Overview

overview

7

Static

static

3

2026-09-25..._p.exe

windows10-2004-x64

3

2026-09-25..._p.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/09/2026, 18:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-25_dd10cf0b704eba8891c4c4a0da5a49ef_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
  • Size 8.7MB
  • Sample260925-xcap6axvdv
  • SHA256 1bf0f12594ed9948008312207959b1021739aadfe1eeca63576d33f2636b6fcc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 3 IoCs
    defense_evasion
  • Runs ping.exe 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 33 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-25_dd10cf0b704eba8891c4c4a0da5a49ef_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-25_dd10cf0b704eba8891c4c4a0da5a49ef_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe"
    1⤵
    • Enumerates connected drives
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Windows\system32\cmd.exe
      /c mklink /J "C:\Users\Admin\AppData\Local\Temp\TestApplyLinkReplacesFolder2336299761\001\apps\app1\copies\c1\profile" "C:\Users\Admin\AppData\Local\Temp\TestApplyLinkReplacesFolder2336299761\002\ram\cache"
      2⤵
        PID:2760
      • C:\Windows\system32\cmd.exe
        /c mklink /J "C:\Users\Admin\AppData\Local\Temp\TestReconcileLinksRestoresWipedLink3248394543\001\apps\app1\copies\c1\profile" "C:\Users\Admin\AppData\Local\Temp\TestReconcileLinksRestoresWipedLink3248394543\002\ram\cache"
        2⤵
          PID:4764
        • C:\Windows\system32\cmd.exe
          /c mklink /J "C:\Users\Admin\AppData\Local\Temp\TestReconcileLinksRestoresWipedLink3248394543\001\apps\app1\copies\c1\profile" "C:\Users\Admin\AppData\Local\Temp\TestReconcileLinksRestoresWipedLink3248394543\002\ram\cache"
          2⤵
            PID:3864
          • C:\Windows\system32\cmd.exe
            /c mklink /J "C:\Users\Admin\AppData\Local\Temp\TestReconcileLinksRecreatesTarget2251129948\001\apps\app1\copies\c1\profile" "C:\Users\Admin\AppData\Local\Temp\TestReconcileLinksRecreatesTarget2251129948\002\cache"
            2⤵
              PID:4812
            • C:\Windows\system32\cmd.exe
              /c mklink /J "C:\Users\Admin\AppData\Local\Temp\TestRemoveLinkLeavesEmptyFolder1120872026\001\apps\app1\copies\c1\profile" "C:\Users\Admin\AppData\Local\Temp\TestRemoveLinkLeavesEmptyFolder1120872026\002\ram"
              2⤵
                PID:4856
              • C:\Windows\system32\cmd.exe
                /c mklink /J "C:\Users\Admin\AppData\Local\Temp\TestListCopyDirShowsLinkAsFolder3674649231\001\apps\app1\copies\c1\profile" "C:\Users\Admin\AppData\Local\Temp\TestListCopyDirShowsLinkAsFolder3674649231\002\ram"
                2⤵
                  PID:236
                • C:\Windows\system32\robocopy.exe
                  robocopy C:\Users\Admin\AppData\Local\Temp\TestCreateCopyAndSafeName1609445031\001\apps\app1\masters C:\Users\Admin\AppData\Local\Temp\TestCreateCopyAndSafeName1609445031\001\apps\app1\copies\c1 /E /R:1 /W:1 /NDL /NJH /NJS /BYTES
                  2⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4996
                • C:\Windows\system32\robocopy.exe
                  robocopy C:\Users\Admin\AppData\Local\Temp\TestCreateCopyAndSafeName1609445031\001\apps\app1\copies\c1 C:\Users\Admin\AppData\Local\Temp\TestCreateCopyAndSafeName1609445031\001\apps\app1\copies\c2 /E /R:1 /W:1 /NDL /NJH /NJS /BYTES
                  2⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5228
                • C:\Windows\system32\robocopy.exe
                  robocopy C:\Users\Admin\AppData\Local\Temp\TestCreateCopyRemovesIncompleteClone2910022863\001\apps\app1\masters C:\Users\Admin\AppData\Local\Temp\TestCreateCopyRemovesIncompleteClone2910022863\001\apps\app1\copies\ok /E /R:1 /W:1 /NDL /NJH /NJS /BYTES
                  2⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5880
                • C:\Windows\system32\cmd.exe
                  /c mklink /J "C:\Users\Admin\AppData\Local\Temp\TestListDirDeadJunctionIsFolder675347643\001\prof" "C:\Users\Admin\AppData\Local\Temp\TestListDirDeadJunctionIsFolder675347643\001\gone"
                  2⤵
                    PID:1156
                  • C:\Users\Admin\AppData\Local\Temp\TestStopCopyConfirmsProcessesGone3449766835\001\stop-probe.exe
                    C:\Users\Admin\AppData\Local\Temp\TestStopCopyConfirmsProcessesGone3449766835\001\stop-probe.exe /c ping -n 30 127.0.0.1
                    2⤵
                    • Executes dropped EXE
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:6056
                    • C:\Windows\system32\PING.EXE
                      ping -n 30 127.0.0.1
                      3⤵
                      • System Network Configuration Discovery: Internet Connection Discovery
                      • Runs ping.exe
                      PID:708
