Overview

overview

7

Static

static

3

2026-10-22...er.exe

windows10-2004-x64

7

2026-10-22...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    129s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/10/2026, 09:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-22_6d6f3802ee3c907d4e9fca7dde4855de_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
  • Size 2.5MB
  • Sample261024-lf9swaef74
  • SHA256 90e57758bedd151a987a5cf08cbe673ec6e5c13469df77dd4d629685ed6f0481
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasionexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 8 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 2 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 8 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-22_6d6f3802ee3c907d4e9fca7dde4855de_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-22_6d6f3802ee3c907d4e9fca7dde4855de_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Direct Volume Access: Opens a physical disk for reading
    • Suspicious use of WriteProcessMemory
    PID:5068
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\db5122b5.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:4752
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdate4c9cd8 /tr C:\Users\Admin\AppData\Local\Temp\2026-10-22_6d6f3802ee3c907d4e9fca7dde4855de_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:5104
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\3c2efb83.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:3408
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command " $WshShell = New-Object -comObject WScript.Shell $Shortcut = $WshShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systemea4f2.lnk\") $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-10-22_6d6f3802ee3c907d4e9fca7dde4855de_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\" $Shortcut.Save() "
      2⤵
      • Creates a file in the Startup directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2936
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\7a1824e5.exe
      2⤵
      • Views/modifies file attributes
      PID:5448
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\be489f29.exe
      2⤵
      • Views/modifies file attributes
      PID:1552
  • C:\Users\Admin\AppData\Local\Temp\2026-10-22_6d6f3802ee3c907d4e9fca7dde4855de_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    C:\Users\Admin\AppData\Local\Temp\2026-10-22_6d6f3802ee3c907d4e9fca7dde4855de_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Direct Volume Access: Opens a physical disk for reading
    • Suspicious use of WriteProcessMemory
    PID:3228
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdate909e99 /tr C:\Users\Admin\AppData\Local\Temp\2026-10-22_6d6f3802ee3c907d4e9fca7dde4855de_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:3708
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\2bfc691e.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:5468
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\77a5af3c.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:4684
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command " $WshShell = New-Object -comObject WScript.Shell $Shortcut = $WshShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System94228.lnk\") $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-10-22_6d6f3802ee3c907d4e9fca7dde4855de_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\" $Shortcut.Save() "
      2⤵
      • Creates a file in the Startup directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2588
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\83e797fc.exe
      2⤵
      • Views/modifies file attributes
      PID:3996
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\5646ebab.exe
      2⤵
      • Views/modifies file attributes
      PID:2644

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 dea234ed69b56a5ac20026ced884f4bb792af688a6a339fefb58f73068aaa846
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        5646ebab.exe
        • Path C:\Users\Admin\AppData\Local\Temp\5646ebab.exe
        • Size 2.5MB
        • SHA256 881a07062dbcb73b6b20c174caec539884e23057090b60efe4bb2dbbacc15998
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_zkvxv4q4.u53.psm1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zkvxv4q4.u53.psm1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        be489f29.exe
        • Path C:\Users\Admin\AppData\Local\Temp\be489f29.exe
        • Size 2.5MB
        • SHA256 0abc1dd5b9569f2caee27bbd10cc1f83729c77999870ec41c8fa5fe4f754e487
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7a1824e5.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\7a1824e5.exe
        • Size 2.5MB
        • SHA256 feb3862c047a50bb3829edc6e6f991be0ed8be1351dec5dcd7b6bb09ce73b220
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        83e797fc.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\83e797fc.exe
        • Size 2.5MB
        • SHA256 c5898e7a6eb0e1d1cf023fba2fefca4e600847f1821fd0c6c63c9709b630679b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        3c2efb83.exe
        • Path C:\Windows\SysWOW64\3c2efb83.exe
        • Size 2.5MB
        • SHA256 7235c855ba8edaa1a115438700137df220b3b5e61ee5eb4335b162cb73ab502e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        77a5af3c.exe
        • Path C:\Windows\SysWOW64\77a5af3c.exe
        • Size 2.5MB
        • SHA256 fa90c7ab65703b3c76d5a2f445e7da71db810d2db29c82955b5b5126902e7454
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2bfc691e.exe
        • Path C:\Windows\System32\2bfc691e.exe
        • Size 2.5MB
        • SHA256 e66f56dabfdaf66e61f73fa890aa41b2d07f871b5218be85d727c080ff15a108
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        db5122b5.exe
        • Path C:\Windows\System32\db5122b5.exe
        • Size 2.5MB
        • SHA256 a8ad7a7838d3f8bb97e7461a4edbfa92fc38b9713de0bd1526c4688d03361bc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2936-15-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
        Download

        memory/2936-16-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
        Download

        memory/2936-17-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
        Download

        memory/2936-19-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
        Download

        memory/2936-22-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
        Download

        memory/2936-23-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
        Download

        memory/2936-14-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
        Download

        memory/2936-13-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
        Download

        memory/2936-9-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
        Download

        memory/2936-12-0x0000027E71610000-0x0000027E71632000-memory.dmp
        Download

        memory/2936-8-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
        Download

        memory/2936-5-0x00007FFC5270F000-0x00007FFC52710000-memory.dmp
        Download