Overview

overview

7

Static

static

3

2026-10-24...er.exe

windows10-2004-x64

7

2026-10-24...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/10/2026, 23:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-24_fe50482fe0852413af27eb7d35a46f84_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
  • Size 2.5MB
  • Sample261024-31ypsaga59
  • SHA256 995ef2d207b6977616ac155fc65f21dd10cce1b6b952b8dc6bd623c3601bffdc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasionexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 4 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Drops file in System32 directory 16 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 4 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 16 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-24_fe50482fe0852413af27eb7d35a46f84_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-24_fe50482fe0852413af27eb7d35a46f84_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Direct Volume Access: Opens a physical disk for reading
    • Suspicious use of WriteProcessMemory
    PID:3564
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn 2a41b7e1 /tr C:\Users\Admin\AppData\Local\Temp\2026-10-24_fe50482fe0852413af27eb7d35a46f84_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:1684
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\5608a6e3.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:1308
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\3673e2b7.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:6052
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$s=New-Object -comObject WScript.Shell;$l=$s.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dc4023.lnk\");$l.TargetPath=\"C:\Users\Admin\AppData\Local\Temp\2026-10-24_fe50482fe0852413af27eb7d35a46f84_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\";$l.Save()"
      2⤵
      • Creates a file in the Startup directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5888
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\df69bc2c.exe
      2⤵
      • Views/modifies file attributes
      PID:4796
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\ed3a5def.exe
      2⤵
      • Views/modifies file attributes
      PID:4420
  • C:\Users\Admin\AppData\Local\Temp\2026-10-24_fe50482fe0852413af27eb7d35a46f84_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    C:\Users\Admin\AppData\Local\Temp\2026-10-24_fe50482fe0852413af27eb7d35a46f84_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Direct Volume Access: Opens a physical disk for reading
    • Suspicious use of WriteProcessMemory
    PID:4220
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn 16f340c6 /tr C:\Users\Admin\AppData\Local\Temp\2026-10-24_fe50482fe0852413af27eb7d35a46f84_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:5836
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\97a0733a.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:2220
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\cb5201e5.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:4688
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$s=New-Object -comObject WScript.Shell;$l=$s.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8e4a7e.lnk\");$l.TargetPath=\"C:\Users\Admin\AppData\Local\Temp\2026-10-24_fe50482fe0852413af27eb7d35a46f84_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\";$l.Save()"
      2⤵
      • Creates a file in the Startup directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5696
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\329bedf3.exe
      2⤵
      • Views/modifies file attributes
      PID:1332
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\a64aa09c.exe
      2⤵
      • Views/modifies file attributes
      PID:3516
  • C:\Users\Admin\AppData\Local\Temp\2026-10-24_fe50482fe0852413af27eb7d35a46f84_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-24_fe50482fe0852413af27eb7d35a46f84_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Direct Volume Access: Opens a physical disk for reading
    • Suspicious use of WriteProcessMemory
    PID:4980
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\9fd29e2b.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:1136
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn 64b6e97a /tr C:\Users\Admin\AppData\Local\Temp\2026-10-24_fe50482fe0852413af27eb7d35a46f84_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4160
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$s=New-Object -comObject WScript.Shell;$l=$s.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\32116a.lnk\");$l.TargetPath=\"C:\Users\Admin\AppData\Local\Temp\2026-10-24_fe50482fe0852413af27eb7d35a46f84_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\";$l.Save()"
      2⤵
      • Creates a file in the Startup directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5892
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\a96e1b6e.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:3252
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\c0bf91e7.exe
      2⤵
      • Views/modifies file attributes
      PID:2480
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\53c607d5.exe
      2⤵
      • Views/modifies file attributes
      PID:5848
  • C:\Users\Admin\AppData\Local\Temp\2026-10-24_fe50482fe0852413af27eb7d35a46f84_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-24_fe50482fe0852413af27eb7d35a46f84_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Direct Volume Access: Opens a physical disk for reading
    • Suspicious use of WriteProcessMemory
    PID:1292
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn 70e03692 /tr C:\Users\Admin\AppData\Local\Temp\2026-10-24_fe50482fe0852413af27eb7d35a46f84_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2852
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\d9a668d9.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:1916
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$s=New-Object -comObject WScript.Shell;$l=$s.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b2738c.lnk\");$l.TargetPath=\"C:\Users\Admin\AppData\Local\Temp\2026-10-24_fe50482fe0852413af27eb7d35a46f84_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\";$l.Save()"
      2⤵
      • Creates a file in the Startup directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2752
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\ea3f229a.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:2612
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\84c8dbb9.exe
      2⤵
      • Views/modifies file attributes
      PID:4148
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\f6e2d97d.exe
      2⤵
      • Views/modifies file attributes
      PID:1308

