Analysis
- max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/10/2026, 23:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-15_07ec4d037af1f4476dd1d9f20b9f5351_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-15_07ec4d037af1f4476dd1d9f20b9f5351_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe
Resource
win11ltsc2024-20260911-en
2 signatures
150 seconds
General
- Target 2026-10-15_07ec4d037af1f4476dd1d9f20b9f5351_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe
- Size 21.6MB
- Sample261016-3xp88set8q
- SHA256 f52bb56b02c4fec4ebfa517e1d7be31e4f5196d6d6b541cfe04a47e773060554
- MD5 07ec4d037af1f4476dd1d9f20b9f5351
- SHA1 572608e447b4645750be28945f52823e3fda4915
- SHA512 635da8fbbd1953aa0503520ee555492b433dcbc970e09efbc5af71167293dcc0b1ab063dbb0c3aa376ce596164b6cb323d042a6f86d8f33c6a30d2b6bc05e8bc
- SSDEEP 196608:SSVTD1J+vvq7PhBMnSIgJrsBGxJ/reTlyPxzWR8vG6nsSP88J0A5lk:SoTZJ+OogJrsBGxBclyPx06rP88SA5lk
- TLSH T120376C03E8A109E9C1E9E274C6769217BB7178484B3123D72B60EB347F72BD06EB9754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4776 2026-10-15_07ec4d037af1f4476dd1d9f20b9f5351_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe 4776 2026-10-15_07ec4d037af1f4476dd1d9f20b9f5351_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe 4776 2026-10-15_07ec4d037af1f4476dd1d9f20b9f5351_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe 4776 2026-10-15_07ec4d037af1f4476dd1d9f20b9f5351_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe - Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4776 2026-10-15_07ec4d037af1f4476dd1d9f20b9f5351_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe Token: SeSecurityPrivilege 4776 2026-10-15_07ec4d037af1f4476dd1d9f20b9f5351_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe Token: SeTakeOwnershipPrivilege 4776 2026-10-15_07ec4d037af1f4476dd1d9f20b9f5351_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe Token: SeLoadDriverPrivilege 4776 2026-10-15_07ec4d037af1f4476dd1d9f20b9f5351_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe Token: SeSystemProfilePrivilege 4776 2026-10-15_07ec4d037af1f4476dd1d9f20b9f5351_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe Token: SeSystemtimePrivilege 4776 2026-10-15_07ec4d037af1f4476dd1d9f20b9f5351_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe Token: SeProfSingleProcessPrivilege 4776 2026-10-15_07ec4d037af1f4476dd1d9f20b9f5351_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe Token: SeIncBasePriorityPrivilege 4776 2026-10-15_07ec4d037af1f4476dd1d9f20b9f5351_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe Token: SeCreatePagefilePrivilege 4776 2026-10-15_07ec4d037af1f4476dd1d9f20b9f5351_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe Token: SeBackupPrivilege 4776 2026-10-15_07ec4d037af1f4476dd1d9f20b9f5351_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe Token: SeRestorePrivilege 4776 2026-10-15_07ec4d037af1f4476dd1d9f20b9f5351_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe Token: SeShutdownPrivilege 4776 2026-10-15_07ec4d037af1f4476dd1d9f20b9f5351_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe Token: SeDebugPrivilege 4776 2026-10-15_07ec4d037af1f4476dd1d9f20b9f5351_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe Token: SeSystemEnvironmentPrivilege 4776 2026-10-15_07ec4d037af1f4476dd1d9f20b9f5351_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe Token: SeRemoteShutdownPrivilege 4776 2026-10-15_07ec4d037af1f4476dd1d9f20b9f5351_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe Token: SeUndockPrivilege 4776 2026-10-15_07ec4d037af1f4476dd1d9f20b9f5351_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe Token: SeManageVolumePrivilege 4776 2026-10-15_07ec4d037af1f4476dd1d9f20b9f5351_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe Token: 33 4776 2026-10-15_07ec4d037af1f4476dd1d9f20b9f5351_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe Token: 34 4776 2026-10-15_07ec4d037af1f4476dd1d9f20b9f5351_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe Token: 35 4776 2026-10-15_07ec4d037af1f4476dd1d9f20b9f5351_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe Token: 36 4776 2026-10-15_07ec4d037af1f4476dd1d9f20b9f5351_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-15_07ec4d037af1f4476dd1d9f20b9f5351_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-15_07ec4d037af1f4476dd1d9f20b9f5351_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_lu.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4776