f900a9f7856f05ac00bf4aa4e7257b70e7d3d9f482a9fdc61766978efc4ca147

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-21_d58063611154563ded1590cc69362141_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe
Size 12.8MB
Sample260922-ltk2nstang
SHA256 f900a9f7856f05ac00bf4aa4e7257b70e7d3d9f482a9fdc61766978efc4ca147
MD5 d58063611154563ded1590cc69362141
SHA1 19043d9bef1cea3e3ce7c4bf7bd8b87d38f4057f
SHA512 630d920bfb2a40f4f082311c98fb46bc10dee62da3b44f67c439e36080ec0428d2f78df8f9bbcf5e2a6f51af7555191e0d917aaac2afa043145a3885ef03f443
SSDEEP 98304:bS3RqkGTk7HeiIEaPsVrwb7X/459q4tG20CwE1aIadaWtIrZg+HI:4G2wECsVrk/4HqHooIWagIrup
TLSH
T17BD67C11FACB58F5E903583140ABB27F63315D048B38DBDBEB143B2AF87B6A11966705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-21_d58063611154563ded1590cc69362141_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6036	2026-09-21_d58063611154563ded1590cc69362141_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe
6036	2026-09-21_d58063611154563ded1590cc69362141_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-21_d58063611154563ded1590cc69362141_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-21_d58063611154563ded1590cc69362141_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:6036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads