Overview

overview

7

Static

static

3

2026-09-24...er.exe

windows10-2004-x64

7

2026-09-24...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    131s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/09/2026, 15:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-24_036b2ad7698050756dbc6c0104d659d5_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
  • Size 2.5MB
  • Sample260925-tez62sfd72
  • SHA256 54aeb95a620c34f289dd2a2c39ccdc4f032130ac86d60fdf48c985864010443b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasionexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 4 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 16 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 16 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_036b2ad7698050756dbc6c0104d659d5_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_036b2ad7698050756dbc6c0104d659d5_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:4900
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\caffb5c6.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:5076
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn Update5f51c3 /tr C:\Users\Admin\AppData\Local\Temp\2026-09-24_036b2ad7698050756dbc6c0104d659d5_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4704
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\9baf169e.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:5908
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command " $s = New-Object -comObject WScript.Shell $l = $s.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systemb002f.lnk\") $l.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-09-24_036b2ad7698050756dbc6c0104d659d5_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\" $l.Save() "
      2⤵
      • Creates a file in the Startup directory
      • Enumerates connected drives
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5116
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\d9e27c84.exe
      2⤵
      • Views/modifies file attributes
      PID:5236
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\8eb55bc9.exe
      2⤵
      • Views/modifies file attributes
      PID:4596
  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_036b2ad7698050756dbc6c0104d659d5_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-24_036b2ad7698050756dbc6c0104d659d5_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:5324
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn Updateafd740 /tr C:\Users\Admin\AppData\Local\Temp\2026-09-24_036b2ad7698050756dbc6c0104d659d5_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4292
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\93edcb1f.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:1028
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\473dba29.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:5832
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command " $s = New-Object -comObject WScript.Shell $l = $s.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System33feb.lnk\") $l.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-09-24_036b2ad7698050756dbc6c0104d659d5_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\" $l.Save() "
      2⤵
      • Creates a file in the Startup directory
      • Enumerates connected drives
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1816
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\1e6bd556.exe
      2⤵
      • Views/modifies file attributes
      PID:2344
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\ea58bbcc.exe
      2⤵
      • Views/modifies file attributes
      PID:436
  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_036b2ad7698050756dbc6c0104d659d5_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_036b2ad7698050756dbc6c0104d659d5_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2944
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn Update5309c2 /tr C:\Users\Admin\AppData\Local\Temp\2026-09-24_036b2ad7698050756dbc6c0104d659d5_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:880
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\c8ee93da.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:1436
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command " $s = New-Object -comObject WScript.Shell $l = $s.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systemf20a6.lnk\") $l.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-09-24_036b2ad7698050756dbc6c0104d659d5_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\" $l.Save() "
      2⤵
      • Creates a file in the Startup directory
      • Enumerates connected drives
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:564
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\de6a0ca5.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:1580
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\98d0abdc.exe
      2⤵
      • Views/modifies file attributes
      PID:4576
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\afc86248.exe
      2⤵
      • Views/modifies file attributes
      PID:4312
  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_036b2ad7698050756dbc6c0104d659d5_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_036b2ad7698050756dbc6c0104d659d5_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:6112
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\f2a84905.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:3640
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn Update47e8bb /tr C:\Users\Admin\AppData\Local\Temp\2026-09-24_036b2ad7698050756dbc6c0104d659d5_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2592
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\bf87baf1.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:5916
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command " $s = New-Object -comObject WScript.Shell $l = $s.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System83e76.lnk\") $l.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-09-24_036b2ad7698050756dbc6c0104d659d5_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\" $l.Save() "
      2⤵
      • Creates a file in the Startup directory
      • Enumerates connected drives
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2380
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\4d749fb6.exe
      2⤵
      • Views/modifies file attributes
      PID:1928
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\c5782a5b.exe
      2⤵
      • Views/modifies file attributes
      PID:3936