                  • C:\Windows\system32\taskkill.exe
                    taskkill /PID 6056 /T /F
                    2⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3236
                  • C:\Users\Admin\AppData\Local\Temp\TestCopyRunningDetectsProcess313012091\001\worker.exe
                    C:\Users\Admin\AppData\Local\Temp\TestCopyRunningDetectsProcess313012091\001\worker.exe /c ping -n 10 127.0.0.1
                    2⤵
                    • Executes dropped EXE
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:5760
                    • C:\Windows\system32\PING.EXE
                      ping -n 10 127.0.0.1
                      3⤵
                      • System Network Configuration Discovery: Internet Connection Discovery
                      • Runs ping.exe
                      PID:1344
                  • C:\Users\Admin\AppData\Local\Temp\TestCopyRunningDetectsProcess313012091\001\FastExecuteScript.exe
                    C:\Users\Admin\AppData\Local\Temp\TestCopyRunningDetectsProcess313012091\001\FastExecuteScript.exe /c ping -n 10 127.0.0.1
                    2⤵
                    • Executes dropped EXE
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:2092
                    • C:\Windows\system32\PING.EXE
                      ping -n 10 127.0.0.1
                      3⤵
                      • System Network Configuration Discovery: Internet Connection Discovery
                      • Runs ping.exe
                      PID:3520
                  • C:\Windows\system32\taskkill.exe
                    taskkill /PID 2092 /T /F
                    2⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4980
                  • C:\Windows\system32\taskkill.exe
                    taskkill /PID 5760 /T /F
                    2⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2504
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\TestRunScriptTimeoutAndCleanup3781954194\001\scripts\______-327708170.ps1
                    2⤵
                    • Enumerates connected drives
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4652
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\TestRunScriptCyrillicRoundTrip3922177698\001\scripts\______-3120188286.ps1
                    2⤵
                    • Enumerates connected drives
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2824
                  • C:\Windows\system32\cmd.exe
                    /c mklink /J "C:\Users\Admin\AppData\Local\Temp\TestCopyOnStore1469532513\001\apps\app1\copies\c1" "C:\Users\Admin\AppData\Local\Temp\TestCopyOnStore1469532513\002\Z\apps\app1\copies\c1"
                    2⤵
                      PID:2148
                    • C:\Windows\system32\robocopy.exe
                      robocopy C:\Users\Admin\AppData\Local\Temp\TestCopyOnStore1469532513\001\apps\app1\masters C:\Users\Admin\AppData\Local\Temp\TestCopyOnStore1469532513\001\apps\app1\copies\c1 /E /R:1 /W:1 /NDL /NJH /NJS /BYTES
                      2⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2612
                    • C:\Windows\system32\robocopy.exe
                      robocopy C:\Users\Admin\AppData\Local\Temp\TestCopyOnStore1469532513\002\Z\apps\app1\copies\c1 C:\Users\Admin\AppData\Local\Temp\TestCopyOnStore1469532513\001\apps\app1\copies\c1.moving /E /XJ /R:1 /W:1 /NDL /NJH /NJS /BYTES
                      2⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3564
                    • C:\Windows\system32\robocopy.exe
                      robocopy C:\Users\Admin\AppData\Local\Temp\TestCopyOnStore1469532513\001\apps\app1\copies\c1 C:\Users\Admin\AppData\Local\Temp\TestCopyOnStore1469532513\002\Z\apps\app1\copies\c1 /E /XJ /R:1 /W:1 /NDL /NJH /NJS /BYTES
                      2⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4540
                    • C:\Windows\system32\cmd.exe
                      /c mklink /J "C:\Users\Admin\AppData\Local\Temp\TestCopyOnStore1469532513\001\apps\app1\copies\c1" "C:\Users\Admin\AppData\Local\Temp\TestCopyOnStore1469532513\002\Z\apps\app1\copies\c1"
                      2⤵
                        PID:4764
                      • C:\Windows\system32\cmd.exe
                        /c mklink /J "C:\Users\Admin\AppData\Local\Temp\TestCopyOnStore1469532513\001\apps\app1\copies\c2" "C:\Users\Admin\AppData\Local\Temp\TestCopyOnStore1469532513\002\Z\apps\app1\copies\c2"
                        2⤵
                          PID:6024
                        • C:\Windows\system32\robocopy.exe
                          robocopy C:\Users\Admin\AppData\Local\Temp\TestCopyOnStore1469532513\001\apps\app1\masters C:\Users\Admin\AppData\Local\Temp\TestCopyOnStore1469532513\001\apps\app1\copies\c2 /E /R:1 /W:1 /NDL /NJH /NJS /BYTES
                          2⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4904

