Overview

overview

7

Static

static

3

2026-10-25...er.exe

windows10-2004-x64

7

2026-10-25...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    26/10/2026, 13:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-25_bdf568ca3cb096e6914fd3cf6068f9e4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
  • Size 2.5MB
  • Sample261026-q95s8set4s
  • SHA256 93aa0bb9cd6bd8c2535c8521361260c61b7c2c8d263fee3936d5b28eb1c3bc32
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasionexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 4 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Drops file in System32 directory 16 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 4 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 16 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdf568ca3cb096e6914fd3cf6068f9e4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdf568ca3cb096e6914fd3cf6068f9e4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Direct Volume Access: Opens a physical disk for reading
    • Suspicious use of WriteProcessMemory
    PID:3348
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\b542045a.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:3752
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn Update1832ad /tr C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdf568ca3cb096e6914fd3cf6068f9e4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:1556
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\05d4c0c8.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:2732
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command " $s = New-Object -comObject WScript.Shell $l = $s.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systeme11f8.lnk\") $l.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdf568ca3cb096e6914fd3cf6068f9e4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\" $l.Save() "
      2⤵
      • Creates a file in the Startup directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4196
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\86b1bfd6.exe
      2⤵
      • Views/modifies file attributes
      PID:1064
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\9697974c.exe
      2⤵
      • Views/modifies file attributes
      PID:1008
  • C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdf568ca3cb096e6914fd3cf6068f9e4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdf568ca3cb096e6914fd3cf6068f9e4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Direct Volume Access: Opens a physical disk for reading
    • Suspicious use of WriteProcessMemory
    PID:4804
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn Update9a488d /tr C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdf568ca3cb096e6914fd3cf6068f9e4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4608
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\f1d46079.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:1384
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\22285d77.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:2060
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command " $s = New-Object -comObject WScript.Shell $l = $s.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System2f6a1.lnk\") $l.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdf568ca3cb096e6914fd3cf6068f9e4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\" $l.Save() "
      2⤵
      • Creates a file in the Startup directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4404
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\fc3dd721.exe
      2⤵
      • Views/modifies file attributes
      PID:204
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\06625cb2.exe
      2⤵
      • Views/modifies file attributes
      PID:3500
  • C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdf568ca3cb096e6914fd3cf6068f9e4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdf568ca3cb096e6914fd3cf6068f9e4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Direct Volume Access: Opens a physical disk for reading
    • Suspicious use of WriteProcessMemory
    PID:3752
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\e476b751.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:2776
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn Update90ccfc /tr C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdf568ca3cb096e6914fd3cf6068f9e4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2616
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\a018c09a.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:4668
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command " $s = New-Object -comObject WScript.Shell $l = $s.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systeme5371.lnk\") $l.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdf568ca3cb096e6914fd3cf6068f9e4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\" $l.Save() "
      2⤵
      • Creates a file in the Startup directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2836
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\a7f00b0e.exe
      2⤵
      • Views/modifies file attributes
      PID:2264
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\d38d45a6.exe
      2⤵
      • Views/modifies file attributes
      PID:216
  • C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdf568ca3cb096e6914fd3cf6068f9e4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdf568ca3cb096e6914fd3cf6068f9e4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Direct Volume Access: Opens a physical disk for reading
    • Suspicious use of WriteProcessMemory
    PID:1836
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn Update633c04 /tr C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdf568ca3cb096e6914fd3cf6068f9e4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:1816
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\49a9ff94.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:956
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\0f4199b9.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:3196
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command " $s = New-Object -comObject WScript.Shell $l = $s.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systemb8e44.lnk\") $l.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdf568ca3cb096e6914fd3cf6068f9e4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\" $l.Save() "
      2⤵
      • Creates a file in the Startup directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3456
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\8659d9e2.exe
      2⤵
      • Views/modifies file attributes
      PID:4764
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\7d22c235.exe
      2⤵
      • Views/modifies file attributes
      PID:4128

