Overview

overview

9

Static

static

3

2026-09-10...st.exe

windows10-2004-x64

9

2026-09-10...st.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/09/2026, 17:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-10_3e84530dd443b0d6ac3438553009de98_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
  • Size 15.5MB
  • Sample260910-weamhawsgw
  • SHA256 754a7e72a95ec74ee60b9a8d1eac7ea7ac273020cbdea9dcca12c6d11e945515
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Looks for VMWare Tools registry key 2 TTPs 2 IoCs
    defense_evasion
  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Looks up external IP address via web service 1 TTPs 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Discovers running processes 1 TTPs 4 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 53 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • cURL User-Agent 2 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-10_3e84530dd443b0d6ac3438553009de98_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-10_3e84530dd443b0d6ac3438553009de98_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
    1⤵
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Creates a file in the Startup directory
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4068
    • C:\Users\Admin\AppData\Local\Temp\2026-09-10_3e84530dd443b0d6ac3438553009de98_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-10_3e84530dd443b0d6ac3438553009de98_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
      2⤵
        PID:4664
      • C:\Windows\system32\tasklist.exe
        tasklist /fo csv /nh
        2⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:3912
      • C:\Windows\System32\Wbem\wmic.exe
        wmic computersystem get manufacturer
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2744
      • C:\Windows\System32\Wbem\wmic.exe
        wmic computersystem get model
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5180
      • C:\Windows\System32\Wbem\wmic.exe
        wmic diskdrive get model
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3216
      • C:\Windows\system32\getmac.exe
        getmac /fo csv /nh
        2⤵
          PID:5840
        • C:\Windows\system32\tasklist.exe
          tasklist /fo csv /nh
          2⤵
          • Discovers running processes
          PID:4552
        • C:\Windows\system32\curl.exe
          curl -s --max-time 5 https://api.ipify.org
          2⤵
            PID:1792
          • C:\Windows\System32\Wbem\wmic.exe
            wmic os get lastbootuptime
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:1656
          • C:\Windows\system32\cmd.exe
            cmd /C ver
            2⤵
            • Executes a command shell one-liner
            PID:5816
          • C:\Windows\system32\cmd.exe
            cmd /C ver
            2⤵
            • Executes a command shell one-liner
            PID:2768
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:4688
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:1120
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:540
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:4964
          • C:\Windows\system32\schtasks.exe
            schtasks /create /tn WindowsUpdater /tr C:\Users\Admin\AppData\Local\Temp\2026-09-10_3e84530dd443b0d6ac3438553009de98_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe /sc onlogon /rl highest /f
            2⤵
            • Scheduled Task/Job: Scheduled Task
            PID:5812
        • C:\Users\Admin\AppData\Local\Temp\2026-09-10_3e84530dd443b0d6ac3438553009de98_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
          C:\Users\Admin\AppData\Local\Temp\2026-09-10_3e84530dd443b0d6ac3438553009de98_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
          1⤵
          • Looks for VirtualBox Guest Additions in registry
          • Looks for VMWare Tools registry key
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2716
          • C:\Users\Admin\AppData\Local\Temp\2026-09-10_3e84530dd443b0d6ac3438553009de98_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
            C:\Users\Admin\AppData\Local\Temp\2026-09-10_3e84530dd443b0d6ac3438553009de98_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
            2⤵
              PID:4728
            • C:\Windows\system32\tasklist.exe
              tasklist /fo csv /nh
              2⤵
              • Discovers running processes
              PID:4900
            • C:\Windows\System32\Wbem\wmic.exe
              wmic computersystem get manufacturer
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:4976
            • C:\Windows\System32\Wbem\wmic.exe
              wmic computersystem get model
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:5380
            • C:\Windows\System32\Wbem\wmic.exe
              wmic diskdrive get model
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:3404
            • C:\Windows\system32\getmac.exe
              getmac /fo csv /nh
              2⤵
                PID:2436
              • C:\Windows\system32\tasklist.exe
                tasklist /fo csv /nh
                2⤵
                • Discovers running processes
                PID:3528
              • C:\Windows\system32\curl.exe
                curl -s --max-time 5 https://api.ipify.org
                2⤵
                  PID:1140
                • C:\Windows\System32\Wbem\wmic.exe
                  wmic os get lastbootuptime
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:260
                • C:\Windows\system32\cmd.exe
                  cmd /C ver
                  2⤵
                  • Executes a command shell one-liner
                  PID:1656
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1872
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4224
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:952
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4580
                • C:\Windows\system32\schtasks.exe
                  schtasks /create /tn WindowsUpdater /tr C:\Users\Admin\AppData\Local\Temp\2026-09-10_3e84530dd443b0d6ac3438553009de98_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe /sc onlogon /rl highest /f
                  2⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:1352

              Network

                    MITRE ATT&CK Enterprise v16

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Command and Scripting Interpreter

