Overview

overview

8

Static

static

3

2026-10-08...er.exe

windows10-2004-x64

8

2026-10-08...er.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    132s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/10/2026, 19:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-08_1c5f9ecc109ba7eb9e65349f5832c23c_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
  • Size 2.5MB
  • Sample261009-yp968avt3p
  • SHA256 ca44dc15e88e16597e26eef12948631174e42004926cd2dba9bee137fbfef0ab
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasionexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell and hide display window.

    execution
  • Creates a file in the Startup directory 1 TTPs 4 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Drops file in System32 directory 16 IoCs
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 4 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 16 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-08_1c5f9ecc109ba7eb9e65349f5832c23c_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-08_1c5f9ecc109ba7eb9e65349f5832c23c_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Direct Volume Access: Opens a physical disk for reading
    • Suspicious use of WriteProcessMemory
    PID:2768
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\9cb3da87.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:3184
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\eec72f3f.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:5700
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdate7e96f9 /tr C:\Users\Admin\AppData\Local\Temp\2026-10-08_1c5f9ecc109ba7eb9e65349f5832c23c_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4820
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\1af2163e.exe
      2⤵
      • Views/modifies file attributes
      PID:4868
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command " $WshShell = New-Object -comObject WScript.Shell $Shortcut = $WshShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systeme0e03.lnk\") $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-10-08_1c5f9ecc109ba7eb9e65349f5832c23c_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe\" $Shortcut.Save() "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Creates a file in the Startup directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3496
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\bf4a7fb6.exe
      2⤵
      • Views/modifies file attributes
      PID:3932
  • C:\Users\Admin\AppData\Local\Temp\2026-10-08_1c5f9ecc109ba7eb9e65349f5832c23c_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
    C:\Users\Admin\AppData\Local\Temp\2026-10-08_1c5f9ecc109ba7eb9e65349f5832c23c_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Direct Volume Access: Opens a physical disk for reading
    • Suspicious use of WriteProcessMemory
    PID:3284
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\e926881d.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:2408
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateba29da /tr C:\Users\Admin\AppData\Local\Temp\2026-10-08_1c5f9ecc109ba7eb9e65349f5832c23c_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:240
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\688b6513.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:5404
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command " $WshShell = New-Object -comObject WScript.Shell $Shortcut = $WshShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systemc0d89.lnk\") $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-10-08_1c5f9ecc109ba7eb9e65349f5832c23c_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe\" $Shortcut.Save() "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Creates a file in the Startup directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5840
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\626de17e.exe
      2⤵
      • Views/modifies file attributes
      PID:1628
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\50e9fd42.exe
      2⤵
      • Views/modifies file attributes
      PID:5580
  • C:\Users\Admin\AppData\Local\Temp\2026-10-08_1c5f9ecc109ba7eb9e65349f5832c23c_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-08_1c5f9ecc109ba7eb9e65349f5832c23c_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Direct Volume Access: Opens a physical disk for reading
    • Suspicious use of WriteProcessMemory
    PID:2700
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\7aa94678.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:5560
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\82e8c668.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:2296
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\89c16296.exe
      2⤵
      • Views/modifies file attributes
      PID:5932
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdate7bf134 /tr C:\Users\Admin\AppData\Local\Temp\2026-10-08_1c5f9ecc109ba7eb9e65349f5832c23c_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4752
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\0d17719a.exe
      2⤵
      • Views/modifies file attributes
      PID:5496
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command " $WshShell = New-Object -comObject WScript.Shell $Shortcut = $WshShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System7e196.lnk\") $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-10-08_1c5f9ecc109ba7eb9e65349f5832c23c_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe\" $Shortcut.Save() "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Creates a file in the Startup directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4524
  • C:\Users\Admin\AppData\Local\Temp\2026-10-08_1c5f9ecc109ba7eb9e65349f5832c23c_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-08_1c5f9ecc109ba7eb9e65349f5832c23c_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Direct Volume Access: Opens a physical disk for reading
    • Suspicious use of WriteProcessMemory
    PID:4356
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\44dc053e.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:5540
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\d56c284b.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:4904
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\92ae4ecf.exe
      2⤵
      • Views/modifies file attributes
      PID:4712
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdate71cd08 /tr C:\Users\Admin\AppData\Local\Temp\2026-10-08_1c5f9ecc109ba7eb9e65349f5832c23c_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:5928
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\29042686.exe
      2⤵
      • Views/modifies file attributes
      PID:5000
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command " $WshShell = New-Object -comObject WScript.Shell $Shortcut = $WshShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System2be3a.lnk\") $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-10-08_1c5f9ecc109ba7eb9e65349f5832c23c_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe\" $Shortcut.Save() "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Creates a file in the Startup directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4836

