fb2db819ed017d7b58edcc0fd3a6d32868d1a758b3434571ddadb0ea1d2ef6cc

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 23:30

Target
2026-10-27_e950937430bc8dff74425f8ff37e1d12_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe
Size 4.7MB
Sample261027-3hgnjsef97
SHA256 fb2db819ed017d7b58edcc0fd3a6d32868d1a758b3434571ddadb0ea1d2ef6cc
MD5 e950937430bc8dff74425f8ff37e1d12
SHA1 d7af217b8a75ab2e302a7e096c8e51dbb6da1134
SHA512 fb310d2526c8e3e81dfe4c349eea133a252b6f16310aa369fdeb1ec4b9489c22081cc2a2f823c5a9e9cb90f322f39bd15179616954cd85a72e9162049acaf531
SSDEEP 49152:h7ru6Hj+3ukiO+rb/TivO90d7HjmAFd4A64nsfJqO+HapFSDIqWhcZfI8AhjCr5+:G3uT+HaFSE+
TLSH
T191363847F89155A8C1EED23086669253BA717C890B3027D36BA0F7B83F72BD49E79314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3916	2026-10-27_e950937430bc8dff74425f8ff37e1d12_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-27_e950937430bc8dff74425f8ff37e1d12_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-27_e950937430bc8dff74425f8ff37e1d12_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3916