Overview

overview

7

Static

static

3

2026-09-24...er.exe

windows10-2004-x64

7

2026-09-24...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    25/09/2026, 10:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-24_45f94bf039a1984930a8b2e974cb4caf_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
  • Size 2.5MB
  • Sample260925-m3m33athpc
  • SHA256 b45e00f9d75568e61f6260ef6df4c5ad8c835aa34c85987dcccb101d3317c2b7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasionexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 4 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Drops file in System32 directory 16 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 16 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_45f94bf039a1984930a8b2e974cb4caf_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_45f94bf039a1984930a8b2e974cb4caf_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:1168
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\738b8265.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:2996
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn Updatea702cc /tr C:\Users\Admin\AppData\Local\Temp\2026-09-24_45f94bf039a1984930a8b2e974cb4caf_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:1220
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\4d6be81a.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:652
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command " $s = New-Object -comObject WScript.Shell $l = $s.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systemd7ec9.lnk\") $l.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-09-24_45f94bf039a1984930a8b2e974cb4caf_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\" $l.Save() "
      2⤵
      • Creates a file in the Startup directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5196
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\f297de2e.exe
      2⤵
      • Views/modifies file attributes
      PID:4828
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\9206801b.exe
      2⤵
      • Views/modifies file attributes
      PID:4940
  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_45f94bf039a1984930a8b2e974cb4caf_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-24_45f94bf039a1984930a8b2e974cb4caf_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:3328
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn Update9ae262 /tr C:\Users\Admin\AppData\Local\Temp\2026-09-24_45f94bf039a1984930a8b2e974cb4caf_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2268
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\7d93ac85.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:1720
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command " $s = New-Object -comObject WScript.Shell $l = $s.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System09e77.lnk\") $l.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-09-24_45f94bf039a1984930a8b2e974cb4caf_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\" $l.Save() "
      2⤵
      • Creates a file in the Startup directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5896
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\794d6725.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:5936
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\87b67b41.exe
      2⤵
      • Views/modifies file attributes
      PID:3044
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\ed8afa20.exe
      2⤵
      • Views/modifies file attributes
      PID:872
  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_45f94bf039a1984930a8b2e974cb4caf_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-24_45f94bf039a1984930a8b2e974cb4caf_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:5808
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\9a17553d.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:3240
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn Update2cb284 /tr C:\Users\Admin\AppData\Local\Temp\2026-09-24_45f94bf039a1984930a8b2e974cb4caf_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:3364
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\0a2aef46.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:2584
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command " $s = New-Object -comObject WScript.Shell $l = $s.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systeme1098.lnk\") $l.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-09-24_45f94bf039a1984930a8b2e974cb4caf_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\" $l.Save() "
      2⤵
      • Creates a file in the Startup directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:6088
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\fec686b5.exe
      2⤵
      • Views/modifies file attributes
      PID:2060
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\c66c1c5f.exe
      2⤵
      • Views/modifies file attributes
      PID:4924
  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_45f94bf039a1984930a8b2e974cb4caf_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-24_45f94bf039a1984930a8b2e974cb4caf_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:1768
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn Updatefd22c8 /tr C:\Users\Admin\AppData\Local\Temp\2026-09-24_45f94bf039a1984930a8b2e974cb4caf_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:1960
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\fef36843.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:5712
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command " $s = New-Object -comObject WScript.Shell $l = $s.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System739b3.lnk\") $l.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-09-24_45f94bf039a1984930a8b2e974cb4caf_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\" $l.Save() "
      2⤵
      • Creates a file in the Startup directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2360
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\14da2321.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:5528
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\52bbf350.exe
      2⤵
      • Views/modifies file attributes
      PID:5880
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\35d26987.exe
      2⤵
      • Views/modifies file attributes
      PID:3184

