17504d216805684214bd84a44172faffc05cbeeacef2a71bfd3afd6ed2fe23f9

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-28_03c24456c436e7bfdec7517b11421700_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
Size 14.1MB
Sample260929-ppdzca1vdz
SHA256 17504d216805684214bd84a44172faffc05cbeeacef2a71bfd3afd6ed2fe23f9
MD5 03c24456c436e7bfdec7517b11421700
SHA1 6287cad683507e908fdf37537e7df0999c8f30b2
SHA512 13f6a4098a11b4ec78d2fb9b2203374c35e6725d55428e63959ca0afe07c660b37c0c00b15541300aeb9cd5aae3feb944f5a06ea0d6a6b9b6be8e56de4736548
SSDEEP 196608:AX6wdI4OG+0TvnAhM2UVrFL/ZQYauIqnL/sambM5x:ABdkG+aoM2YF/ZQKL/sambWx
TLSH
T137E68C43ECB546D9C0AAA276C66796637A753C844B3163C36B50B7382F737D0AEB9700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5228	2026-09-28_03c24456c436e7bfdec7517b11421700_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
5228	2026-09-28_03c24456c436e7bfdec7517b11421700_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
5228	2026-09-28_03c24456c436e7bfdec7517b11421700_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
5228	2026-09-28_03c24456c436e7bfdec7517b11421700_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-28_03c24456c436e7bfdec7517b11421700_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-28_03c24456c436e7bfdec7517b11421700_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cookie-shm

Path C:\Users\Admin\AppData\Local\Temp\hbd-93738315\cookie-shm
Size 32KB
SHA256 fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb
MD5 b7c14ec6110fa820ca6b65f5aec85911
SHA1 608eeb7488042453c9ca40f7e1398fc1a270f3f4
SHA512 d8d75760f29b1e27ac9430bc4f4ffcec39f1590be5aef2bfb5a535850302e067c288ef59cf3b2c5751009a22a6957733f9f80fa18f2b0d33d90c068a3f08f3b0
SSDEEP 3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5 SHA1 SHA512 SSDEEP

Submit Download