE5631102F90790
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3552-16-0x0000018E15150000-0x0000018E15172000-memory.dmp

Download

memory/3552-9-0x0000018E15140000-0x0000018E15150000-memory.dmp

Download

memory/3552-10-0x0000018E15140000-0x0000018E15150000-memory.dmp

Download

memory/3552-32-0x0000018E14C50000-0x0000018E14C58000-memory.dmp

Download

memory/3552-33-0x0000018E15140000-0x0000018E15150000-memory.dmp

Download

memory/3552-34-0x0000018E15140000-0x0000018E15150000-memory.dmp

Download