                      Network

                            MITRE ATT&CK Enterprise v16

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            Actual.MySoft.xml
                            • Path C:\Users\Admin\AppData\Local\Temp\TestApplyModelChanges1765954531\001\engine\Actual.MySoft.xml
                            • Size 622B
                            • SHA256 30f444a5363c1b5b9b064928bbdc058d1d30ec4991478caec44953096aa52a61
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            7e52effb9d7571abd4b42fa849a021d3ffe8400932967e52374862e559116ed9.zip
                            • Path C:\Users\Admin\AppData\Local\Temp\TestArchiveCacheAvoidsSecondDownload227810992\001\cache\7e52effb9d7571abd4b42fa849a021d3ffe8400932967e52374862e559116ed9.zip
                            • Size 459B
                            • SHA256 7e52effb9d7571abd4b42fa849a021d3ffe8400932967e52374862e559116ed9
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            bot.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\TestArchiveCacheRejectsCorruptEntry3605536046\001\apps\one\masters\bot.exe
                            • Size 5B
                            • SHA256 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
                            • MD5 SHA1 SHA512
                            Submit Download

                            debug.txt
                            • Path C:\Users\Admin\AppData\Local\Temp\TestArchiveCacheRejectsCorruptEntry3605536046\001\apps\one\masters\data\debug.txt
                            • Size 4B
                            • SHA256 cd6317b826072e616fa092b856c1e36f5a536f44429c9e7a9285113631cbfe00
                            • MD5 SHA1 SHA512
                            Submit Download

                            .bpinit
                            • Path C:\Users\Admin\AppData\Local\Temp\TestArchiveCacheRejectsCorruptEntry3605536046\001\apps\two\.bpinit
                            • Size 3B
                            • SHA256 dc51b8c96c2d745df3bd5590d990230a482fd247123599548e0632fdbf97fc22
                            • MD5 SHA1 SHA512
                            Submit Download

                            app.json
                            • Path C:\Users\Admin\AppData\Local\Temp\TestArchiveCacheRejectsCorruptEntry3605536046\001\apps\two\app.json
                            • Size 164B
                            • SHA256 7feec7a701392931edac60095c6ccb6253094df78b4721412a9e58814a9780de
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            bb.zip
                            • Path C:\Users\Admin\AppData\Local\Temp\TestCacheEvictsLeastRecentlyUsed324731054\001\cache\bb.zip
                            • Size 400B
                            • SHA256 7a12e561363385e9dfeeab326368731c030ed4b374e7f5897ac819159d2884c5
                            • MD5 SHA1 SHA512
                            Submit Download

                            cfg.txt
                            • Path C:\Users\Admin\AppData\Local\Temp\TestCreateCopyAndSafeName1609445031\001\apps\app1\copies\c1\cfg.txt
                            • Size 10B
                            • SHA256 20158224750041d653cd8c737d64c2fdce258d4280c9bf2a49fa1db0a7f9f3ac
                            • MD5 SHA1 SHA512
                            Submit Download

                            copy.json
                            • Path C:\Users\Admin\AppData\Local\Temp\TestCreateCopyAndSafeName1609445031\001\apps\app1\copies\c1\copy.json
                            • Size 3B
                            • SHA256 ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
                            • MD5 SHA1 SHA512
                            Submit Download

                            f172894d97eb8f30b4cf09f505521d6186e545b4d2c67111de1ae2c183a2eb5f.zip
                            • Path C:\Users\Admin\AppData\Local\Temp\TestDamagedMasterIsRebuiltfiles_removed213551231\001\cache\f172894d97eb8f30b4cf09f505521d6186e545b4d2c67111de1ae2c183a2eb5f.zip
                            • Size 459B
                            • SHA256 f172894d97eb8f30b4cf09f505521d6186e545b4d2c67111de1ae2c183a2eb5f
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            .bpsrc
                            • Path C:\Users\Admin\AppData\Local\Temp\TestDamagedMasterIsRebuiltlauncher_gone,_size_compensated212265484\001\apps\app\.bpsrc
                            • Size 99B
                            • SHA256 a4c791611610bec25802776f7399c78e9223112189b396c7e4957cac3101f737
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            .bpsrc
                            • Path C:\Users\Admin\AppData\Local\Temp\TestDeploySkipsUpToDateMaster2009653919\001\apps\app\.bpsrc
                            • Size 99B
                            • SHA256 4fb51c972c280219ebfd96a669e7b16fc2b696e33a390799a098967457af8e56
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            FastExecuteScript.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\TestDeploySkipsUpToDateMaster2009653919\001\apps\app\masters\appsremote\x\y\engine\FastExecuteScript.exe
                            • Size 6B
                            • SHA256 ed9f6f25068608efd412958da4dfc19328ca3511251fa6d5f9c42baf230e32f8
                            • MD5 SHA1 SHA512
                            Submit Download