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        powershell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        • Size 2KB
        • SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 c3b902373ade4b2a21c8e2dc3316e38731f75f20fd07ee2003310d97ba542bf3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 4c54d05ea168e041fb78ab1e0ab805969d1b75a58baac93db2c792ac76ab73a5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        35d26987.exe
        • Path C:\Users\Admin\AppData\Local\Temp\35d26987.exe
        • Size 2.5MB
        • SHA256 53fce6fb278eedaa6a51b3fcc5f42aba751e5607eb386315ffeb798f720648f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        9206801b.exe
        • Path C:\Users\Admin\AppData\Local\Temp\9206801b.exe
        • Size 2.5MB
        • SHA256 f829929a55f5e6d73f7a5b1bf31803279aaafee356f0a1e9abbebaad18aa530c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_5izpqncb.ot3.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5izpqncb.ot3.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        c66c1c5f.exe
        • Path C:\Users\Admin\AppData\Local\Temp\c66c1c5f.exe
        • Size 2.5MB
        • SHA256 9dd33ecaf5d74fef696312d0a1756f36f38db8ebc575e4f06667d8c9d5ff7d92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ed8afa20.exe
        • Path C:\Users\Admin\AppData\Local\Temp\ed8afa20.exe
        • Size 2.5MB
        • SHA256 17c451c731a2de3549949005f01736f47d9887ca56d88e54d32932283388f0d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        52bbf350.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\52bbf350.exe
        • Size 2.5MB
        • SHA256 f058a4fe7dbfb08b6c3960797169404f83d3d090278ebfb093fe51ff33586cf7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        87b67b41.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\87b67b41.exe
        • Size 2.5MB
        • SHA256 e5207f2b078fcc55d92754ef6cae9a9e82fcef442cfe5f1bba10e9509285e61b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        f297de2e.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\f297de2e.exe
        • Size 2.5MB
        • SHA256 7cc87e77927606205c871a20d34813ac4e4cb0b8b03240ff8ad603ce6d912cbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fec686b5.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\fec686b5.exe
        • Size 2.5MB
        • SHA256 79847b0823bc877ba928d1ef55326a3c7a331e4d1f41a4ab47654580082baa85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        0a2aef46.exe
        • Path C:\Windows\SysWOW64\0a2aef46.exe
        • Size 2.5MB
        • SHA256 e9b6f1865aa28633e0e1b312ce606b34bf0ae09e06a8828745717c9fd40a078a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        14da2321.exe
        • Path C:\Windows\SysWOW64\14da2321.exe
        • Size 2.5MB
        • SHA256 7f89c0d6cba1441a6c49c9f165807e8843e68776c1922f1ee88fb22c9d49502a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        4d6be81a.exe
        • Path C:\Windows\SysWOW64\4d6be81a.exe
        • Size 2.5MB
        • SHA256 a85b4eed824a3693f06a4b97357e3ddb0520d3a4ac77b34e4aa6f03325ee4871
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        794d6725.exe
        • Path C:\Windows\SysWOW64\794d6725.exe
        • Size 2.5MB
        • SHA256 a9f78d6263defc73ac9daea3339f955ea13c4a7538da0b5a5a241745e6d59621
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        738b8265.exe
        • Path C:\Windows\System32\738b8265.exe
        • Size 2.5MB
        • SHA256 2eb5327e8cdc14d192e678f523ad5cae1b583f2f8dad228dd912550400960881
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7d93ac85.exe
        • Path C:\Windows\System32\7d93ac85.exe
        • Size 2.5MB
        • SHA256 424856f86b78c05df4afadf0612d45b262a8535cd6e7c537e1d009480c7f9d22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        9a17553d.exe
        • Path C:\Windows\System32\9a17553d.exe
        • Size 2.5MB
        • SHA256 31ab043a5b0ce729752fba6b096ac8da5f0738324402111aa79e2f6e6899fb20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fef36843.exe
        • Path C:\Windows\System32\fef36843.exe
        • Size 2.5MB
        • SHA256 6deba6441a52ff706116947c186887483c44e0e0a7d63ebf42ed712a122ff60a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5196-14-0x0000027EE9DE0000-0x0000027EE9E02000-memory.dmp
        Download

        memory/5196-5-0x0000027EE72D0000-0x0000027EE72E0000-memory.dmp
        Download

        memory/5196-6-0x0000027EE72D0000-0x0000027EE72E0000-memory.dmp
        Download