Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/09/2026, 13:15
General
- Target 2026-09-23_1babf36d84ea75e0d061d1fc5c17c583_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
- Size 7.7MB
- Sample260924-qhllaavbkd
- SHA256 31a9bfb1203ca4750e019db195462d3e78b9470dc16eda052a5df6008a63fe40
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: MythicApollo
Mythic Apollo is a Windows agent written in C# for the Mythic C2 framework, used in SpecterOps training.
- Detects DonutLoader 1 IoCs
- Detects MythicApollo 3 IoCs
- Detects executables manipulated with Fody 2 IoCs
- Costura .NET executable packer 2 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_1babf36d84ea75e0d061d1fc5c17c583_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_1babf36d84ea75e0d061d1fc5c17c583_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/984-3-0x000001AC70CE0000-0x000001AC70E99000-memory.dmp
memory/984-6-0x00007FF875ACF000-0x00007FF875AD0000-memory.dmp
memory/984-8-0x00007FF875940000-0x00007FF8762E4000-memory.dmp
memory/984-7-0x000001AC73450000-0x000001AC73606000-memory.dmp
memory/984-9-0x000001AC72950000-0x000001AC729A4000-memory.dmp
memory/984-11-0x000001AC72B20000-0x000001AC72B2A000-memory.dmp
memory/984-14-0x000001AC72B40000-0x000001AC72B50000-memory.dmp
memory/984-16-0x00007FF875940000-0x00007FF8762E4000-memory.dmp
memory/984-15-0x00007FF875940000-0x00007FF8762E4000-memory.dmp
memory/984-13-0x000001AC72B30000-0x000001AC72B3E000-memory.dmp
memory/984-12-0x000001AC72920000-0x000001AC72930000-memory.dmp
memory/984-10-0x000001AC72930000-0x000001AC7293C000-memory.dmp
memory/984-18-0x000001AC73250000-0x000001AC7325A000-memory.dmp
memory/984-17-0x000001AC72B70000-0x000001AC72B78000-memory.dmp
memory/984-19-0x00007FF875940000-0x00007FF8762E4000-memory.dmp
memory/984-20-0x00007FF875940000-0x00007FF8762E4000-memory.dmp
memory/984-21-0x00007FF875940000-0x00007FF8762E4000-memory.dmp
memory/984-22-0x000001AC73260000-0x000001AC733CA000-memory.dmp
memory/984-23-0x000001AC73420000-0x000001AC7342A000-memory.dmp
memory/984-24-0x00007FF875940000-0x00007FF8762E4000-memory.dmp
memory/984-25-0x00007FF875940000-0x00007FF8762E4000-memory.dmp
memory/984-27-0x000001AC737B0000-0x000001AC737EC000-memory.dmp
memory/984-26-0x000001AC73750000-0x000001AC73762000-memory.dmp
memory/984-28-0x00007FF875940000-0x00007FF8762E4000-memory.dmp