Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/09/2026, 11:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
- Size 13.8MB
- Sample260910-m32lfsbk9v
- SHA256 2b2be82f03465ae09c6cc052e96219451c3c60db24738014ca91f8299cd935a2
- MD5 c2b6ec340d0086d894a7beb21760154e
- SHA1 6863ae812963f94b8f0848e12d714997fee695ee
- SHA512 80d39fe4cbe5f5eb919021f192ca43ee9181d9bdd22dee13ed80873e6533508a3afa14a76cabfbb6e4f3c3e433b6a63ca866e9e8f0f133eedc4c6a1b5f22110f
- SSDEEP 98304:dvTNY0hpfTxKD/6P1GyW1/SrzlAv2uslcrN6MeFiE3GddEdOx30kc1GQEUEj:dLTp7xcym1SGN6MeXqEdOx3CGQsj
- TLSH T19CE64B47E8A545E9C0E9D57586679257BE703C888B3063D36F50FA242F37BD0AEB9B00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions 2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools 2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe - Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 17 checkip.amazonaws.com 18 checkip.amazonaws.com 11 api.ipify.org - Discovers running processes 1 TTPs 2 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 2652 tasklist.exe 3572 tasklist.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2652 tasklist.exe Token: SeIncreaseQuotaPrivilege 2136 wmic.exe Token: SeSecurityPrivilege 2136 wmic.exe Token: SeTakeOwnershipPrivilege 2136 wmic.exe Token: SeLoadDriverPrivilege 2136 wmic.exe Token: SeSystemProfilePrivilege 2136 wmic.exe Token: SeSystemtimePrivilege 2136 wmic.exe Token: SeProfSingleProcessPrivilege 2136 wmic.exe Token: SeIncBasePriorityPrivilege 2136 wmic.exe Token: SeCreatePagefilePrivilege 2136 wmic.exe Token: SeBackupPrivilege 2136 wmic.exe Token: SeRestorePrivilege 2136 wmic.exe Token: SeShutdownPrivilege 2136 wmic.exe Token: SeDebugPrivilege 2136 wmic.exe Token: SeSystemEnvironmentPrivilege 2136 wmic.exe Token: SeRemoteShutdownPrivilege 2136 wmic.exe Token: SeUndockPrivilege 2136 wmic.exe Token: SeManageVolumePrivilege 2136 wmic.exe Token: 33 2136 wmic.exe Token: 34 2136 wmic.exe Token: 35 2136 wmic.exe Token: 36 2136 wmic.exe Token: SeIncreaseQuotaPrivilege 2136 wmic.exe Token: SeSecurityPrivilege 2136 wmic.exe Token: SeTakeOwnershipPrivilege 2136 wmic.exe Token: SeLoadDriverPrivilege 2136 wmic.exe Token: SeSystemProfilePrivilege 2136 wmic.exe Token: SeSystemtimePrivilege 2136 wmic.exe Token: SeProfSingleProcessPrivilege 2136 wmic.exe Token: SeIncBasePriorityPrivilege 2136 wmic.exe Token: SeCreatePagefilePrivilege 2136 wmic.exe Token: SeBackupPrivilege 2136 wmic.exe Token: SeRestorePrivilege 2136 wmic.exe Token: SeShutdownPrivilege 2136 wmic.exe Token: SeDebugPrivilege 2136 wmic.exe Token: SeSystemEnvironmentPrivilege 2136 wmic.exe Token: SeRemoteShutdownPrivilege 2136 wmic.exe Token: SeUndockPrivilege 2136 wmic.exe Token: SeManageVolumePrivilege 2136 wmic.exe Token: 33 2136 wmic.exe Token: 34 2136 wmic.exe Token: 35 2136 wmic.exe Token: 36 2136 wmic.exe Token: SeIncreaseQuotaPrivilege 2592 wmic.exe Token: SeSecurityPrivilege 2592 wmic.exe Token: SeTakeOwnershipPrivilege 2592 wmic.exe Token: SeLoadDriverPrivilege 2592 wmic.exe Token: SeSystemProfilePrivilege 2592 wmic.exe Token: SeSystemtimePrivilege 2592 wmic.exe Token: SeProfSingleProcessPrivilege 2592 wmic.exe Token: SeIncBasePriorityPrivilege 2592 wmic.exe Token: SeCreatePagefilePrivilege 2592 wmic.exe Token: SeBackupPrivilege 2592 wmic.exe Token: SeRestorePrivilege 2592 wmic.exe Token: SeShutdownPrivilege 2592 wmic.exe Token: SeDebugPrivilege 2592 wmic.exe Token: SeSystemEnvironmentPrivilege 2592 wmic.exe Token: SeRemoteShutdownPrivilege 2592 wmic.exe Token: SeUndockPrivilege 2592 wmic.exe Token: SeManageVolumePrivilege 2592 wmic.exe Token: 33 2592 wmic.exe Token: 34 2592 wmic.exe Token: 35 2592 wmic.exe Token: 36 2592 wmic.