2b2be82f03465ae09c6cc052e96219451c3c60db24738014ca91f8299cd935a2

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 11:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 13.8MB
Sample260910-m32lfsbk9v
SHA256 2b2be82f03465ae09c6cc052e96219451c3c60db24738014ca91f8299cd935a2
MD5 c2b6ec340d0086d894a7beb21760154e
SHA1 6863ae812963f94b8f0848e12d714997fee695ee
SHA512 80d39fe4cbe5f5eb919021f192ca43ee9181d9bdd22dee13ed80873e6533508a3afa14a76cabfbb6e4f3c3e433b6a63ca866e9e8f0f133eedc4c6a1b5f22110f
SSDEEP 98304:dvTNY0hpfTxKD/6P1GyW1/SrzlAv2uslcrN6MeFiE3GddEdOx30kc1GQEUEj:dLTp7xcym1SGN6MeXqEdOx3CGQsj
TLSH
T19CE64B47E8A545E9C0E9D57586679257BE703C888B3063D36F50FA242F37BD0AEB9B00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
4	api.ipify.org

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
6048	tasklist.exe
564	tasklist.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2368	wmic.exe
2368	wmic.exe
2368	wmic.exe
2368	wmic.exe
4368	wmic.exe
4368	wmic.exe
4368	wmic.exe
4368	wmic.exe
52	wmic.exe
52	wmic.exe
52	wmic.exe
52	wmic.exe
4500	wmic.exe
4500	wmic.exe
4500	wmic.exe
4500	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6048	tasklist.exe
Token: SeIncreaseQuotaPrivilege	2368	wmic.exe
Token: SeSecurityPrivilege	2368	wmic.exe
Token: SeTakeOwnershipPrivilege	2368	wmic.exe
Token: SeLoadDriverPrivilege	2368	wmic.exe
Token: SeSystemProfilePrivilege	2368	wmic.exe
Token: SeSystemtimePrivilege	2368	wmic.exe
Token: SeProfSingleProcessPrivilege	2368	wmic.exe
Token: SeIncBasePriorityPrivilege	2368	wmic.exe
Token: SeCreatePagefilePrivilege	2368	wmic.exe
Token: SeBackupPrivilege	2368	wmic.exe
Token: SeRestorePrivilege	2368	wmic.exe
Token: SeShutdownPrivilege	2368	wmic.exe
Token: SeDebugPrivilege	2368	wmic.exe
Token: SeSystemEnvironmentPrivilege	2368	wmic.exe
Token: SeRemoteShutdownPrivilege	2368	wmic.exe
Token: SeUndockPrivilege	2368	wmic.exe
Token: SeManageVolumePrivilege	2368	wmic.exe
Token: 33	2368	wmic.exe
Token: 34	2368	wmic.exe
Token: 35	2368	wmic.exe
Token: 36	2368	wmic.exe
Token: SeIncreaseQuotaPrivilege	2368	wmic.exe
Token: SeSecurityPrivilege	2368	wmic.exe
Token: SeTakeOwnershipPrivilege	2368	wmic.exe
Token: SeLoadDriverPrivilege	2368	wmic.exe
Token: SeSystemProfilePrivilege	2368	wmic.exe
Token: SeSystemtimePrivilege	2368	wmic.exe
Token: SeProfSingleProcessPrivilege	2368	wmic.exe
Token: SeIncBasePriorityPrivilege	2368	wmic.exe
Token: SeCreatePagefilePrivilege	2368	wmic.exe
Token: SeBackupPrivilege	2368	wmic.exe
Token: SeRestorePrivilege	2368	wmic.exe
Token: SeShutdownPrivilege	2368	wmic.exe
Token: SeDebugPrivilege	2368	wmic.exe
Token: SeSystemEnvironmentPrivilege	2368	wmic.exe
Token: SeRemoteShutdownPrivilege	2368	wmic.exe
Token: SeUndockPrivilege	2368	wmic.exe
Token: SeManageVolumePrivilege	2368	wmic.exe
Token: 33	2368	wmic.exe
Token: 34	2368	wmic.exe
Token: 35	2368	wmic.exe
Token: 36	2368	wmic.exe
Token: SeIncreaseQuotaPrivilege	4368	wmic.exe
Token: SeSecurityPrivilege	4368	wmic.exe
Token: SeTakeOwnershipPrivilege	4368	wmic.exe
Token: SeLoadDriverPrivilege	4368	wmic.exe
Token: SeSystemProfilePrivilege	4368	wmic.exe
Token: SeSystemtimePrivilege	4368	wmic.exe
Token: SeProfSingleProcessPrivilege	4368	wmic.exe
Token: SeIncBasePriorityPrivilege	4368	wmic.exe
Token: SeCreatePagefilePrivilege	4368	wmic.exe
Token: SeBackupPrivilege	4368	wmic.exe
Token: SeRestorePrivilege	4368	wmic.exe
Token: SeShutdownPrivilege	4368	wmic.exe
Token: SeDebugPrivilege	4368	wmic.exe
Token: SeSystemEnvironmentPrivilege	4368	wmic.exe
Token: SeRemoteShutdownPrivilege	4368	wmic.exe
Token: SeUndockPrivilege	4368	wmic.exe
Token: SeManageVolumePrivilege	4368	wmic.exe
Token: 33	4368	wmic.exe
Token: 34	4368	wmic.exe
Token: 35	4368	wmic.exe
Token: 36	4368	wmic.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 4952	3796	2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	89
PID 3796 wrote to memory of 6048	3796	2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	90
PID 3796 wrote to memory of 2368	3796	2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	93
PID 3796 wrote to memory of 4368	3796	2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	95
PID 3796 wrote to memory of 52	3796	2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	97
PID 3796 wrote to memory of 5648	3796	2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	99
PID 3796 wrote to memory of 564	3796	2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	102
PID 3796 wrote to memory of 2992	3796	2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	104
PID 3796 wrote to memory of 4500	3796	2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	106

