Overview

overview

8

Static

static

3

2026-10-10...er.exe

windows10-2004-x64

8

2026-10-10...er.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    11/10/2026, 03:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-10_bc0f6da814e62aeb59e35c58043bc9f2_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
  • Size 2.5MB
  • Sample261011-ej95gsdw6k
  • SHA256 9560b53f5ea965208c1a718b1b1361d657b6ce634380e8a9e03532c9cb1f0b02
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasionexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell and hide display window.

    execution
  • Creates a file in the Startup directory 1 TTPs 4 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Drops file in System32 directory 16 IoCs
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 4 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 16 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-10_bc0f6da814e62aeb59e35c58043bc9f2_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-10_bc0f6da814e62aeb59e35c58043bc9f2_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Direct Volume Access: Opens a physical disk for reading
    • Suspicious use of WriteProcessMemory
    PID:1152
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\29e31901.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:3360
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\cf660601.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:4652
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2754d2e9.exe
      2⤵
      • Views/modifies file attributes
      PID:3040
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdated5a744 /tr C:\Users\Admin\AppData\Local\Temp\2026-10-10_bc0f6da814e62aeb59e35c58043bc9f2_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2052
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\a6caf6a8.exe
      2⤵
      • Views/modifies file attributes
      PID:4304
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command " $WshShell = New-Object -comObject WScript.Shell $Shortcut = $WshShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systema37b4.lnk\") $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-10-10_bc0f6da814e62aeb59e35c58043bc9f2_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe\" $Shortcut.Save() "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Creates a file in the Startup directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3340
  • C:\Users\Admin\AppData\Local\Temp\2026-10-10_bc0f6da814e62aeb59e35c58043bc9f2_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
    C:\Users\Admin\AppData\Local\Temp\2026-10-10_bc0f6da814e62aeb59e35c58043bc9f2_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Direct Volume Access: Opens a physical disk for reading
    • Suspicious use of WriteProcessMemory
    PID:4880
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\51ea6dcd.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:3408
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\8843e831.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:228
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdate1e65b8 /tr C:\Users\Admin\AppData\Local\Temp\2026-10-10_bc0f6da814e62aeb59e35c58043bc9f2_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2204
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\02a3173d.exe
      2⤵
      • Views/modifies file attributes
      PID:1876
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\f1093438.exe
      2⤵
      • Views/modifies file attributes
      PID:4536
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command " $WshShell = New-Object -comObject WScript.Shell $Shortcut = $WshShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System71117.lnk\") $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-10-10_bc0f6da814e62aeb59e35c58043bc9f2_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe\" $Shortcut.Save() "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Creates a file in the Startup directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1788
  • C:\Users\Admin\AppData\Local\Temp\2026-10-10_bc0f6da814e62aeb59e35c58043bc9f2_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
    C:\Users\Admin\AppData\Local\Temp\2026-10-10_bc0f6da814e62aeb59e35c58043bc9f2_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Direct Volume Access: Opens a physical disk for reading
    • Suspicious use of WriteProcessMemory
    PID:2080
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\f3c0d765.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:1332
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\e68aa47c.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:308
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdate5935f9 /tr C:\Users\Admin\AppData\Local\Temp\2026-10-10_bc0f6da814e62aeb59e35c58043bc9f2_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:3188
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\6eac78a9.exe
      2⤵
      • Views/modifies file attributes
      PID:2976
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command " $WshShell = New-Object -comObject WScript.Shell $Shortcut = $WshShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System81a6d.lnk\") $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-10-10_bc0f6da814e62aeb59e35c58043bc9f2_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe\" $Shortcut.Save() "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Creates a file in the Startup directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3248
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\65d0edf8.exe
      2⤵
      • Views/modifies file attributes
      PID:4996
  • C:\Users\Admin\AppData\Local\Temp\2026-10-10_bc0f6da814e62aeb59e35c58043bc9f2_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
    C:\Users\Admin\AppData\Local\Temp\2026-10-10_bc0f6da814e62aeb59e35c58043bc9f2_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Direct Volume Access: Opens a physical disk for reading
    • Suspicious use of WriteProcessMemory
    PID:3316
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\f62b4ad0.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:4388
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdate9c3c7c /tr C:\Users\Admin\AppData\Local\Temp\2026-10-10_bc0f6da814e62aeb59e35c58043bc9f2_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4628
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\9f3b54a6.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:2148
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command " $WshShell = New-Object -comObject WScript.Shell $Shortcut = $WshShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System5dcb4.lnk\") $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-10-10_bc0f6da814e62aeb59e35c58043bc9f2_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe\" $Shortcut.Save() "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Creates a file in the Startup directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:636
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\f6845648.exe
      2⤵
      • Views/modifies file attributes
      PID:4872
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\0fd7fc75.exe
      2⤵
      • Views/modifies file attributes
      PID:632