                            agent.key
                            • Path C:\Users\Admin\AppData\Local\Temp\TestEnsureKey3151109251\001\agent.key
                            • Size 89B
                            • SHA256 79bbd51df40959d590eee1157adaf0c8944549bdcc41bf0b3b36dfc285776330
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            chrome.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\TestFindChromeDLLDepths2009296521\002\appsremote\Script\SID06a4c138\engine\151.0.7922.72\chrome.dll
                            • Size 4B
                            • SHA256 725c546b990dd1b41f3d5791b37c3c0edcb1f08cf150bdae32a73dfd166e02d7
                            • MD5 SHA1 SHA512
                            Submit Download

                            install.log
                            • Path C:\Users\Admin\AppData\Local\Temp\TestInstallTail885905295\001\install.log
                            • Size 27B
                            • SHA256 cfacd0bdaedd85ef8ca896813c242ee6b5fc5e2c950c8c321ad15ce02cb07ffd
                            • MD5 SHA1 SHA512
                            Submit Download

                            ______-3120188286.ps1
                            • Path C:\Users\Admin\AppData\Local\Temp\TestRunScriptCyrillicRoundTrip3922177698\001\scripts\______-3120188286.ps1
                            • Size 106B
                            • SHA256 4148babedbba778fa116ef25f324710fc73925110b22adcef93a912bebb889b8
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            ______-327708170.ps1
                            • Path C:\Users\Admin\AppData\Local\Temp\TestRunScriptTimeoutAndCleanup3781954194\001\scripts\______-327708170.ps1
                            • Size 119B
                            • SHA256 78c7d230f8b19531e81cd482d7c82f820395df26afddde1d8ebb532a88d835f0
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            stop-probe.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\TestStopCopyConfirmsProcessesGone3449766835\001\stop-probe.exe
                            • Size 332KB
                            • SHA256 486aa8ac1661c0dc08d3ebea4f25f0009d248f2ced111dea8587c2b7d71b49bb
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            proxies.txt
                            • Path C:\Users\Admin\AppData\Local\Temp\TestSyncFilesFromRefs780475592\001\files\proxies.txt
                            • Size 8B
                            • SHA256 454debca5afcd37addd0dcca05094625dcde6402510f8fc664cd567893ec7096
                            • MD5 SHA1 SHA512
                            Submit Download

                            run.log
                            • Path C:\Users\Admin\AppData\Local\Temp\TestTailBoundedBurstAndLongLine2115849476\001\run.log
                            • Size 585KB
                            • SHA256 db238b4a2817015ff459f3928f04705409fda8de8aa2b75f30312646909ada2e
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            bot.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\TestUnzipHappyAndSlip3454336235\001\app\bot.exe
                            • Size 1B
                            • SHA256 2d711642b726b04401627ca9fbac32f5c8530fb1903cc4db02258717921a4881
                            • MD5 SHA1 SHA512
                            Submit Download

                            Actual.MySoft.xml
                            • Path C:\Users\Admin\AppData\Local\Temp\TestWriteConfigArtifactReturnsReadback2678236485\001\apps\MySoft\copies\c1\engine\Actual.MySoft.xml
                            • Size 607B
                            • SHA256 88ed3083b3cf3e9cf1d34be4b0d102e1a221c0bd5a2801df2b67cc91310fae70
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            Actual.MySoft.xml.default.xml
                            • Path C:\Users\Admin\AppData\Local\Temp\TestWriteConfigArtifactReturnsReadback2678236485\001\apps\MySoft\copies\c1\engine\Actual.MySoft.xml.default.xml
                            • Size 601B
                            • SHA256 086bb2874ecd1dce9ae9fe56f6c1da7d4b369e053f144cb827578268be82bb17
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            cfg.ini
                            • Path C:\Users\Admin\AppData\Local\Temp\TestWriteCopyFileHandlesReadOnly698975798\001\apps\app1\copies\c1\cfg.ini
                            • Size 12B
                            • SHA256 cbe803738ba4de00c1278fe5295cc8536cc9f3b6fdace5fa14444ef3bbc43f90
                            • MD5 SHA1 SHA512
                            Submit Download

                            memory/4652-342-0x0000024ECCF00000-0x0000024ECCF22000-memory.dmp
                            Download