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 860f177b712e131bfc38312951662ae1e5c9e0aeb19be8f15f64d44920c7172a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        0d17719a.exe
        • Path C:\Users\Admin\AppData\Local\Temp\0d17719a.exe
        • Size 2.5MB
        • SHA256 d827fd09c4b2ec458c0b5b4f47bed82ea569502f08b98a076dc8bae5da6de9b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        29042686.exe
        • Path C:\Users\Admin\AppData\Local\Temp\29042686.exe
        • Size 2.5MB
        • SHA256 c3348fdd4e69ba9893eb96ac72db996b06b5e955582a2420c9f85d51fbe57e09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        50e9fd42.exe
        • Path C:\Users\Admin\AppData\Local\Temp\50e9fd42.exe
        • Size 2.5MB
        • SHA256 4bb57f94cb5c57355906156ede26c80e5af179b3ca5ad8b83f46d28c550e0cc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_d1uhoon3.emj.psm1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d1uhoon3.emj.psm1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        bf4a7fb6.exe
        • Path C:\Users\Admin\AppData\Local\Temp\bf4a7fb6.exe
        • Size 2.5MB
        • SHA256 5a72483ce23e3dd50201f302af8b591ec56055435f0a2016a88f27df9d66c831
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        1af2163e.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\1af2163e.exe
        • Size 2.5MB
        • SHA256 4405d34ed3fc79461fd5c7257e82261852816d22a08ade8c0503ee195664d158
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        626de17e.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\626de17e.exe
        • Size 2.5MB
        • SHA256 8b340bc4f0f1015bde92108fca8f6648f93a04c1e681f35e627a4f37c31719f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        89c16296.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\89c16296.exe
        • Size 2.5MB
        • SHA256 94d5e198cb71de8821f1f04dc2279045fd53b2274f70022feb6d6d3168872ea1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        92ae4ecf.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\92ae4ecf.exe
        • Size 2.5MB
        • SHA256 ec3727b3397bae756c1e36f1aa48bdff34b929ff1e7c977448e3b89746e02403
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        688b6513.exe
        • Path C:\Windows\SysWOW64\688b6513.exe
        • Size 2.5MB
        • SHA256 fc080e8855cfada1bf71b96ba4985b30c054a750c4b6c7fc4cd855c95dc962f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        82e8c668.exe
        • Path C:\Windows\SysWOW64\82e8c668.exe
        • Size 2.5MB
        • SHA256 241e62be3fb20d7b27d4641bd9e8922ee75a60924fe4f0d5850fd07ffd2f4812
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        d56c284b.exe
        • Path C:\Windows\SysWOW64\d56c284b.exe
        • Size 2.5MB
        • SHA256 0c1b35ec69a4b33377e7d5de52030aa8fd23937edc5d54e7e1576a7f583ab19c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        eec72f3f.exe
        • Path C:\Windows\SysWOW64\eec72f3f.exe
        • Size 2.5MB
        • SHA256 34c65ca63bfc8fd2377b7f0235775db12263724e828cbcd56642d6925886d73f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        44dc053e.exe
        • Path C:\Windows\System32\44dc053e.exe
        • Size 2.5MB
        • SHA256 039cfb143b0fa3dd21ee2e020fa35f57781ad292bf209b26b4e0043911ff9e3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7aa94678.exe
        • Path C:\Windows\System32\7aa94678.exe
        • Size 2.5MB
        • SHA256 f1e32f3e3ac8950da93d5548f742617917ac356e7bc9346c4bb4dc1730b7d14a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        9cb3da87.exe
        • Path C:\Windows\System32\9cb3da87.exe
        • Size 2.5MB
        • SHA256 938f3b0a3021c398723586c6fe105a12312ae7c0ac91c39f47345fcb84b9ac2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e926881d.exe
        • Path C:\Windows\System32\e926881d.exe
        • Size 2.5MB
        • SHA256 ea470e14739ff3b25ca1c18a5b84f6f26b6ef7a11e41aa2906c973e8d93080bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3496-12-0x00007FFBDEDC0000-0x00007FFBDF764000-memory.dmp
        Download

        memory/3496-27-0x00007FFBDEDC0000-0x00007FFBDF764000-memory.dmp
        Download

        memory/3496-25-0x00007FFBDEDC0000-0x00007FFBDF764000-memory.dmp
        Download

        memory/3496-21-0x00007FFBDEDC0000-0x00007FFBDF764000-memory.dmp
        Download

        memory/3496-20-0x00007FFBDEDC0000-0x00007FFBDF764000-memory.dmp
        Download

        memory/3496-18-0x00007FFBDEDC0000-0x00007FFBDF764000-memory.dmp
        Download

        memory/3496-16-0x00007FFBDEDC0000-0x00007FFBDF764000-memory.dmp
        Download

        memory/3496-15-0x00007FFBDEDC0000-0x00007FFBDF764000-memory.dmp
        Download

        memory/3496-11-0x000001C7BDE30000-0x000001C7BDE52000-memory.dmp
        Download

        memory/3496-9-0x00007FFBDEDC0000-0x00007FFBDF764000-memory.dmp
        Download

        memory/3496-8-0x00007FFBDEF4F000-0x00007FFBDEF50000-memory.dmp
        Download