64a6f3168722a0324188899da47e47b956f8454d97d357b81fd92c04fe7e75df

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 03:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-24_720e32d9571de34d6f507dc275292ba2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 6.1MB
Sample260924-d3zmesdb32
SHA256 64a6f3168722a0324188899da47e47b956f8454d97d357b81fd92c04fe7e75df
MD5 720e32d9571de34d6f507dc275292ba2
SHA1 2e4ebd81bec44c76aa997adfb67788c3511ca274
SHA512 579d78bbc5fc952c6e5fca44eb47f7924fbc81716a613e23ad9ccc75205684564182a54a6b8202bc1d37f985b603d0475bcc1d108babb97aac614780189d44f9
SSDEEP 49152:meNFIU8m/ddNX35QaMQr4LO0PPIlMI2d4Syw30WpNFEiRJHOA/AzAo6/ffKiK9Kx:mGpduUQnIMX4Syq0MPp4kbb4E/sE
TLSH
T134563A07EC9555E5C0AAE2308A679352BB71BC485B3123D72F90F3292F76BD06EB9350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Clears Windows event logs 1 TTPs 3 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
1132	wevtutil.exe
1944	wevtutil.exe
1108	wevtutil.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost_32500.exe	2026-09-24_720e32d9571de34d6f507dc275292ba2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5468	cmd.exe
4140	cmd.exe
4548	cmd.exe

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	8	Go-http-client/1.1
HTTP User-Agent header	9	Go-http-client/1.1

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1132	wevtutil.exe
Token: SeBackupPrivilege	1132	wevtutil.exe
Token: SeSecurityPrivilege	1944	wevtutil.exe
Token: SeBackupPrivilege	1944	wevtutil.exe
Token: SeSecurityPrivilege	1108	wevtutil.exe
Token: SeBackupPrivilege	1108	wevtutil.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5728 wrote to memory of 5468	5728	2026-09-24_720e32d9571de34d6f507dc275292ba2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	90
PID 5468 wrote to memory of 1132	5468	cmd.exe	92
PID 5728 wrote to memory of 4140	5728	2026-09-24_720e32d9571de34d6f507dc275292ba2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	93
PID 4140 wrote to memory of 1944	4140	cmd.exe	95
PID 5728 wrote to memory of 4548	5728	2026-09-24_720e32d9571de34d6f507dc275292ba2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	96
PID 4548 wrote to memory of 1108	4548	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-09-24_720e32d9571de34d6f507dc275292ba2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_720e32d9571de34d6f507dc275292ba2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Creates a file in the Startup directory
- Suspicious use of WriteProcessMemory
PID:5728
- C:\Windows\system32\cmd.exe
  cmd /c "wevtutil cl Application"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5468
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl Application
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:1132
- C:\Windows\system32\cmd.exe
  cmd /c "wevtutil cl Security"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl Security
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:1944
- C:\Windows\system32\cmd.exe
  cmd /c "wevtutil cl System"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl System
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:1108