Overview

overview

7

Static

static

3

2026-10-25...er.exe

windows10-2004-x64

7

2026-10-25...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    26/10/2026, 13:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-25_bdf568ca3cb096e6914fd3cf6068f9e4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
  • Size 2.5MB
  • Sample261026-q95s8set4s
  • SHA256 93aa0bb9cd6bd8c2535c8521361260c61b7c2c8d263fee3936d5b28eb1c3bc32
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasionexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 4 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Drops file in System32 directory 16 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 4 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 16 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdf568ca3cb096e6914fd3cf6068f9e4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdf568ca3cb096e6914fd3cf6068f9e4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Direct Volume Access: Opens a physical disk for reading
    • Suspicious use of WriteProcessMemory
    PID:1944
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn Update06ee77 /tr C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdf568ca3cb096e6914fd3cf6068f9e4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:5616
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\6f067e82.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:5096
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\7f1eea43.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:4896
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command " $s = New-Object -comObject WScript.Shell $l = $s.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systemd17b3.lnk\") $l.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdf568ca3cb096e6914fd3cf6068f9e4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\" $l.Save() "
      2⤵
      • Creates a file in the Startup directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5816
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\864c0503.exe
      2⤵
      • Views/modifies file attributes
      PID:1800
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\da3e7ba6.exe
      2⤵
      • Views/modifies file attributes
      PID:5168
  • C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdf568ca3cb096e6914fd3cf6068f9e4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdf568ca3cb096e6914fd3cf6068f9e4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Direct Volume Access: Opens a physical disk for reading
    • Suspicious use of WriteProcessMemory
    PID:2724
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\5e6d48b1.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:3180
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn Updatedc5772 /tr C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdf568ca3cb096e6914fd3cf6068f9e4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2584
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\7043572e.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:3204
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command " $s = New-Object -comObject WScript.Shell $l = $s.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System66be0.lnk\") $l.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdf568ca3cb096e6914fd3cf6068f9e4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\" $l.Save() "
      2⤵
      • Creates a file in the Startup directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3860
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\1bf6e097.exe
      2⤵
      • Views/modifies file attributes
      PID:1636
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\d4151b40.exe
      2⤵
      • Views/modifies file attributes
      PID:3972
  • C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdf568ca3cb096e6914fd3cf6068f9e4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdf568ca3cb096e6914fd3cf6068f9e4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Direct Volume Access: Opens a physical disk for reading
    • Suspicious use of WriteProcessMemory
    PID:2436
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn Updated3b5cc /tr C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdf568ca3cb096e6914fd3cf6068f9e4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:5868
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\578903b0.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:3280
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\0d2a6c62.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:4292
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command " $s = New-Object -comObject WScript.Shell $l = $s.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System4dcd4.lnk\") $l.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdf568ca3cb096e6914fd3cf6068f9e4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\" $l.Save() "
      2⤵
      • Creates a file in the Startup directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4236
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\28849106.exe
      2⤵
      • Views/modifies file attributes
      PID:1092
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\2093de15.exe
      2⤵
      • Views/modifies file attributes
      PID:1028
  • C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdf568ca3cb096e6914fd3cf6068f9e4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdf568ca3cb096e6914fd3cf6068f9e4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Direct Volume Access: Opens a physical disk for reading
    • Suspicious use of WriteProcessMemory
    PID:2508
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn Update494b60 /tr C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdf568ca3cb096e6914fd3cf6068f9e4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4868
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\572677d6.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:4800
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command " $s = New-Object -comObject WScript.Shell $l = $s.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System20b4c.lnk\") $l.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdf568ca3cb096e6914fd3cf6068f9e4_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\" $l.Save() "
      2⤵
      • Creates a file in the Startup directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1840
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\d3ecf623.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:1748
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\9dee0937.exe
      2⤵
      • Views/modifies file attributes
      PID:3676
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\f6d3a3c0.exe
      2⤵
      • Views/modifies file attributes
      PID:3012

