0a6b8565210720625db6d5784d30d35fd6b8325a6d54990c92300c798c8bc878

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 23:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_36f5619d0905ef03e5dd1dee1045abf5_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 9.1MB
Sample261104-3ty2zagv8q
SHA256 0a6b8565210720625db6d5784d30d35fd6b8325a6d54990c92300c798c8bc878
MD5 36f5619d0905ef03e5dd1dee1045abf5
SHA1 0a82c4e467ca0c4b8297555b6e6abd0e93d8a8c9
SHA512 19466c8dd20d60737ff7e57bb69170bc96fc55992374c4880686bf26c6d26f9acbd4c9ce93aa8e77b2a1d74a558b0590de8f8d318dca44362546da9b02b27c38
SSDEEP 98304:qA16zc1+54ebfXpnNuJDCqoHs28kEEteEO:qY6yuXpnU1CodElO
TLSH
T160A638C7F8A154E5C0AAD33489669252BB717C481B3227D32B90FF682F36BD06E79714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2040	cmd.exe
5836	cmd.exe
4868	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-03_36f5619d0905ef03e5dd1dee1045abf5_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-03_36f5619d0905ef03e5dd1dee1045abf5_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 4868	2016	2026-11-03_36f5619d0905ef03e5dd1dee1045abf5_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	89
PID 2016 wrote to memory of 2040	2016	2026-11-03_36f5619d0905ef03e5dd1dee1045abf5_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	90
PID 2016 wrote to memory of 5836	2016	2026-11-03_36f5619d0905ef03e5dd1dee1045abf5_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-11-03_36f5619d0905ef03e5dd1dee1045abf5_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_36f5619d0905ef03e5dd1dee1045abf5_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\system32\cmd.exe
  cmd /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4868
- C:\Windows\system32\cmd.exe
  cmd /c cls
  2⤵
  - Executes a command shell one-liner
  PID:2040
- C:\Windows\system32\cmd.exe
  cmd /c "pause >nul"
  2⤵
  - Executes a command shell one-liner
  PID:5836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads