Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 00:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-25_6fcf46dd350f3b57d475d046b7d68e78_coinminer_dosia_frostygoop_hive_luca-stealer_poet-rat_qu.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-25_6fcf46dd350f3b57d475d046b7d68e78_coinminer_dosia_frostygoop_hive_luca-stealer_poet-rat_qu.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-10-25_6fcf46dd350f3b57d475d046b7d68e78_coinminer_dosia_frostygoop_hive_luca-stealer_poet-rat_qu.exe
- Size 21.3MB
- Sample261027-aq52wscc79
- SHA256 42283e16645bc2f88ec685a949fbdce36ce3fc17d01ce0b5377dbbc12c3734f2
- MD5 6fcf46dd350f3b57d475d046b7d68e78
- SHA1 07d3ba78ff1959a1b471b7561381fcedd16f6549
- SHA512 b0694758739e392b32d47ddb9f54a8f6a380c0931db8bb8b877bd4805ea56ef8fc11f9252325a77393be83cc55aaefbe6bd8b1e9f017696df33fec21765b0baf
- SSDEEP 196608:C/MRSu1lO2oYAGNjeGaF2FrbI4txZsovhf7LsH3j:C/CXlGG+F2XxZs67LK
- TLSH T17B274AC3F8E61890D4A9D3B585768226EA717C0D0B3A23DF5660BE742F337E15A76B40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1368 RtAudioSvc.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\RtAudioSvc = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\RtAudioSvc.exe" 2026-10-25_6fcf46dd350f3b57d475d046b7d68e78_coinminer_dosia_frostygoop_hive_luca-stealer_poet-rat_qu.exe - Looks up external IP address via web service 1 TTPs 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 1 ip-api.com 6 api.ipify.org 9 api.ipify.org - Queries system WMI classes for hardware identifiers 2 TTPs 2 IoCs
Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.
pid Process 1900 wmic.exe 4284 wmic.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-10-25_6fcf46dd350f3b57d475d046b7d68e78_coinminer_dosia_frostygoop_hive_luca-stealer_poet-rat_qu.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain RtAudioSvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-10-25_6fcf46dd350f3b57d475d046b7d68e78_coinminer_dosia_frostygoop_hive_luca-stealer_poet-rat_qu.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname RtAudioSvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1900 wmic.exe 1900 wmic.exe 1900 wmic.exe 1900 wmic.exe 4284 wmic.exe 4284 wmic.exe 4284 wmic.exe 4284 wmic.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3376 2026-10-25_6fcf46dd350f3b57d475d046b7d68e78_coinminer_dosia_frostygoop_hive_luca-stealer_poet-rat_qu.exe Token: SeIncreaseQuotaPrivilege 1900 wmic.exe Token: SeSecurityPrivilege 1900 wmic.exe Token: SeTakeOwnershipPrivilege 1900 wmic.exe Token: SeLoadDriverPrivilege 1900 wmic.exe Token: SeSystemProfilePrivilege 1900 wmic.exe Token: SeSystemtimePrivilege 1900 wmic.exe Token: SeProfSingleProcessPrivilege 1900 wmic.exe Token: SeIncBasePriorityPrivilege 1900 wmic.exe Token: SeCreatePagefilePrivilege 1900 wmic.exe Token: SeBackupPrivilege 1900 wmic.exe Token: SeRestorePrivilege 1900 wmic.exe Token: SeShutdownPrivilege 1900 wmic.exe Token: SeDebugPrivilege 1900 wmic.exe Token: SeSystemEnvironmentPrivilege 1900 wmic.exe Token: SeRemoteShutdownPrivilege 1900 wmic.exe Token: SeUndockPrivilege 1900 wmic.exe Token: SeManageVolumePrivilege 1900 wmic.exe Token: 33 1900 wmic.exe Token: 34 1900 wmic.exe Token: 35 1900 wmic.exe Token: 36 1900 wmic.exe Token: SeIncreaseQuotaPrivilege 1900 wmic.exe Token: SeSecurityPrivilege 1900 wmic.exe Token: SeTakeOwnershipPrivilege 1900 wmic.exe Token: SeLoadDriverPrivilege 1900 wmic.exe Token: SeSystemProfilePrivilege 1900 wmic.exe Token: SeSystemtimePrivilege 1900 wmic.exe Token: SeProfSingleProcessPrivilege 1900 wmic.exe Token: SeIncBasePriorityPrivilege 1900 wmic.exe Token: SeCreatePagefilePrivilege 1900 wmic.exe Token: SeBackupPrivilege 1900 wmic.exe Token: SeRestorePrivilege 