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	4	curl/8.8.0

C:\Users\Admin\AppData\Local\Temp\2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Users\Admin\AppData\Local\Temp\2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
  C:\Users\Admin\AppData\Local\Temp\2026-09-10_c2b6ec340d0086d894a7beb21760154e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
  2⤵
  PID:4952
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:6048
- C:\Windows\System32\Wbem\wmic.exe
  wmic computersystem get manufacturer
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2368
- C:\Windows\System32\Wbem\wmic.exe
  wmic computersystem get model
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4368
- C:\Windows\System32\Wbem\wmic.exe
  wmic diskdrive get model
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:52
- C:\Windows\system32\getmac.exe
  getmac /fo csv /nh
  2⤵
  PID:5648
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Discovers running processes
  PID:564
- C:\Windows\system32\curl.exe
  curl -s --max-time 5 https://api.ipify.org
  2⤵
  PID:2992
- C:\Windows\System32\Wbem\wmic.exe
  wmic os get lastbootuptime
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sv3_c2_debug.log

Path C:\Users\Admin\AppData\Local\Temp\sv3_c2_debug.log
Size 132B
SHA256 bb3638b6d58fe8a8f6c8f9716ddabe8aebe7d2daa3ceaaefafc275b772bbb2d3
MD5 bc2dfe5facb8e3aa0c9925edca330d9c
SHA1 baed4e6d645fc3750bdd6c02e732f78369370c8e
SHA512 7b8e8c47f79be13f2c92b7a412bc711ce838113233a056a249f87909c8a303a17930c50b3f3097d8b4e046861bdecc1b1c8c119a6f413a92342a02363b2a4aad
TLSH
T1B6C08C71E4500016013B702413BA50020C83C02B6E00ABB490DAA1E9DBA208802B1055
MD5 SHA1 SHA512 TLSH

Submit Download

sv3_c2_debug.log

Path C:\Users\Admin\AppData\Local\Temp\sv3_c2_debug.log
Size 307B
SHA256 eb4c446a961a598fe4ad458f856b95ec00b8b0b5442b8e36ce9bc21db6f32d82
MD5 3a86a8a35665c1c08d6d1fa4c54677b4
SHA1 2a5a189e72b4e18f492abfc38630b26774ca6454
SHA512 b3a1c0d45f36c3795ebbecca080c79205f967dede5270c7a9078ee2de86e92b580315a208e9157d222e722273c3ed4e2138356ac2e4cb5f52a0b93a1f519d94f
TLSH
T1B4E0CD36C551013A07371A5433BA41324C8F83172A00EFF190BA579DEF57445937865E
MD5 SHA1 SHA512 TLSH

Submit Download