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        powershell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        • Size 2KB
        • SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 b4b5d73e34f75a48a12f693f4a5a6a38b1b09299fc3810b720f778c613b0d991
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 4c5607f14e0117d936eda5fb9d12925e3614ae79ff0ee119444b75134b1c0af6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 90af996df16e4574d32f3bd46cdedef8d4c8b2595accbb224b411320068bb7b9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        0fd7fc75.exe
        • Path C:\Users\Admin\AppData\Local\Temp\0fd7fc75.exe
        • Size 2.5MB
        • SHA256 7ee702222a092156ac20dd9b4320964c288f61cfecaa99225b0b4356d2d8cb87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        65d0edf8.exe
        • Path C:\Users\Admin\AppData\Local\Temp\65d0edf8.exe
        • Size 2.5MB
        • SHA256 4f2932c0b6635f6ea8becb7f6adc4dda72b2ce77bfc4aa12d2f34f002c053687
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_th4dsy4w.2yf.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_th4dsy4w.2yf.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        a6caf6a8.exe
        • Path C:\Users\Admin\AppData\Local\Temp\a6caf6a8.exe
        • Size 2.5MB
        • SHA256 e58bf760093fbebf7c305981bf0f23aafcee5e56afa2d1c5337fcf436408be48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        f1093438.exe
        • Path C:\Users\Admin\AppData\Local\Temp\f1093438.exe
        • Size 2.5MB
        • SHA256 a32b04aa689af250c7c1638240dcdcef2b4428d27cc84848d745facdb686dd0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        02a3173d.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\02a3173d.exe
        • Size 2.5MB
        • SHA256 541057bdad723f7c4bbf29e66ae5d38e205e71d3c7f5c6f91a8bc96f357882e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2754d2e9.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2754d2e9.exe
        • Size 2.5MB
        • SHA256 53560d3fc9965e7d821592958d14d6a1139dcb8e9e80853e54e40e294f954ea0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        6eac78a9.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\6eac78a9.exe
        • Size 2.5MB
        • SHA256 75819f60511ba847432955cc6a480be9f2fda96102323cae272710a4b90e78fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        f6845648.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\f6845648.exe
        • Size 2.5MB
        • SHA256 bfb2a28cb1e9f91e692cafec26077fdfc932cbdf576a933cef73430c4a490bd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        8843e831.exe
        • Path C:\Windows\SysWOW64\8843e831.exe
        • Size 2.5MB
        • SHA256 35ec9f3800431171ad6e6ddbdc85eceb42a41b7eb37a1d209b1a64e9836f648f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        9f3b54a6.exe
        • Path C:\Windows\SysWOW64\9f3b54a6.exe
        • Size 2.5MB
        • SHA256 928f72e019a5d7df86df70b1bd30cb9f6b039ce2409dbf9af4aa8d9205387d72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cf660601.exe
        • Path C:\Windows\SysWOW64\cf660601.exe
        • Size 2.5MB
        • SHA256 e70dc02462671fbf68345ae5f8949c991689bae746c8d70f7cdd516205970d6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e68aa47c.exe
        • Path C:\Windows\SysWOW64\e68aa47c.exe
        • Size 2.5MB
        • SHA256 81e7fa7736e15d944ee15db4323b99c1353d20abd4952c34289d2673e88b7630
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        29e31901.exe
        • Path C:\Windows\System32\29e31901.exe
        • Size 2.5MB
        • SHA256 6a5ea026d6c6c10c73e180a458a81f00464381c8c6b2e2c53ea1e1c7cad926ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        51ea6dcd.exe
        • Path C:\Windows\System32\51ea6dcd.exe
        • Size 2.5MB
        • SHA256 4547d0ea849b53c2624f939e9454b5499dab5ca7ca04c8ff74d40b61f2b08d54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        f3c0d765.exe
        • Path C:\Windows\System32\f3c0d765.exe
        • Size 2.5MB
        • SHA256 7a97e54731aef82bf0e6dc7189dbd510ccd8abce41f11af60559c3b8d5de0d57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        f62b4ad0.exe
        • Path C:\Windows\System32\f62b4ad0.exe
        • Size 2.5MB
        • SHA256 0473f4b0b384f1f1b18a9b162ceee838b330e617ad0007642a4eacb20899213f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3340-8-0x0000013463730000-0x0000013463740000-memory.dmp
        Download

        memory/3340-17-0x000001347EA40000-0x000001347EA62000-memory.dmp
        Download

        memory/3340-9-0x0000013463730000-0x0000013463740000-memory.dmp
        Download