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 c56eeb9b90dc0626e9f948dd63def569540538a75908f5843bd2a47ca0407c7d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 451c6eeafd9ab4ebdc785768dda0b8bcfd59ded542d3a4e2380e0daaecf5927d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        2093de15.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2093de15.exe
        • Size 2.5MB
        • SHA256 f955a67165f5d4f5c7a9b8d740d1b3a0eff131e591812433e5777cd43ed098ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_xc05dff0.no0.psm1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xc05dff0.no0.psm1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        d4151b40.exe
        • Path C:\Users\Admin\AppData\Local\Temp\d4151b40.exe
        • Size 2.5MB
        • SHA256 7c8107679a38de57b364e8ee7ff3986ea89c9f0f795c5d3b52c86aba2e259b20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        da3e7ba6.exe
        • Path C:\Users\Admin\AppData\Local\Temp\da3e7ba6.exe
        • Size 2.5MB
        • SHA256 57796adea23750ef12b19dceeebe0e207d6cdc464678498d409130aa35ddac54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        f6d3a3c0.exe
        • Path C:\Users\Admin\AppData\Local\Temp\f6d3a3c0.exe
        • Size 2.5MB
        • SHA256 f5cdcc956614d644756c9c7e64dfbe15e7d342f3e3b0bdfb1ccca701d81a54c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        1bf6e097.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\1bf6e097.exe
        • Size 2.5MB
        • SHA256 079ba443bd1835af5e5d1c2657202f5ae5464b70260c8533cc26d6f526fdd66b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        28849106.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\28849106.exe
        • Size 2.5MB
        • SHA256 85149b8e392e4a693cb7e8317a37202f6d3f73b3712dc136e1077ea4c8176644
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        864c0503.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\864c0503.exe
        • Size 2.5MB
        • SHA256 aafa61b7d296cee5cb048c973f159bd2d3a7828e9932fb9158dece79f9ed88a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        9dee0937.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\9dee0937.exe
        • Size 2.5MB
        • SHA256 dc7c2b5663c39f7012f33183ca572f9d4a49752df3d7352edfde37237d77f009
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        0d2a6c62.exe
        • Path C:\Windows\SysWOW64\0d2a6c62.exe
        • Size 2.5MB
        • SHA256 e303585a43580b62388a6b8e659eb74930b133377c278ecfef790deb53ead449
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7043572e.exe
        • Path C:\Windows\SysWOW64\7043572e.exe
        • Size 2.5MB
        • SHA256 756cc82b55c22f1379fe7af881044993d16200a4962bf7be42d9c51fa28d7128
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7f1eea43.exe
        • Path C:\Windows\SysWOW64\7f1eea43.exe
        • Size 2.5MB
        • SHA256 2b076e6381be8458e0436a95adbb01efff10bc858158f61d046672bee5d55f7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        d3ecf623.exe
        • Path C:\Windows\SysWOW64\d3ecf623.exe
        • Size 2.5MB
        • SHA256 5e5a55f99d194d2936b9cd690c7093102445af6bdb2cf9e7c12d9a6d036cd3b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        572677d6.exe
        • Path C:\Windows\System32\572677d6.exe
        • Size 2.5MB
        • SHA256 fb3d9fcc3944746a7383eabb8d6fce9270a1a16220de0fc6a247ccc0030b3492
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        578903b0.exe
        • Path C:\Windows\System32\578903b0.exe
        • Size 2.5MB
        • SHA256 9487df40078f1c18310a5851c578fca82f3454e8047f5bc3ab76d87e4dee8631
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        5e6d48b1.exe
        • Path C:\Windows\System32\5e6d48b1.exe
        • Size 2.5MB
        • SHA256 96967a41ec0766aa01fb05a86ecefaec53280a73ccdf0d5dfe6c55d9a38446b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        6f067e82.exe
        • Path C:\Windows\System32\6f067e82.exe
        • Size 2.5MB
        • SHA256 cb94b62e885d23d2e109991b0c9e78859808d8c7d1dd36e14ad7e794912b0aa4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5816-13-0x00007FFA3E890000-0x00007FFA3F234000-memory.dmp
        Download

        memory/5816-27-0x00007FFA3E890000-0x00007FFA3F234000-memory.dmp
        Download

        memory/5816-26-0x00007FFA3E890000-0x00007FFA3F234000-memory.dmp
        Download

        memory/5816-22-0x00007FFA3E890000-0x00007FFA3F234000-memory.dmp
        Download

        memory/5816-19-0x00007FFA3E890000-0x00007FFA3F234000-memory.dmp
        Download

        memory/5816-18-0x00007FFA3E890000-0x00007FFA3F234000-memory.dmp
        Download

        memory/5816-17-0x00007FFA3E890000-0x00007FFA3F234000-memory.dmp
        Download

        memory/5816-16-0x00007FFA3E890000-0x00007FFA3F234000-memory.dmp
        Download

        memory/5816-15-0x00007FFA3E890000-0x00007FFA3F234000-memory.dmp
        Download

        memory/5816-11-0x00007FFA3E890000-0x00007FFA3F234000-memory.dmp
        Download

        memory/5816-9-0x000001E0625A0000-0x000001E0625C2000-memory.dmp
        Download

        memory/5816-6-0x00007FFA3E890000-0x00007FFA3F234000-memory.dmp
        Download

        memory/5816-4-0x00007FFA3EA1F000-0x00007FFA3EA20000-memory.dmp
        Download