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 e01f5741ced7748eef83cfb8a46d0174a59543551d136235356c274108c90770
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 452eb598b2884fd99242cb5db005e3ac8e31bc9e3d58fe88ad0dd79ba08fbfd1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        8eb55bc9.exe
        • Path C:\Users\Admin\AppData\Local\Temp\8eb55bc9.exe
        • Size 2.5MB
        • SHA256 53aba281cba14ef81b1e850c1b0ba548ad182370d65a0095944f11ce3af2a284
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_w24b3zhc.2qf.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w24b3zhc.2qf.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        afc86248.exe
        • Path C:\Users\Admin\AppData\Local\Temp\afc86248.exe
        • Size 2.5MB
        • SHA256 52f183cfa627befcfd61b39fd7b8d29de57868fdc77943cd7378173db55c5e67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        c5782a5b.exe
        • Path C:\Users\Admin\AppData\Local\Temp\c5782a5b.exe
        • Size 2.5MB
        • SHA256 65d825422597c094532d99145ba8cc0071f0511674e707cf0fd5a1d48e8bb0c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ea58bbcc.exe
        • Path C:\Users\Admin\AppData\Local\Temp\ea58bbcc.exe
        • Size 2.5MB
        • SHA256 0d3850b433aeb8dadccde1a6589c36c42d94d06bcd2f9f0cc10fc78b700fed53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        1e6bd556.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\1e6bd556.exe
        • Size 2.5MB
        • SHA256 a3cc746c64fec9daa852f6f67e951118dde8df93ade04acd8d9c85179def5f4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        4d749fb6.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\4d749fb6.exe
        • Size 2.5MB
        • SHA256 89aa85ba0635a44b8a19c3734def6c041eb7b25c8634fea7042043dea1e248ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        98d0abdc.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\98d0abdc.exe
        • Size 2.5MB
        • SHA256 8e94153a8c4d86788768a74a12fa3652ef338e19653db7a8e22d5fbb833cb071
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        d9e27c84.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\d9e27c84.exe
        • Size 2.5MB
        • SHA256 c88b500fe291a5621120028d11705199d1444e3436922d872cd4758e144ad6ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        473dba29.exe
        • Path C:\Windows\SysWOW64\473dba29.exe
        • Size 2.5MB
        • SHA256 88de60e7968c48257df30d25e4bccbbbee416449a848273b5ced82e2eb6edac9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        9baf169e.exe
        • Path C:\Windows\SysWOW64\9baf169e.exe
        • Size 2.5MB
        • SHA256 5c6521364773fb1a39d01156a3b2d4cd3c97afec2b06076f908c44868990d175
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bf87baf1.exe
        • Path C:\Windows\SysWOW64\bf87baf1.exe
        • Size 2.5MB
        • SHA256 c11db21214c6bc530901aab1651e53d77c53650cb917211a142e619948269e5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        de6a0ca5.exe
        • Path C:\Windows\SysWOW64\de6a0ca5.exe
        • Size 2.5MB
        • SHA256 12366a03041d1381cb2c243eddc4d46129cc899ad0bea5f3fd1f825c82885145
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        93edcb1f.exe
        • Path C:\Windows\System32\93edcb1f.exe
        • Size 2.5MB
        • SHA256 3ada0cb58d9fcbcb07d41c04aec6b13f403eef92529e9f453c901f7f0902d83f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        c8ee93da.exe
        • Path C:\Windows\System32\c8ee93da.exe
        • Size 2.5MB
        • SHA256 3eb89982adb1252d70cf70be988778d33b11be2262d692901fb53a7aaf7c1e42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        caffb5c6.exe
        • Path C:\Windows\System32\caffb5c6.exe
        • Size 2.5MB
        • SHA256 35661147f4f4702983ada054eb01b591386378ec75ad38c0d8aab1986b8e0f6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        f2a84905.exe
        • Path C:\Windows\System32\f2a84905.exe
        • Size 2.5MB
        • SHA256 16254af33ea79f73e1266dbc0ccb1bcdab07d9720b22273955325bf6e44d4627
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5116-15-0x00007FFDEA900000-0x00007FFDEB2A4000-memory.dmp
        Download

        memory/5116-33-0x00007FFDEA900000-0x00007FFDEB2A4000-memory.dmp
        Download

        memory/5116-32-0x00007FFDEA900000-0x00007FFDEB2A4000-memory.dmp
        Download

        memory/5116-27-0x00007FFDEA900000-0x00007FFDEB2A4000-memory.dmp
        Download

        memory/5116-25-0x00007FFDEA900000-0x00007FFDEB2A4000-memory.dmp
        Download

        memory/5116-23-0x00007FFDEA900000-0x00007FFDEB2A4000-memory.dmp
        Download

        memory/5116-22-0x00007FFDEA900000-0x00007FFDEB2A4000-memory.dmp
        Download

        memory/5116-21-0x00007FFDEA900000-0x00007FFDEB2A4000-memory.dmp
        Download

        memory/5116-20-0x00007FFDEA900000-0x00007FFDEB2A4000-memory.dmp
        Download

        memory/5116-19-0x00007FFDEA900000-0x00007FFDEB2A4000-memory.dmp
        Download

        memory/5116-14-0x00007FFDEA900000-0x00007FFDEB2A4000-memory.dmp
        Download

        memory/5116-10-0x00000248E7580000-0x00000248E75A2000-memory.dmp
        Download

        memory/5116-13-0x00007FFDEA900000-0x00007FFDEB2A4000-memory.dmp
        Download

        memory/5116-6-0x00007FFDEA900000-0x00007FFDEB2A4000-memory.dmp
        Download

        memory/5116-5-0x00007FFDEAA8F000-0x00007FFDEAA90000-memory.dmp
        Download