619cf940b7947067a21841934f7239789af057956eb653c9d6d503276d540a70

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4888	powershell.exe
4280	powershell.exe
4944	powershell.exe
5104	powershell.exe
4028	powershell.exe
4880	powershell.exe
2452	powershell.exe
4440	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

persistence privilege_escalation

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

Registry Run Keys / Startup Folder

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdater.exe	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdater = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdater = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Looks up external IP address via web service 1 TTPs 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
3	api.ipify.org
4	api.ipify.org
18	checkip.amazonaws.com
19	checkip.amazonaws.com
37	api.ipify.org
42	api.ipify.org
44	api.ipify.org

Discovers running processes 1 TTPs 4 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5036	tasklist.exe
452	tasklist.exe
872	tasklist.exe
2932	tasklist.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
916	cmd.exe
1868	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2020	schtasks.exe
3292	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4880	powershell.exe
4880	powershell.exe
2452	powershell.exe
2452	powershell.exe
4440	powershell.exe
4440	powershell.exe
4888	powershell.exe
4888	powershell.exe
4280	powershell.exe
4280	powershell.exe
4944	powershell.exe
4944	powershell.exe
5104	powershell.exe
5104	powershell.exe
4028	powershell.exe
4028	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	872	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4888	wmic.exe
Token: SeSecurityPrivilege	4888	wmic.exe
Token: SeTakeOwnershipPrivilege	4888	wmic.exe
Token: SeLoadDriverPrivilege	4888	wmic.exe
Token: SeSystemProfilePrivilege	4888	wmic.exe
Token: SeSystemtimePrivilege	4888	wmic.exe
Token: SeProfSingleProcessPrivilege	4888	wmic.exe
Token: SeIncBasePriorityPrivilege	4888	wmic.exe
Token: SeCreatePagefilePrivilege	4888	wmic.exe
Token: SeBackupPrivilege	4888	wmic.exe
Token: SeRestorePrivilege	4888	wmic.exe
Token: SeShutdownPrivilege	4888	wmic.exe
Token: SeDebugPrivilege	4888	wmic.exe
Token: SeSystemEnvironmentPrivilege	4888	wmic.exe
Token: SeRemoteShutdownPrivilege	4888	wmic.exe
Token: SeUndockPrivilege	4888	wmic.exe
Token: SeManageVolumePrivilege	4888	wmic.exe
Token: 33	4888	wmic.exe
Token: 34	4888	wmic.exe
Token: 35	4888	wmic.exe
Token: 36	4888	wmic.exe
Token: SeIncreaseQuotaPrivilege	4888	wmic.exe
Token: SeSecurityPrivilege	4888	wmic.exe
Token: SeTakeOwnershipPrivilege	4888	wmic.exe
Token: SeLoadDriverPrivilege	4888	wmic.exe
Token: SeSystemProfilePrivilege	4888	wmic.exe
Token: SeSystemtimePrivilege	4888	wmic.exe
Token: SeProfSingleProcessPrivilege	4888	wmic.exe
Token: SeIncBasePriorityPrivilege	4888	wmic.exe
Token: SeCreatePagefilePrivilege	4888	wmic.exe
Token: SeBackupPrivilege	4888	wmic.exe
Token: SeRestorePrivilege	4888	wmic.exe
Token: SeShutdownPrivilege	4888	wmic.exe
Token: SeDebugPrivilege	4888	wmic.exe
Token: SeSystemEnvironmentPrivilege	4888	wmic.exe
Token: SeRemoteShutdownPrivilege	4888	wmic.exe
Token: SeUndockPrivilege	4888	wmic.exe
Token: SeManageVolumePrivilege	4888	wmic.exe
Token: 33	4888	wmic.exe
Token: 34	4888	wmic.exe
Token: 35	4888	wmic.exe
Token: 36	4888	wmic.exe
Token: SeIncreaseQuotaPrivilege	1192	wmic.exe
Token: SeSecurityPrivilege	1192	wmic.exe
Token: SeTakeOwnershipPrivilege	1192	wmic.exe
Token: SeLoadDriverPrivilege	1192	wmic.exe
Token: SeSystemProfilePrivilege	1192	wmic.exe
Token: SeSystemtimePrivilege	1192	wmic.exe
Token: SeProfSingleProcessPrivilege	1192	wmic.exe
Token: SeIncBasePriorityPrivilege	1192	wmic.exe
Token: SeCreatePagefilePrivilege	1192	wmic.exe
Token: SeBackupPrivilege	1192	wmic.exe
Token: SeRestorePrivilege	1192	wmic.exe
Token: SeShutdownPrivilege	1192	wmic.exe
Token: SeDebugPrivilege	1192	wmic.exe
Token: SeSystemEnvironmentPrivilege	1192	wmic.exe
Token: SeRemoteShutdownPrivilege	1192	wmic.exe
Token: SeUndockPrivilege	1192	wmic.exe
Token: SeManageVolumePrivilege	1192	wmic.exe
Token: 33	1192	wmic.exe
Token: 34	1192	wmic.exe
Token: 35	1192	wmic.exe
Token: 36	1192	wmic.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 3224	4824	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	86
PID 4824 wrote to memory of 872	4824	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	87
PID 4824 wrote to memory of 4888	4824	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	90
PID 4824 wrote to memory of 1192	4824	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	92
PID 4824 wrote to memory of 4380	4824	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	94
PID 4824 wrote to memory of 4736	4824	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	96
PID 4824 wrote to memory of 2932	4824	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	99
PID 4824 wrote to memory of 4876	4824	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	101
PID 4824 wrote to memory of 3356	4824	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	108
PID 4824 wrote to memory of 4092	4824	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	117
PID 4824 wrote to memory of 916	4824	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	120
PID 4824 wrote to memory of 4880	4824	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	122
PID 4824 wrote to memory of 2452	4824	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	124
PID 4824 wrote to memory of 4440	4824	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	126
PID 4824 wrote to memory of 4888	4824	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	128
PID 4824 wrote to memory of 2020	4824	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	130
PID 2464 wrote to memory of 3448	2464	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	134
PID 2464 wrote to memory of 5036	2464	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	135
PID 2464 wrote to memory of 764	2464	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	137
PID 2464 wrote to memory of 2104	2464	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	139
PID 2464 wrote to memory of 2096	2464	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	141
PID 2464 wrote to memory of 516	2464	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	143
PID 2464 wrote to memory of 452	2464	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	145
PID 2464 wrote to memory of 3508	2464	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	147
PID 2464 wrote to memory of 4692	2464	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	150
PID 2464 wrote to memory of 1868	2464	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	153
PID 2464 wrote to memory of 4280	2464	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	155
PID 2464 wrote to memory of 4944	2464	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	157
PID 2464 wrote to memory of 5104	2464	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	159
PID 2464 wrote to memory of 4028	2464	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	161
PID 2464 wrote to memory of 3292	2464	2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	163