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 f9d54fa6e10d00480c3baaf723ae4ccafeb8bd822ffa9914f662317bd93fb308
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 7bde7b3ba2d5e8261cff157f2b49ca62a1f5cb0b1c5ae6fb70d353f7311ec1de
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 452eb598b2884fd99242cb5db005e3ac8e31bc9e3d58fe88ad0dd79ba08fbfd1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        53c607d5.exe
        • Path C:\Users\Admin\AppData\Local\Temp\53c607d5.exe
        • Size 2.5MB
        • SHA256 691e7f3d5f9786be941486482631cfc5e9295d016beb6f0d3f74463a186a6e88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_r1v4glmm.zn5.psm1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r1v4glmm.zn5.psm1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        a64aa09c.exe
        • Path C:\Users\Admin\AppData\Local\Temp\a64aa09c.exe
        • Size 2.5MB
        • SHA256 b693aa318988c1fcd232e424e41717d7b70c30acaf6e3d75a1fa90a4a86a5759
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ed3a5def.exe
        • Path C:\Users\Admin\AppData\Local\Temp\ed3a5def.exe
        • Size 2.5MB
        • SHA256 6137fe1d34c33105f2aa8f6261aa7faf61673da3533c8df7dec45bf88824b0ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        f6e2d97d.exe
        • Path C:\Users\Admin\AppData\Local\Temp\f6e2d97d.exe
        • Size 2.5MB
        • SHA256 1053bbb37600829e8e1bbd218add0e69d367caf864c31cf452c95f4c1f82ffce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        329bedf3.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\329bedf3.exe
        • Size 2.5MB
        • SHA256 cbcce01412c2d9774071081d2bed1ee712174541f5c684a61e39be5cd26a6985
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        84c8dbb9.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\84c8dbb9.exe
        • Size 2.5MB
        • SHA256 966e1c16e9af181458468398830c2534378e3ddc5efbb8feaf172d7445c31a74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        c0bf91e7.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\c0bf91e7.exe
        • Size 2.5MB
        • SHA256 c596e2837e8c2b3ac137f0e94d7b01bf4492327fa5ff0700343dda5b964d90ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        df69bc2c.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\df69bc2c.exe
        • Size 2.5MB
        • SHA256 4c74a63e989da4e0ce1a15506bff6a31da585608ae8b7c71f14d237db5665a21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        3673e2b7.exe
        • Path C:\Windows\SysWOW64\3673e2b7.exe
        • Size 2.5MB
        • SHA256 c17ce3444c0a7c12183ca6b02b500d2c7ea99382fd2d245f156a80c1e017bc58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        a96e1b6e.exe
        • Path C:\Windows\SysWOW64\a96e1b6e.exe
        • Size 2.5MB
        • SHA256 5143a945ff1d14249400021ccdb1792545880749ad46ea2fd3701ce04ae3fec1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cb5201e5.exe
        • Path C:\Windows\SysWOW64\cb5201e5.exe
        • Size 2.5MB
        • SHA256 9ba0b8cbf77bdd86a94bbb09ddd926a7b064a6545f15308d6a3f210b9ae03157
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ea3f229a.exe
        • Path C:\Windows\SysWOW64\ea3f229a.exe
        • Size 2.5MB
        • SHA256 8aa4dc3bb784966b81ebcaf31573cc4249505330b4b8cf4e3bbbd8f073495711
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        5608a6e3.exe
        • Path C:\Windows\System32\5608a6e3.exe
        • Size 2.5MB
        • SHA256 0dfe40b4c21ff41573503884d8a31bf7b24dc287d2c484a6bfa1626b3aa6ffe5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        97a0733a.exe
        • Path C:\Windows\System32\97a0733a.exe
        • Size 2.5MB
        • SHA256 47cf5fe725e7fc3914aafa9d142fe8e1e5c9ccd312842a7cb1378ace33793998
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        9fd29e2b.exe
        • Path C:\Windows\System32\9fd29e2b.exe
        • Size 2.5MB
        • SHA256 44779986c7d1f51319c63d74cf19352d6e0de09b09e253d87725f7d21482e04d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        d9a668d9.exe
        • Path C:\Windows\System32\d9a668d9.exe
        • Size 2.5MB
        • SHA256 c03836d575d1882ca51450b443c76da7c600f74583681829013a23874a6d5e1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5888-20-0x00007FFDBE140000-0x00007FFDBEAE4000-memory.dmp
        Download

        memory/5888-21-0x00007FFDBE140000-0x00007FFDBEAE4000-memory.dmp
        Download

        memory/5888-10-0x00007FFDBE140000-0x00007FFDBEAE4000-memory.dmp
        Download

        memory/5888-9-0x0000024E27AE0000-0x0000024E27B02000-memory.dmp
        Download

        memory/5888-30-0x00007FFDBE140000-0x00007FFDBEAE4000-memory.dmp
        Download

        memory/5888-24-0x00007FFDBE140000-0x00007FFDBEAE4000-memory.dmp
        Download

        memory/5888-8-0x00007FFDBE140000-0x00007FFDBEAE4000-memory.dmp
        Download

        memory/5888-11-0x00007FFDBE140000-0x00007FFDBEAE4000-memory.dmp
        Download

        memory/5888-22-0x00007FFDBE140000-0x00007FFDBEAE4000-memory.dmp
        Download

        memory/5888-12-0x00007FFDBE140000-0x00007FFDBEAE4000-memory.dmp
        Download

        memory/5888-4-0x00007FFDBE2CF000-0x00007FFDBE2D0000-memory.dmp
        Download

        memory/5888-19-0x00007FFDBE140000-0x00007FFDBEAE4000-memory.dmp
        Download

        memory/5888-18-0x00007FFDBE140000-0x00007FFDBEAE4000-memory.dmp
        Download

        memory/5888-17-0x00007FFDBE140000-0x00007FFDBEAE4000-memory.dmp
        Download

        memory/5888-16-0x00007FFDBE140000-0x00007FFDBEAE4000-memory.dmp
        Download