210700f7ba939783b02d47bb04068487c4cb98d9166a729da88d56ba70b1b2e0

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_a202a50bcabe4cbd7e4defc3aaa471e6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 11.1MB
Sample260909-rxzbcsce54
SHA256 210700f7ba939783b02d47bb04068487c4cb98d9166a729da88d56ba70b1b2e0
MD5 a202a50bcabe4cbd7e4defc3aaa471e6
SHA1 7f3363509841594659d9a5a66dc0eabb441d038f
SHA512 a44a2afd04d47d6050e9a371f298a7f1bfaec5cbcbe8272efdb976b44df7c8b28c85da8700539d11cd0d37899621d5dfe0880d420a55ad0a5c3f08ddcdb0e1f2
SSDEEP 196608:h8hlXGGFpjtip8gl8oeQLU1cSkrGCmE/SZK:h8h99pjti228oc1dkrGCmQSM
TLSH
T171C67D07ECA159E9C0A9A23189B39252BB75BC491F3623D72F50B7382F72BD06E75740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
6908	miramaro-agent-setup.exe
7160	miramaro-agent-setup.exe
1508	miramaro-agent-setup.exe
4912	miramaro-agent.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Miramaro\miramaro-agent.exe	miramaro-agent-setup.exe
File opened for modification	C:\Program Files\Miramaro\agent.json	miramaro-agent-setup.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4912	miramaro-agent.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 6908	4472	2026-09-09_a202a50bcabe4cbd7e4defc3aaa471e6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	90
PID 4472 wrote to memory of 7160	4472	2026-09-09_a202a50bcabe4cbd7e4defc3aaa471e6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	92
PID 4472 wrote to memory of 1508	4472	2026-09-09_a202a50bcabe4cbd7e4defc3aaa471e6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	94
PID 1508 wrote to memory of 4812	1508	miramaro-agent-setup.exe	96
PID 1508 wrote to memory of 3156	1508	miramaro-agent-setup.exe	97
PID 1508 wrote to memory of 6236	1508	miramaro-agent-setup.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-09_a202a50bcabe4cbd7e4defc3aaa471e6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_a202a50bcabe4cbd7e4defc3aaa471e6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Users\Admin\AppData\Local\Miramaro\miramaro-agent-setup.exe
  C:\Users\Admin\AppData\Local\Miramaro\miramaro-agent-setup.exe install-event -flow-id bad8844f2ddc1b74c18a5308c26e8f3d -stage bundle_started -status done -detail "management-only bundle process started"
  2⤵
  - Executes dropped EXE
  PID:6908
- C:\Users\Admin\AppData\Local\Miramaro\miramaro-agent-setup.exe
  C:\Users\Admin\AppData\Local\Miramaro\miramaro-agent-setup.exe install-event -flow-id bad8844f2ddc1b74c18a5308c26e8f3d -stage uac_accepted -status done -detail "elevated bundle started"
  2⤵
  - Executes dropped EXE
  PID:7160
- C:\Users\Admin\AppData\Local\Miramaro\miramaro-agent-setup.exe
  C:\Users\Admin\AppData\Local\Miramaro\miramaro-agent-setup.exe install -flow-id bad8844f2ddc1b74c18a5308c26e8f3d
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\Windows\system32\schtasks.exe
    schtasks.exe /Delete /TN MiramaroWatchdog /F
    3⤵
    PID:4812
- - C:\Windows\system32\schtasks.exe
    schtasks.exe /Delete /TN MiramaroWatchdogBoot /F
    3⤵
    PID:3156
- - C:\Windows\system32\schtasks.exe
    schtasks.exe /Delete /TN MiramaroWatchdogBak /F
    3⤵
    PID:6236

C:\Program Files\Miramaro\miramaro-agent.exe
"C:\Program Files\Miramaro\miramaro-agent.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

agent.json

Path C:\Program Files\Miramaro\agent.json
Size 467B
SHA256 6943f62ceb0705cacc95e7b1358f2deb2bcec96d50c68e955f856f3bc364d48f
MD5 72aeaef6032203ed70f0f92d6b0159a7
SHA1 3801c6235c49a1301417f2469d54399302e5473b
SHA512 9adcca308b849c173db947062feae88b5dc64bfae6f6881737ea6d47d7f80fbc24a57b3c51e4ceede52012e3b3fbf660add9541e280abed752ed8925d3865a0b
TLSH
T115F0D4DBB054952B41D083939560344162DF693F6DD038C05F4355C8860B1B770B7F1E
MD5 SHA1 SHA512 TLSH

Submit Download

miramaro-agent-setup.exe

Path C:\Users\Admin\AppData\Local\Miramaro\miramaro-agent-setup.exe
Size 8.9MB
SHA256 0abb8b7174d787a1423a6076a210f21d421b0e269f474de733b298e4bcc51aa6
MD5 708bd5be000a1518741a1b0756fe8dc7
SHA1 cb1f7c1f81fa98ed5b5338f96f3bf7e49c902961
SHA512 95d7cfa829eeb75bd7408b2108c19755fca50ede31d26b9749f4e9d73f1e06ea3c7230932f2b3080d3a3514a1590cf12015aa5054051dc5ae95dd56ddd187f39
SSDEEP 98304:0Ofz1odJ7pjGi7ip3Clg4qAb5uEEeHHg3MaUC4cSkrGUAemEzbSL+07+Zs:0GGFpjtip8gl8oeQLU1cSkrGCmE/SZK
TLSH
T119967C13ECA159E9C1A9E331C9A39252BB71BC485B3623D32B50B7386F727D0AE75740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download