1900 wmic.exe Token: SeShutdownPrivilege 1900 wmic.exe Token: SeDebugPrivilege 1900 wmic.exe Token: SeSystemEnvironmentPrivilege 1900 wmic.exe Token: SeRemoteShutdownPrivilege 1900 wmic.exe Token: SeUndockPrivilege 1900 wmic.exe Token: SeManageVolumePrivilege 1900 wmic.exe Token: 33 1900 wmic.exe Token: 34 1900 wmic.exe Token: 35 1900 wmic.exe Token: 36 1900 wmic.exe Token: SeDebugPrivilege 1368 RtAudioSvc.exe Token: SeIncreaseQuotaPrivilege 4284 wmic.exe Token: SeSecurityPrivilege 4284 wmic.exe Token: SeTakeOwnershipPrivilege 4284 wmic.exe Token: SeLoadDriverPrivilege 4284 wmic.exe Token: SeSystemProfilePrivilege 4284 wmic.exe Token: SeSystemtimePrivilege 4284 wmic.exe Token: SeProfSingleProcessPrivilege 4284 wmic.exe Token: SeIncBasePriorityPrivilege 4284 wmic.exe Token: SeCreatePagefilePrivilege 4284 wmic.exe Token: SeBackupPrivilege 4284 wmic.exe Token: SeRestorePrivilege 4284 wmic.exe Token: SeShutdownPrivilege 4284 wmic.exe Token: SeDebugPrivilege 4284 wmic.exe Token: SeSystemEnvironmentPrivilege 4284 wmic.exe Token: SeRemoteShutdownPrivilege 4284 wmic.exe Token: SeUndockPrivilege 4284 wmic.exe Token: SeManageVolumePrivilege 4284 wmic.exe Token: 33 4284 wmic.exe Token: 34 4284 wmic.exe Token: 35 4284 wmic.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3376 wrote to memory of 5832 3376 2026-10-25_6fcf46dd350f3b57d475d046b7d68e78_coinminer_dosia_frostygoop_hive_luca-stealer_poet-rat_qu.exe 89 PID 3376 wrote to memory of 124 3376 2026-10-25_6fcf46dd350f3b57d475d046b7d68e78_coinminer_dosia_frostygoop_hive_luca-stealer_poet-rat_qu.exe 91 PID 3376 wrote to memory of 1900 3376 2026-10-25_6fcf46dd350f3b57d475d046b7d68e78_coinminer_dosia_frostygoop_hive_luca-stealer_poet-rat_qu.exe 93 PID 1368 wrote to memory of 5968 1368 RtAudioSvc.exe 98 PID 1368 wrote to memory of 4284 1368 RtAudioSvc.exe 100 - Views/modifies file attributes 1 TTPs 3 IoCs
pid Process 124 attrib.exe 5968 attrib.exe 5832 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-25_6fcf46dd350f3b57d475d046b7d68e78_coinminer_dosia_frostygoop_hive_luca-stealer_poet-rat_qu.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-25_6fcf46dd350f3b57d475d046b7d68e78_coinminer_dosia_frostygoop_hive_luca-stealer_poet-rat_qu.exe"1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Temp\2026-10-25_6fcf46dd350f3b57d475d046b7d68e78_coinminer_dosia_frostygoop_hive_luca-stealer_poet-rat_qu.exe2⤵
- Views/modifies file attributes
PID:5832
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\RtAudioSvc.exe2⤵
- Views/modifies file attributes
PID:124
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵
- Queries system WMI classes for hardware identifiers
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1900
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\RtAudioSvc.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\RtAudioSvc.exe1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\RtAudioSvc.exe2⤵
- Views/modifies file attributes
PID:5968
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵
- Queries system WMI classes for hardware identifiers
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4284
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\RtAudioSvc.exe
- Size 21.3MB
- SHA256 42283e16645bc2f88ec685a949fbdce36ce3fc17d01ce0b5377dbbc12c3734f2
- MD5 6fcf46dd350f3b57d475d046b7d68e78
- SHA1 07d3ba78ff1959a1b471b7561381fcedd16f6549
- SHA512 b0694758739e392b32d47ddb9f54a8f6a380c0931db8bb8b877bd4805ea56ef8fc11f9252325a77393be83cc55aaefbe6bd8b1e9f017696df33fec21765b0baf
- SSDEEP 196608:C/MRSu1lO2oYAGNjeGaF2FrbI4txZsovhf7LsH3j:C/CXlGG+F2XxZs67LK
- TLSH T17B274AC3F8E61890D4A9D3B585768226EA717C0D0B3A23DF5660BE742F337E15A76B40
- MD5 SHA1 SHA512 SSDEEP TLSH