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        powershell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        • Size 2KB
        • SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 209d3e29f652102e18d555e843826e3908c5ccb0fce183df3bbee7f171abab24
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 51ee889212834fdeb58d41531f3aa31002e52038857ee5b13a12db1b93521b94
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 fff6ee24ae8bcdd3214dc0416d8b5a190555069b7429a786637fe5a3d6421d1a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        06625cb2.exe
        • Path C:\Users\Admin\AppData\Local\Temp\06625cb2.exe
        • Size 2.5MB
        • SHA256 5655d988b1b6186fb32f5bf4eb68c9a3ec3939ec15fa8c14368538a1ac7b8dda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7d22c235.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7d22c235.exe
        • Size 2.5MB
        • SHA256 659aabf15384e03db4d08204c3c633874d525094ac713bb2f5506d30de43884a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        9697974c.exe
        • Path C:\Users\Admin\AppData\Local\Temp\9697974c.exe
        • Size 2.5MB
        • SHA256 5cf82975a3e3005852a6ff34aa4d1bc67a904b4d0500e30da05645c8d0b37b99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_pk4ssbeb.55o.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pk4ssbeb.55o.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        d38d45a6.exe
        • Path C:\Users\Admin\AppData\Local\Temp\d38d45a6.exe
        • Size 2.5MB
        • SHA256 8e4489c23b5716e8eccc0349b21f8495b0d7f6c390c00de3ab4d72625c21b90e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        8659d9e2.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\8659d9e2.exe
        • Size 2.5MB
        • SHA256 d9d748d24776eb55058f097f47f2cdaf729ab903116adbaa48192aec1f11a748
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        86b1bfd6.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\86b1bfd6.exe
        • Size 2.5MB
        • SHA256 d549f80e5bb60edaf04a94afd8db14e95c77738e73cfae5e12394b1d862d6910
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        a7f00b0e.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\a7f00b0e.exe
        • Size 2.5MB
        • SHA256 5687f84cd4d212294cb91c0e8b104e442dfb52517d537eb66a8393848b24860a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fc3dd721.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\fc3dd721.exe
        • Size 2.5MB
        • SHA256 2d13a13538ecd921b1750c0b988111d2d94eab150d6c6766030a352484e6ea90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        05d4c0c8.exe
        • Path C:\Windows\SysWOW64\05d4c0c8.exe
        • Size 2.5MB
        • SHA256 e9b2a65a7bc34d0742b9dfa31f0e601885e2a33eb77f04dfba5a378e5b611149
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        0f4199b9.exe
        • Path C:\Windows\SysWOW64\0f4199b9.exe
        • Size 2.5MB
        • SHA256 d7c9a88a622dcf8f6f799b50cece4eedee6b31034e8e3cf7d84ebf3499096329
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        22285d77.exe
        • Path C:\Windows\SysWOW64\22285d77.exe
        • Size 2.5MB
        • SHA256 1ce51a8691b02877cdaa7dd6160b5a51fa0ab70d42593cc308bc62a27511e52c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        a018c09a.exe
        • Path C:\Windows\SysWOW64\a018c09a.exe
        • Size 2.5MB
        • SHA256 bed6b7ba070ab2d333fff28ce0c394982d63ae8017c25efab02eefbbf1251a6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        49a9ff94.exe
        • Path C:\Windows\System32\49a9ff94.exe
        • Size 2.5MB
        • SHA256 a1b400d16cd78928a4791945183921d49ef1ac9fbd40691b1ac7c9433d698090
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        b542045a.exe
        • Path C:\Windows\System32\b542045a.exe
        • Size 2.5MB
        • SHA256 be702f03887a349c85fba28846265d6282c37ce57a074538af57a7c168d500d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e476b751.exe
        • Path C:\Windows\System32\e476b751.exe
        • Size 2.5MB
        • SHA256 f58b8ad80d0fec343dcead52deea1f687da085e764a1cf24824b46fc824d5f18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        f1d46079.exe
        • Path C:\Windows\System32\f1d46079.exe
        • Size 2.5MB
        • SHA256 8b8635abaf3de4c5d03ce817a208aca446099185f217d76763bfe369b4c6a4fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2836-67-0x000001BF9A390000-0x000001BF9A4DE000-memory.dmp
        Download

        memory/3456-76-0x0000013D646E0000-0x0000013D6482E000-memory.dmp
        Download

        memory/4196-7-0x000002BF70BA0000-0x000002BF70BC2000-memory.dmp
        Download

        memory/4196-5-0x000002BF6E9B0000-0x000002BF6E9C0000-memory.dmp
        Download