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4932 wrote to memory of 2548 4932 2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe 87 PID 4932 wrote to memory of 2652 4932 2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe 88 PID 4932 wrote to memory of 2136 4932 2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe 91 PID 4932 wrote to memory of 2592 4932 2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe 93 PID 4932 wrote to memory of 1492 4932 2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe 95 PID 4932 wrote to memory of 2364 4932 2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe 97 PID 4932 wrote to memory of 3572 4932 2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe 100 PID 4932 wrote to memory of 4864 4932 2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe 102 PID 4932 wrote to memory of 3392 4932 2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe 107 PID 4932 wrote to memory of 2712 4932 2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exeC:\Users\Admin\AppData\Local\Temp\2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe2⤵PID:2548
-
-
C:\Windows\system32\tasklist.exetasklist /fo csv /nh2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:2652
-
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get manufacturer2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2136
-
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2592
-
-
C:\Windows\System32\Wbem\wmic.exewmic diskdrive get model2⤵PID:1492
-
-
C:\Windows\system32\getmac.exegetmac /fo csv /nh2⤵PID:2364
-
-
C:\Windows\system32\tasklist.exetasklist /fo csv /nh2⤵
- Discovers running processes
PID:3572
-
-
C:\Windows\system32\curl.execurl -s --max-time 5 https://api.ipify.org2⤵PID:4864
-
-
C:\Windows\system32\curl.execurl -s --max-time 5 https://checkip.amazonaws.com2⤵PID:3392
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get lastbootuptime2⤵PID:2712
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\sv3_c2_debug.log
- Size 132B
- SHA256 275e162cd5b865f002f1d96e4f9119446e94af6696509ca6b77796490d06dbaa
- MD5 3f8ca6166ea9136df69dcfd09f3c8f94
- SHA1 ddf6ba3e3d96ce1d3608513f99dc782d5a34e638
- SHA512 7384072e3f955e07cb67a0e1ae8cc2f77f730e07a5d371cfe1810decd966599cad5bca7af2199d120ce8f21db75a691b039deb3757e9eea9d0a55eea93d8189d
- TLSH T17EC09BB5D4E1051B017A6521177E541B4883847B52403F5590EAF3DF5F6108513A1116
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\sv3_c2_debug.log
- Size 307B
- SHA256 79a350fc3baa536684b051e95f9b0f6e74dc7f2a3801e1b7f3f7b47d16493635
- MD5 0920536f6e1184a2fff9b0060e6ff889
- SHA1 d9ddcc12668bbf9f8422f9867ced552953d56ce4
- SHA512 37cc94f469e837415b323475201963378de0508f0efe8866eee6884dd377357394e94d42e3e0acf1d5aee3067518d6ca70c0282dcb00520e08965c1df77b8c07
- TLSH T12CE0CD79C7A1013E0776195016FE0537494F072656012F76B474679F9DD5442335C61E
- MD5 SHA1 SHA512 TLSH