Overview

overview

8

Static

static

3

2026-10-22...er.exe

windows10-2004-x64

8

2026-10-22...er.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    115s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/10/2026, 13:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-22_4c58e8fc133b3e4c07293d2771b4a796_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
  • Size 2.5MB
  • Sample261024-q88thavtex
  • SHA256 c48eaab8bac250d322cf4f32683eb82788d644b38c37b714befffa2fe168c722
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasionexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 2 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 10 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-22_4c58e8fc133b3e4c07293d2771b4a796_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-22_4c58e8fc133b3e4c07293d2771b4a796_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe"
    1⤵
    • Adds Run key to start application
    • Direct Volume Access: Opens a physical disk for reading
    • Suspicious use of WriteProcessMemory
    PID:4356
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\8fd426f4.tmp
      2⤵
      • Views/modifies file attributes
      PID:3308
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn 36993806 /tr C:\Users\Admin\AppData\Local\Temp\2026-10-22_4c58e8fc133b3e4c07293d2771b4a796_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe /sc daily /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:856
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\f11a1b33.dat
      2⤵
      • Views/modifies file attributes
      PID:4552
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command " $a = New-Object -comObject WScript.Shell $b = $a.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\247b34da.lnk\") $b.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-10-22_4c58e8fc133b3e4c07293d2771b4a796_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe\" $b.Save() "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Creates a file in the Startup directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:944
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\1da4f057.bin
      2⤵
      • Views/modifies file attributes
      PID:3240
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\897c9abd.log
      2⤵
      • Views/modifies file attributes
      PID:4072
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\b106a635.cache
      2⤵
      • Views/modifies file attributes
      PID:392
  • C:\Users\Admin\AppData\Local\Temp\2026-10-22_4c58e8fc133b3e4c07293d2771b4a796_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
    C:\Users\Admin\AppData\Local\Temp\2026-10-22_4c58e8fc133b3e4c07293d2771b4a796_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
    1⤵
    • Adds Run key to start application
    • Direct Volume Access: Opens a physical disk for reading
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn 605eb46d /tr C:\Users\Admin\AppData\Local\Temp\2026-10-22_4c58e8fc133b3e4c07293d2771b4a796_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe /sc daily /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2724
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\d1c5eed8.tmp
      2⤵
      • Views/modifies file attributes
      PID:532
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command " $a = New-Object -comObject WScript.Shell $b = $a.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c0e36d68.lnk\") $b.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-10-22_4c58e8fc133b3e4c07293d2771b4a796_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe\" $b.Save() "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Creates a file in the Startup directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2140
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\81b0ce00.dat
      2⤵
      • Views/modifies file attributes
      PID:220
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\4abfc712.bin
      2⤵
      • Views/modifies file attributes
      PID:4008
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\548e8d6b.log
      2⤵
      • Views/modifies file attributes
      PID:3268
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\5cb2e005.cache
      2⤵
      • Views/modifies file attributes
      PID:3932

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        1da4f057.bin
        • Path C:\Users\Admin\AppData\Local\1da4f057.bin
        • Size 2.5MB
        • SHA256 4cd8bf8e2ed7b597e80881d69ccf0698e919e9881b211b0a8724bdcaabb7661d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        4abfc712.bin
        • Path C:\Users\Admin\AppData\Local\4abfc712.bin
        • Size 2.5MB
        • SHA256 654a53abf71189e6e2025c93a2226cd2a8b40494206128f969b437962deef28b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        powershell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        • Size 2KB
        • SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 e2a0aa31308cace2aeecb323a16480755b7d85438a75a2f174a4dcaa4e306a16
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        548e8d6b.log
        • Path C:\Users\Admin\AppData\Local\Temp\548e8d6b.log
        • Size 2.5MB
        • SHA256 e6d9f149b3c8d0ef22ced329100ce9e6cac8df301ef8a276bb24efdcf91c8402
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        897c9abd.log
        • Path C:\Users\Admin\AppData\Local\Temp\897c9abd.log
        • Size 2.5MB
        • SHA256 7924bb826727f509d5629173855cb7465e43a0ce7c5f5c0ec69a0de25d68cbeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        8fd426f4.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\8fd426f4.tmp
        • Size 2.5MB
        • SHA256 8dc9ba32e70ea666a0a5d3d61001aff63db09fcb8e83a275df818aaae8bac8fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_qcwz221h.5ch.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qcwz221h.5ch.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        d1c5eed8.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\d1c5eed8.tmp
        • Size 2.5MB
        • SHA256 0269445fc9c54c88c144b34886c615671b41b8c9f12fc40c9a0cf27c6ca49836
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        81b0ce00.dat
        • Path C:\Users\Admin\AppData\Roaming\81b0ce00.dat
        • Size 2.5MB
        • SHA256 58b76d61819498ea4f2df7b01c868528911619a4d904fa4efade22c6feabc639
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        5cb2e005.cache
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\5cb2e005.cache
        • Size 2.5MB
        • SHA256 fb92a1992f56fcaf0cf7dd580384903b726113efc939053eb8e734e2327d8e26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        b106a635.cache
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\b106a635.cache
        • Size 2.5MB
        • SHA256 41a6a78ea6e3d7e735bd698b2cd50a99e60cd2b662d0eabec21c6e0bfffa1735
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        f11a1b33.dat
        • Path C:\Users\Admin\AppData\Roaming\f11a1b33.dat
        • Size 2.5MB
        • SHA256 8f1d2a7725f34989b7d5b35dc2b7baf8da833acd88fe4f5b36f4e95030b5d7a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/944-12-0x00000274FD8E0000-0x00000274FD902000-memory.dmp
        Download

        memory/944-5-0x00000274FB830000-0x00000274FB840000-memory.dmp
        Download

        memory/944-4-0x00000274FB830000-0x00000274FB840000-memory.dmp
        Download