Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/09/2026, 08:05
Behavioral task
behavioral1
Sample
2026-09-11_e1a82d267ca715b786bfc10d40647dd4_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-11_e1a82d267ca715b786bfc10d40647dd4_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target 2026-09-11_e1a82d267ca715b786bfc10d40647dd4_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
- Size 10.1MB
- Sample260911-jy71wsdj4v
- SHA256 59bac4b810a527c2c668c21d24ca49265d5125f2e879d7e15e216e13796b5d68
- MD5 e1a82d267ca715b786bfc10d40647dd4
- SHA1 1591f407009feac4c49a1fd33ab40ff0c836f7cb
- SHA512 bbf3795025bfa025c688b105775f873dafc53103fc6c8f60916311ea2b7872a283903e37f2a51b247f50e547b08c197ae2b56f6785af7419ac22f8b411806e00
- SSDEEP 98304:SrtcRtikrjhVnGXYIrk478WE7BWAdkfMXH:ykjhVngkz7BOfMXH
- TLSH T1BDB65A07F89545E8C4EDD130C6668266BBB17C488B2067D72F60F7282F77BD06ABA750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 3268 2026-09-11_e1a82d267ca715b786bfc10d40647dd4_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe Token: SeDebugPrivilege 3268 2026-09-11_e1a82d267ca715b786bfc10d40647dd4_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3268 wrote to memory of 6240 3268 2026-09-11_e1a82d267ca715b786bfc10d40647dd4_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-11_e1a82d267ca715b786bfc10d40647dd4_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-11_e1a82d267ca715b786bfc10d40647dd4_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Windows\system32\cmd.execmd ver2⤵PID:6240
-