0349ce64085c900bf770c03fcb463b775f6e09c6d70edd3da988ca4ae1b11cc1

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 17:35

Target
2026-09-25_eec858c24f4fdf558f58c58e72770d01_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
Size 8.6MB
Sample260925-v55d5asdlf
SHA256 0349ce64085c900bf770c03fcb463b775f6e09c6d70edd3da988ca4ae1b11cc1
MD5 eec858c24f4fdf558f58c58e72770d01
SHA1 7a1109546216f4015fe6612fcb9a397cc0af313c
SHA512 08ed9ed31ffa6caf267c1d3ec53fe863508fdc20cc241975bb5f172fde0082ffc9bc241b8a09da1d1ce39742ddd31cd1fe2f3654dbb7c45739b70ef54572e82f
SSDEEP 98304:dsrdFvNR9KyGNHJ6FRY9lEmI3M7lRw8hcn5xz7QNJUuBHyS1C:doVRYyGFJ6nXs7A8CMNJJJ/C
TLSH
T1CA967C03EC9555E9C1AAA2358AB79253BB717C481B3223D32B90F3386F76BD06E75350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1188	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1188	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\2026-09-25_eec858c24f4fdf558f58c58e72770d01_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-25_eec858c24f4fdf558f58c58e72770d01_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe"
1⤵
PID:892

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004F8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1188