                    2
                    T1059

                    PowerShell

                    1
                    T1059.001

                    Windows Command Shell

                    1
                    T1059.003

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Persistence

                    Boot or Logon Autostart Execution

                    2
                    T1547

                    Registry Run Keys / Startup Folder

                    2
                    T1547.001

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Privilege Escalation

                    Boot or Logon Autostart Execution

                    2
                    T1547

                    Registry Run Keys / Startup Folder

                    2
                    T1547.001

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Defense Evasion

                    Modify Registry

                    1
                    T1112

                    Virtualization/Sandbox Evasion

                    2
                    T1497

                    Credential Access

                    Discovery

                    Process Discovery

                    1
                    T1057

                    Query Registry

                    3
                    T1012

                    System Network Configuration Discovery

                    1
                    T1016

                    Internet Connection Discovery

                    1
                    T1016.001

                    Virtualization/Sandbox Evasion

                    2
                    T1497

                    Lateral Movement

                    Collection

                    Command and Control

                    Exfiltration

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 f7680072ca5221cf2d0f5ef9769a208e6ade25923ae1978cfe80fbdc4748dc3a
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 f1e5d82b5a189ea2be5bcb97eaf21b4ff8cb785bf14b9b7d0c3532a3cd068d60
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 3122bb6da954dc4a07f27f1fb71f77f57f8a7491719f8bc1b4e65962b5f3bbc5
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 222f10e8ce2317e99402a6965f29f479b9cf68887a204bd8a82cb25b56c1de1a
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 7596c206de31f0a71480b6a308e6ced37e91134e394199ccf13b52b72fd665f0
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 dc4ebf4baa7b27ac79e1e8787c84c5adaaaad1ec2f83eaf97b5e28040afcf03b
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 4fb025787851a7d907bbb74dbaa2bcf930c1393531cdf7e15b15460ab7045df7
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    __PSScriptPolicyTest_frlaegx2.ni4.ps1
                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_frlaegx2.ni4.ps1
                    • Size 60B
                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    sv3_c2_debug.log
                    • Path C:\Users\Admin\AppData\Local\Temp\sv3_c2_debug.log
                    • Size 2KB
                    • SHA256 f95c2b925924ac86c2176c872c9063eca53e7a390fe689ee3468df10b8fc46fe
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    sv3_c2_debug.log
                    • Path C:\Users\Admin\AppData\Local\Temp\sv3_c2_debug.log
                    • Size 132B
                    • SHA256 f3ff1408c25188a69bf01d654f2e8f19403a5ed182e546435f36ee3c7ddc5f5c
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    sv3_c2_debug.log
                    • Path C:\Users\Admin\AppData\Local\Temp\sv3_c2_debug.log
                    • Size 301B
                    • SHA256 ddf2a9a4cddb2149337a4e98221665c91b8797ce737082746a60bc2b323bfc6b
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    sv3_c2_debug.log
                    • Path C:\Users\Admin\AppData\Local\Temp\sv3_c2_debug.log
                    • Size 1KB
                    • SHA256 15146e6f3053f7be555439592ec071b626e65ff97fceb903df640e59f1b28b09
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    sv3_c2_debug.log
                    • Path C:\Users\Admin\AppData\Local\Temp\sv3_c2_debug.log
                    • Size 1KB
                    • SHA256 ff85e82f9a422e44bcaff5fdac189079684035b6fa3afcf11696bbb83e1ea4f6
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    sv3_c2_debug.log
                    • Path C:\Users\Admin\AppData\Local\Temp\sv3_c2_debug.log
                    • Size 1KB
                    • SHA256 0ab9fa2f5dab07eab1b1aae465c8a31927b003a99627ff4cb325cbdb4b23704e
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    sv3_c2_debug.log
                    • Path C:\Users\Admin\AppData\Local\Temp\sv3_c2_debug.log
                    • Size 1KB
                    • SHA256 48eab2ec85712f418f3ed5af7a742c661c30b281c9ea1dda69dbe3d6cd83e8fe
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    sv3_debug.log
                    • Path C:\Users\Admin\AppData\Local\Temp\sv3_debug.log
                    • Size 328B
                    • SHA256 67b823108ad499926535e72f53bf603a2876738abc5d407d3bcfa1b9ff26af14
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    sv3_debug.log
                    • Path C:\Users\Admin\AppData\Local\Temp\sv3_debug.log
                    • Size 654B
                    • SHA256 b89c9a19b9741f992a695ae75c92564379989dd76db3669fcf7be2dd2379af2d
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    sv3_debug.log
                    • Path C:\Users\Admin\AppData\Local\Temp\sv3_debug.log
                    • Size 597B
                    • SHA256 30fae8ea378871306c084c9be0d78cbb2d06249e6b4361b8d7f23cda914ed0ca
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    sv3_debug.log
                    • Path C:\Users\Admin\AppData\Local\Temp\sv3_debug.log
                    • Size 680B
                    • SHA256 5f77cae035d1b2f64df9b69b167f482c06ed156e85db77b9b474063d4bc1ee6a
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    sv3_debug.log
                    • Path C:\Users\Admin\AppData\Local\Temp\sv3_debug.log
                    • Size 302B
                    • SHA256 22f8aa87366b91c39aaf40d67a74d365156fc3644625b75b6457149509533376
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    memory/4688-33-0x0000021BD46B0000-0x0000021BD46BA000-memory.dmp
                    Download

                    memory/4688-32-0x0000021BD4950000-0x0000021BD4A02000-memory.dmp
                    Download

                    memory/4688-31-0x0000021BD4690000-0x0000021BD46AE000-memory.dmp
                    Download

                    memory/4688-26-0x0000021BD45D0000-0x0000021BD45F2000-memory.dmp
                    Download