Overview

overview

7

Static

static

3

2026-10-22...er.exe

windows10-2004-x64

7

2026-10-22...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/10/2026, 21:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-22_0f50de697547dab193c5758fd40167c2_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
  • Size 2.5MB
  • Sample261024-1k9e8set4l
  • SHA256 fcb6ef30dbb786849607e27c1d8176a5e5bb2f5c4c1c5504cb8f715caeb5780f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasionexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 8 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 2 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 8 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-22_0f50de697547dab193c5758fd40167c2_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-22_0f50de697547dab193c5758fd40167c2_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Direct Volume Access: Opens a physical disk for reading
    • Suspicious use of WriteProcessMemory
    PID:5372
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\1c548427.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:4792
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn Update695ff4 /tr C:\Users\Admin\AppData\Local\Temp\2026-10-22_0f50de697547dab193c5758fd40167c2_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:5320
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\29cba0b5.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:3456
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command " $s = New-Object -comObject WScript.Shell $l = $s.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systemd9139.lnk\") $l.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-10-22_0f50de697547dab193c5758fd40167c2_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\" $l.Save() "
      2⤵
      • Creates a file in the Startup directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5340
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\6a387a3f.exe
      2⤵
      • Views/modifies file attributes
      PID:2176
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\5e6d1b50.exe
      2⤵
      • Views/modifies file attributes
      PID:3224
  • C:\Users\Admin\AppData\Local\Temp\2026-10-22_0f50de697547dab193c5758fd40167c2_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    C:\Users\Admin\AppData\Local\Temp\2026-10-22_0f50de697547dab193c5758fd40167c2_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Direct Volume Access: Opens a physical disk for reading
    • Suspicious use of WriteProcessMemory
    PID:3232
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn Update515e5b /tr C:\Users\Admin\AppData\Local\Temp\2026-10-22_0f50de697547dab193c5758fd40167c2_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2184
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\21cff595.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:2492
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\42f24458.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:5768
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command " $s = New-Object -comObject WScript.Shell $l = $s.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System8aeb4.lnk\") $l.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-10-22_0f50de697547dab193c5758fd40167c2_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\" $l.Save() "
      2⤵
      • Creates a file in the Startup directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2052
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\0899f948.exe
      2⤵
      • Views/modifies file attributes
      PID:980
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\150a2223.exe
      2⤵
      • Views/modifies file attributes
      PID:5572

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        powershell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        • Size 2KB
        • SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 209d3e29f652102e18d555e843826e3908c5ccb0fce183df3bbee7f171abab24
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        150a2223.exe
        • Path C:\Users\Admin\AppData\Local\Temp\150a2223.exe
        • Size 2.5MB
        • SHA256 563613a31e33c739e337cff603bf918b0782e2b7282b0e31fd5fb6bbda4cb394
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        5e6d1b50.exe
        • Path C:\Users\Admin\AppData\Local\Temp\5e6d1b50.exe
        • Size 2.5MB
        • SHA256 bf492c759246f7da83910e3ebbd1b27130f34bd043197c50e5177717737f3d02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_ncfimfrr.cwc.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ncfimfrr.cwc.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        0899f948.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\0899f948.exe
        • Size 2.5MB
        • SHA256 e26617fcb04e0f90038c01bee63e6b1a9461c6acac1093d4bb2ac957854e354d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        6a387a3f.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\6a387a3f.exe
        • Size 2.5MB
        • SHA256 4b7687c7aa61715537fe6719ec55ec7bd4a3d4561e70f485d160fa9437a36107
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        29cba0b5.exe
        • Path C:\Windows\SysWOW64\29cba0b5.exe
        • Size 2.5MB
        • SHA256 3606eb1f6744ab02ca7f8e4ca1c7b1ddb3ab1e554de1e959dc3cca99b8d8d0d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        42f24458.exe
        • Path C:\Windows\SysWOW64\42f24458.exe
        • Size 2.5MB
        • SHA256 822070ea4c55d33d737c1f3307d1f12f64db0e283867a2622da48719b07331f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        1c548427.exe
        • Path C:\Windows\System32\1c548427.exe
        • Size 2.5MB
        • SHA256 413ea90d67022987e6a0f3555633be8dac961220bdfa76027389c08e315e061a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        21cff595.exe
        • Path C:\Windows\System32\21cff595.exe
        • Size 2.5MB
        • SHA256 80df7682c320966b61b5ba65ab900b4395cb67317e5711fa2371118a776f7017
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5340-12-0x00000132B7890000-0x00000132B78B2000-memory.dmp
        Download

        memory/5340-5-0x00000132B5710000-0x00000132B5720000-memory.dmp
        Download

        memory/5340-6-0x00000132B5710000-0x00000132B5720000-memory.dmp
        Download