Overview

overview

7

Static

static

3

2026-11-03...er.exe

windows10-2004-x64

7

2026-11-03...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/11/2026, 18:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-03_6893cec36d72a47a2e77bad316f9c137_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
  • Size 2.5MB
  • Sample261104-wstyasttdx
  • SHA256 19d2473be50d41d4879bd3e85a1454cfffd32a914951291e481efa8f818467d8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasionexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 8 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 2 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 8 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-03_6893cec36d72a47a2e77bad316f9c137_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-03_6893cec36d72a47a2e77bad316f9c137_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Direct Volume Access: Opens a physical disk for reading
    • Suspicious use of WriteProcessMemory
    PID:4256
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\c9797443.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:1724
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateb28c78 /tr C:\Users\Admin\AppData\Local\Temp\2026-11-03_6893cec36d72a47a2e77bad316f9c137_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4284
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\995456c7.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:4964
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command " $WshShell = New-Object -comObject WScript.Shell $Shortcut = $WshShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systemcef19.lnk\") $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-11-03_6893cec36d72a47a2e77bad316f9c137_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\" $Shortcut.Save() "
      2⤵
      • Creates a file in the Startup directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5072
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\15983ba9.exe
      2⤵
      • Views/modifies file attributes
      PID:4488
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\264aaa93.exe
      2⤵
      • Views/modifies file attributes
      PID:2416
  • C:\Users\Admin\AppData\Local\Temp\2026-11-03_6893cec36d72a47a2e77bad316f9c137_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    C:\Users\Admin\AppData\Local\Temp\2026-11-03_6893cec36d72a47a2e77bad316f9c137_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Direct Volume Access: Opens a physical disk for reading
    • Suspicious use of WriteProcessMemory
    PID:1652
    • C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdate0096ad /tr C:\Users\Admin\AppData\Local\Temp\2026-11-03_6893cec36d72a47a2e77bad316f9c137_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe /sc hourly /st 00:00 /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4484
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\46c3d535.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:4896
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\SysWOW64\73ba0709.exe
      2⤵
      • Drops file in System32 directory
      • Views/modifies file attributes
      PID:764
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command " $WshShell = New-Object -comObject WScript.Shell $Shortcut = $WshShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systemabe6f.lnk\") $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-11-03_6893cec36d72a47a2e77bad316f9c137_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe\" $Shortcut.Save() "
      2⤵
      • Creates a file in the Startup directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4860
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\5c0d817d.exe
      2⤵
      • Views/modifies file attributes
      PID:212
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\1eb81589.exe
      2⤵
      • Views/modifies file attributes
      PID:3220

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        powershell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        • Size 2KB
        • SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 652c8cde0becaaab074c1546265be70413d1887915084d6636291460883aec53
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        1eb81589.exe
        • Path C:\Users\Admin\AppData\Local\Temp\1eb81589.exe
        • Size 2.5MB
        • SHA256 724ec2a7e35b21eb6cf9e290609c071e2dbdd04b64907032b46bf8caa3239b06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        264aaa93.exe
        • Path C:\Users\Admin\AppData\Local\Temp\264aaa93.exe
        • Size 2.5MB
        • SHA256 eb58bee750d7d402970dc3af5734eaddca8c3df146b42b2214a39e28422f81da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_2plim43a.p3c.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2plim43a.p3c.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        15983ba9.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\15983ba9.exe
        • Size 2.5MB
        • SHA256 42794492e7daac1b21683a9dfc566587bd267fbf324682d3a25d97041be8de99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        5c0d817d.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\5c0d817d.exe
        • Size 2.5MB
        • SHA256 b6187453b94928595223df637698e77c5ebe49e7dacef202d3726949fdcd5128
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        73ba0709.exe
        • Path C:\Windows\SysWOW64\73ba0709.exe
        • Size 2.5MB
        • SHA256 6f4e4554d96c687af2990c52e1e3cef06763d8c6a77292a2ce4e84631abee4cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        995456c7.exe
        • Path C:\Windows\SysWOW64\995456c7.exe
        • Size 2.5MB
        • SHA256 1db8eb10fe6adc87a752f676125b52ff11070fbea0ce1d65e5f66b9161c24d79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        46c3d535.exe
        • Path C:\Windows\System32\46c3d535.exe
        • Size 2.5MB
        • SHA256 2110ddfce9735e6c3a8ded8d13300ab1856b4e743a18f85d1b55a4df14603fd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        c9797443.exe
        • Path C:\Windows\System32\c9797443.exe
        • Size 2.5MB
        • SHA256 6ba7fa106dbbce3022d131d270984a7394ef1340a996f57fbe06e0e621658719
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5072-16-0x000001DCE8450000-0x000001DCE8472000-memory.dmp
        Download

        memory/5072-5-0x000001DCCDC80000-0x000001DCCDC90000-memory.dmp
        Download

        memory/5072-6-0x000001DCCDC80000-0x000001DCCDC90000-memory.dmp
        Download