Overview

overview

8

Static

static

3

2026-09-29...er.exe

windows10-2004-x64

8

2026-09-29...er.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    136s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/09/2026, 17:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-29_c255da8e674cc05241a809df68f95618_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
  • Size 2.5MB
  • Sample260929-vrml6ast4m
  • SHA256 e08f20b49421d4693b9de57d9ba2f0bc68b43a829d3ca5c31e69ea3fab5defb3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasionexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 8 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 8 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_c255da8e674cc05241a809df68f95618_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_c255da8e674cc05241a809df68f95618_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:1808
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\c52574ed.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:4284
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdate861799 /tr C:\Users\Admin\AppData\Local\Temp\2026-09-29_c255da8e674cc05241a809df68f95618_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4884
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\7aa64bb7.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:5960
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command " $WshShell = New-Object -comObject WScript.Shell $Shortcut = $WshShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System5681c.lnk\") $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-09-29_c255da8e674cc05241a809df68f95618_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe\" $Shortcut.Save() "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Creates a file in the Startup directory
      • Enumerates connected drives
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4568
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\6ebf5c20.exe
      2⤵
      • Views/modifies file attributes
      PID:940
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\c198981b.exe
      2⤵
      • Views/modifies file attributes
      PID:2124
  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_c255da8e674cc05241a809df68f95618_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-29_c255da8e674cc05241a809df68f95618_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:4836
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\a6b58d6c.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:1208
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdate3187b2 /tr C:\Users\Admin\AppData\Local\Temp\2026-09-29_c255da8e674cc05241a809df68f95618_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:3196
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\ff49de4d.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:5808
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command " $WshShell = New-Object -comObject WScript.Shell $Shortcut = $WshShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systemcc8a8.lnk\") $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-09-29_c255da8e674cc05241a809df68f95618_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe\" $Shortcut.Save() "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Creates a file in the Startup directory
      • Enumerates connected drives
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5864
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\d99667e0.exe
      2⤵
      • Views/modifies file attributes
      PID:936
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\6e923cb9.exe
      2⤵
      • Views/modifies file attributes
      PID:2172

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 dea234ed69b56a5ac20026ced884f4bb792af688a6a339fefb58f73068aaa846
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        6e923cb9.exe
        • Path C:\Users\Admin\AppData\Local\Temp\6e923cb9.exe
        • Size 2.5MB
        • SHA256 129433c8aff77e373b4778cf65223f7ab270293b6cf980920a738e1a4f5cbd42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        c198981b.exe
        • Path C:\Users\Admin\AppData\Local\Temp\c198981b.exe
        • Size 2.5MB
        • SHA256 58d697eebefb1d5d9d7728ad3a89767af57e3b629d774dc564f17cde68e7de3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        6ebf5c20.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\6ebf5c20.exe
        • Size 2.5MB
        • SHA256 98b8294969e3b64b000ae6fadf30a55e54b12cd64cea324076680180bb9ef64c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        d99667e0.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\d99667e0.exe
        • Size 2.5MB
        • SHA256 65bbb8eed56336c3374e077c80beaaf70a4a9c1d43af86e9ad5cc872e9a08cd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7aa64bb7.exe
        • Path C:\Windows\SysWOW64\7aa64bb7.exe
        • Size 2.5MB
        • SHA256 3db1db96dd0bb76acb26ed83ef7e28e53b1ad9b94ec3b48c395672b628b76725
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ff49de4d.exe
        • Path C:\Windows\SysWOW64\ff49de4d.exe
        • Size 2.5MB
        • SHA256 a794d1677b9339bd395b83ba4866e8bd7a4240503c6620c55c9eb49b27275733
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        a6b58d6c.exe
        • Path C:\Windows\System32\a6b58d6c.exe
        • Size 2.5MB
        • SHA256 62602126fc75ca154addabef21009aa0c2b7c4b818bb202e4831c609b7d159b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        c52574ed.exe
        • Path C:\Windows\System32\c52574ed.exe
        • Size 2.5MB
        • SHA256 c5ad75891a243e60ccde6f3c96f584ceac686dd9df8f461897b3ed246addc76b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4568-8-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
        Download

        memory/4568-24-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
        Download

        memory/4568-17-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
        Download

        memory/4568-19-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
        Download

        memory/4568-13-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
        Download

        memory/4568-21-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
        Download

        memory/4568-23-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
        Download

        memory/4568-15-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
        Download

        memory/4568-25-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
        Download

        memory/4568-11-0x000001C775A60000-0x000001C775A82000-memory.dmp
        Download

        memory/4568-7-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
        Download

        memory/4568-6-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
        Download

        memory/4568-35-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
        Download

        memory/4568-4-0x00007FFEFB8BF000-0x00007FFEFB8C0000-memory.dmp
        Download