Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/10/2026, 18:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-18_0dda5e4e728882c3bf04cfe6f6938c43_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-18_0dda5e4e728882c3bf04cfe6f6938c43_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
Resource
win11ltsc2024-20260911-en
2 signatures
150 seconds
General
- Target 2026-10-18_0dda5e4e728882c3bf04cfe6f6938c43_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
- Size 21.2MB
- Sample261018-wnf6msg15v
- SHA256 69ba4b554b668879c150d0790983146cdc682e3d8d8c548a0df11ebb934b5a36
- MD5 0dda5e4e728882c3bf04cfe6f6938c43
- SHA1 679430a20fd5b86e0244e1c01c5c481056c89452
- SHA512 4f8af684a15df4248a8c2bcba62339e14fd1b435c6549cd1573c88860d8623b7d75816ded7cb3db9a54323ff0bf6ddc3d6e0d6aaa04423dee36fbef190d453d6
- SSDEEP 196608:2en33XyWZ4JInnhbahpIvIg7945P8Fl1lXLprDjXyAN411NJ:2W33XyMn5aXIG8FtLprvyC4pJ
- TLSH T10027AE43E87505E9C0AAD271C6668213BA343C894B3163D37BA0FB352F76BD0AE79745
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2452 2026-10-18_0dda5e4e728882c3bf04cfe6f6938c43_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe 2452 2026-10-18_0dda5e4e728882c3bf04cfe6f6938c43_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe 2452 2026-10-18_0dda5e4e728882c3bf04cfe6f6938c43_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2452 2026-10-18_0dda5e4e728882c3bf04cfe6f6938c43_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe 2452 2026-10-18_0dda5e4e728882c3bf04cfe6f6938c43_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe 2452 2026-10-18_0dda5e4e728882c3bf04cfe6f6938c43_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-18_0dda5e4e728882c3bf04cfe6f6938c43_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-18_0dda5e4e728882c3bf04cfe6f6938c43_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2452