5b4334b4a2331d1ec625925c80ba9f576d6133ab18ca61a8de7fc97c4766304f

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 15:01

Target
2026-10-26_6cf26fdab8b26af4ea0ff03cb362be9d_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
Size 11.3MB
Sample261027-sd48yadg96
SHA256 5b4334b4a2331d1ec625925c80ba9f576d6133ab18ca61a8de7fc97c4766304f
MD5 6cf26fdab8b26af4ea0ff03cb362be9d
SHA1 a03c9227b75af8d9512b0afcd9a2f5c23ee347c3
SHA512 5cdb5828deca23395a30e39c12a76a42c9238d189f9ee555441842e031fb7dd6a916a2ebb8d5b5807a2b87de9bdc7a728e4c040a71209472dc48f0d2e52a9772
SSDEEP 98304:rSLtpaJeQuzAiYOQf1BjMYmDHU8QZPUypKzAtwhELEf:rS7asz7YOQfoH038yIRNf
TLSH
T1F6C64A43E8A541E4C0AAD175CA669613BB717C884F3063D77B90FB292F76BD0AE79700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 1596	3892	2026-10-26_6cf26fdab8b26af4ea0ff03cb362be9d_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	92
PID 3892 wrote to memory of 1944	3892	2026-10-26_6cf26fdab8b26af4ea0ff03cb362be9d_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-10-26_6cf26fdab8b26af4ea0ff03cb362be9d_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_6cf26fdab8b26af4ea0ff03cb362be9d_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Users\Admin\AppData\Local\Temp\2026-10-26_6cf26fdab8b26af4ea0ff03cb362be9d_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
  C:\Users\Admin\AppData\Local\Temp\2026-10-26_6cf26fdab8b26af4ea0ff03cb362be9d_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe -test.run=^TestControllerProcessFixture$ -test.timeout=30s
  2⤵
  PID:1596
- C:\Users\Admin\AppData\Local\Temp\2026-10-26_6cf26fdab8b26af4ea0ff03cb362be9d_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
  C:\Users\Admin\AppData\Local\Temp\2026-10-26_6cf26fdab8b26af4ea0ff03cb362be9d_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe -test.run=^TestControllerProcessFixture$ -test.timeout=30s
  2⤵
  PID:1944

controller.db

Path C:\Users\Admin\AppData\Local\Temp\TestMVPControllerRestartAndInterruptedExecution1760727653\001\controller.db
Size 4KB
SHA256 da63a52bdf62b3fc863995d79f497584be3ba97c1de4c55d1d301afbafab6cfc
MD5 92ca0d14cd0b699cab9d9551be951fa8
SHA1 d83570f11fb5e5f323b7d8d0d0bbd8299b893d23
SHA512 f839af7a748c2b9f56113c71f2d90932583bc6c12154bfea05bb55132241906a8f32e4e97c3b2f3ee32614dae78c47f19865a444c28bc1076847c85731525fb8
TLSH
T170810450534000F1D05407F354D1131C1F07F1D4DF510F0315010441CC41544CC70FCC
MD5 SHA1 SHA512 TLSH

Submit Download

controller.db-wal

Path C:\Users\Admin\AppData\Local\Temp\TestMVPControllerRestartAndInterruptedExecution1760727653\001\controller.db-wal
Size 442KB
SHA256 74a6747ad9474011be1ddc0ae08ec1aed31267f31aed4a75d3040762201d7a65
MD5 f0147bc54bb62b0cfaf0b6a3d86b00d5
SHA1 642ebf6c3a0c7e1bf3147083ef6e9862908b91a6
SHA512 ff7571a911047989e53701815d85d3468fb453b404ef81dc85ee33de7eea979e76eda8d7da4ac570ccd09a607e75141a705f1507df65667ac5a3f49e4b24475b
SSDEEP 768:l/+4/+r7zJSwNSw2SwrSw5w9SwiSwSSwqSwHSw9SwZSwpSwm:l1A1l
TLSH
T154A474CF132A3C81C4DD03B7C5769BE389BD465E84220ADCBA717DD1A84543BA9BD079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download