Analysis
- max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/11/2026, 19:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe
- Size 11.3MB
- Sample261107-ylm8aaga62
- SHA256 77be022536ac350bbb10d779db7ba9de07f528e3ea275c0b1c46d5b86d8d809c
- MD5 ea2bd9b822323ab2103fd9f77a74d280
- SHA1 9e508c8c93da4f089115789bc87e58a3d0da5b1c
- SHA512 3af4e0fcdd02ed584ed22aa92b19fe4f17585b7397b0b43e44341bcd188faa9415a49ec10994fdef4312ec4ae0c18743f1b50f44cee6706bd23258c1dfe86f63
- SSDEEP 98304:GAuzUCGT9FOo3k2VxNyiHCSUtD/AWQnw6M+cTEUjmIphlaRwGp7U18dhwpDP:8I9bk2Vb/Utbl6fcAWzph+U18dhy
- TLSH T14AC67B43FD5161E8C6EDC230CA76C25ABAB178C4433067D32B519AB62B63BC45A7937C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
- Detects DarkSideRAT 1 IoCs
resource yara_rule behavioral2/memory/2280-1-0x0000000140000000-0x0000000140015000-memory.dmp family_darksiderat - Suspicious use of SetThreadContext 12 IoCs
description pid Process procid_target PID 4192 set thread context of 2280 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 90 PID 4192 set thread context of 1956 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 91 PID 4192 set thread context of 4688 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 92 PID 4192 set thread context of 3136 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 93 PID 4192 set thread context of 4740 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 94 PID 4192 set thread context of 952 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 95 PID 4192 set thread context of 2096 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 96 PID 4192 set thread context of 6016 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 97 PID 4192 set thread context of 3392 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 98 PID 4192 set thread context of 2188 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 99 PID 4192 set thread context of 4268 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 100 PID 4192 set thread context of 3168 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 101 - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe - Modifies system certificate store 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 6b0000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c000000010000000400000000080000190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab6b0000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4192 wrote to memory of 2280 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 90 PID 4192 wrote to memory of 2280 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 90 PID 4192 wrote to memory of 2280 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 90 PID 4192 wrote to memory of 2280 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 90 PID 4192 wrote to memory of 2280 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 90 PID 4192 wrote to memory of 2280 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 90 PID 4192 wrote to memory of 2280 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 90 PID 4192 wrote to memory of 1956 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 91 PID 4192 wrote to memory of 1956 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 91 PID 4192 wrote to memory of 1956 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 91 PID 4192 wrote to memory of 1956 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 91 PID 4192 wrote to memory of 1956 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 91 PID 4192 wrote to memory of 1956 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 91 PID 4192 wrote to memory of 1956 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 91 PID 4192 wrote to memory of 4688 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 92 PID 4192 wrote to memory of 4688 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 92 PID 4192 wrote to memory of 4688 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 92 PID 4192 wrote to memory of 4688 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 92 PID 4192 wrote to memory of 4688 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 92 PID 4192 wrote to memory of 4688 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 92 PID 4192 wrote to memory of 4688 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 92 PID 4192 wrote to memory of 3136 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 93 PID 4192 wrote to memory of 3136 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 93 PID 4192 wrote to memory of 3136 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 93 PID 4192 wrote to memory of 3136 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 93 PID 4192 wrote to memory of 3136 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 93 PID 4192 wrote to memory of 3136 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 93 PID 4192 wrote to memory of 3136 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 93 PID 4192 wrote to memory of 4740 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 94 PID 4192 wrote to memory of 4740 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 94 PID 4192 wrote to memory of 4740 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 94 PID 4192 wrote to memory of 4740 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 94 PID 4192 wrote to memory of 4740 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 94 PID 4192 wrote to memory of 4740 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 94 PID 4192 wrote to memory of 4740 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 94 PID 4192 wrote to memory of 952 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 95 PID 4192 wrote to memory of 952 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 95 PID 4192 wrote to memory of 952 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 95 PID 4192 wrote to memory of 952 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 95 PID 4192 wrote to memory of 952 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 95 PID 4192 wrote to memory of 952 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 95 PID 4192 wrote to memory of 952 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 95 PID 4192 wrote to memory of 2096 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 96 PID 4192 wrote to memory of 2096 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 96 PID 4192 wrote to memory of 2096 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 96 PID 4192 wrote to memory of 2096 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 96 PID 4192 wrote to memory of 2096 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 96 PID 4192 wrote to memory of 2096 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 96 PID 4192 wrote to memory of 2096 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 96 PID 4192 wrote to memory of 6016 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 97 PID 4192 wrote to memory of 6016 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 97 PID 4192 wrote to memory of 6016 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 97 PID 4192 wrote to memory of 6016 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 97 PID 4192 wrote to memory of 6016 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 97 PID 4192 wrote to memory of 6016 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 97 PID 4192 wrote to memory of 6016 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 97 PID 4192 wrote to memory of 3392 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 98 PID 4192 wrote to memory of 3392 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 98 PID 4192 wrote to memory of 3392 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 98 PID 4192 wrote to memory of 3392 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 98 PID 4192 wrote to memory of 3392 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 98 PID 4192 wrote to memory of 3392 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 98 PID 4192 wrote to memory of 3392 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 98 PID 4192 wrote to memory of 2188 4192 2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"1⤵
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"2⤵PID:2280
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"2⤵PID:1956
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"2⤵PID:4688
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"2⤵PID:3136
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"2⤵PID:4740
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"2⤵PID:952
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"2⤵PID:2096
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"2⤵PID:6016
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"2⤵PID:3392
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"2⤵PID:2188
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"2⤵PID:4268
-
-
C:\Users\Admin\AppData\Local\Temp\2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-06_ea2bd9b822323ab2103fd9f77a74d280_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"2⤵PID:3168
-