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Users\Admin\AppData\Local\Temp\2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
  C:\Users\Admin\AppData\Local\Temp\2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
  2⤵
  PID:3224
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:872
- C:\Windows\System32\Wbem\wmic.exe
  wmic computersystem get manufacturer
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4888
- C:\Windows\System32\Wbem\wmic.exe
  wmic computersystem get model
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1192
- C:\Windows\System32\Wbem\wmic.exe
  wmic diskdrive get model
  2⤵
  PID:4380
- C:\Windows\system32\getmac.exe
  getmac /fo csv /nh
  2⤵
  PID:4736
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Discovers running processes
  PID:2932
- C:\Windows\system32\curl.exe
  curl -s --max-time 5 https://api.ipify.org
  2⤵
  PID:4876
- C:\Windows\system32\curl.exe
  curl -s --max-time 5 https://checkip.amazonaws.com
  2⤵
  PID:3356
- C:\Windows\System32\Wbem\wmic.exe
  wmic os get lastbootuptime
  2⤵
  PID:4092
- C:\Windows\system32\cmd.exe
  cmd /C ver
  2⤵
  - Executes a command shell one-liner
  PID:916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4888
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsUpdater /tr C:\Users\Admin\AppData\Local\Temp\2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe /sc onlogon /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2020

C:\Users\Admin\AppData\Local\Temp\2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
C:\Users\Admin\AppData\Local\Temp\2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Users\Admin\AppData\Local\Temp\2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
  C:\Users\Admin\AppData\Local\Temp\2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
  2⤵
  PID:3448
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Discovers running processes
  PID:5036
- C:\Windows\System32\Wbem\wmic.exe
  wmic computersystem get manufacturer
  2⤵
  PID:764
- C:\Windows\System32\Wbem\wmic.exe
  wmic computersystem get model
  2⤵
  PID:2104
- C:\Windows\System32\Wbem\wmic.exe
  wmic diskdrive get model
  2⤵
  PID:2096
- C:\Windows\system32\getmac.exe
  getmac /fo csv /nh
  2⤵
  PID:516
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Discovers running processes
  PID:452
- C:\Windows\system32\curl.exe
  curl -s --max-time 5 https://api.ipify.org
  2⤵
  PID:3508
- C:\Windows\System32\Wbem\wmic.exe
  wmic os get lastbootuptime
  2⤵
  PID:4692
- C:\Windows\system32\cmd.exe
  cmd /C ver
  2⤵
  - Executes a command shell one-liner
  PID:1868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4028
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsUpdater /tr C:\Users\Admin\AppData\Local\Temp\2026-09-10_dcd8a35417a675e01a9210a2be846400_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe /sc onlogon /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion