Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
30/05/2026, 00:38
General
- Target 2026-05-30_9534e19bc3c3b2b5cfadc0748d58bfe8_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
- Size 15.2MB
- Sample260530-ay7wfset9p
- SHA256 d8a20bbcf001b764131a2c0002c262c1f2822a32dae645d4f2b3050d0a4d9f66
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-30_9534e19bc3c3b2b5cfadc0748d58bfe8_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-30_9534e19bc3c3b2b5cfadc0748d58bfe8_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\svchost_task.exeC:\Users\Admin\AppData\Roaming\svchost_task.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_34225vbm.1nh.ps1
svchost_task.exe
memory/2056-65-0x0000000007C90000-0x0000000007CA5000-memory.dmp
memory/2056-64-0x0000000007C50000-0x0000000007C61000-memory.dmp
memory/2056-63-0x00000000078F0000-0x0000000007994000-memory.dmp
memory/2056-56-0x0000000070760000-0x00000000707AC000-memory.dmp
memory/2056-55-0x0000000006740000-0x000000000678C000-memory.dmp
memory/2056-53-0x0000000006180000-0x00000000064D7000-memory.dmp
memory/3376-14-0x0000000006900000-0x000000000691E000-memory.dmp
memory/3376-34-0x0000000007F20000-0x0000000007F2E000-memory.dmp
memory/3376-17-0x00000000078D0000-0x0000000007904000-memory.dmp
memory/3376-25-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/3376-26-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/3376-18-0x0000000070B50000-0x0000000070B9C000-memory.dmp
memory/3376-27-0x0000000006EF0000-0x0000000006F0E000-memory.dmp
memory/3376-28-0x0000000007990000-0x0000000007A34000-memory.dmp
memory/3376-29-0x0000000008310000-0x000000000898A000-memory.dmp
memory/3376-30-0x0000000007CD0000-0x0000000007CEA000-memory.dmp
memory/3376-31-0x0000000007D40000-0x0000000007D4A000-memory.dmp
memory/3376-32-0x0000000007F70000-0x0000000008006000-memory.dmp
memory/3376-33-0x0000000007EE0000-0x0000000007EF1000-memory.dmp
memory/3376-16-0x000000007F360000-0x000000007F370000-memory.dmp
memory/3376-35-0x0000000007F30000-0x0000000007F45000-memory.dmp
memory/3376-36-0x0000000008030000-0x000000000804A000-memory.dmp
memory/3376-37-0x0000000008010000-0x0000000008018000-memory.dmp
memory/3376-15-0x0000000006990000-0x00000000069DC000-memory.dmp
memory/3376-0-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/3376-13-0x0000000006400000-0x0000000006757000-memory.dmp
memory/3376-6-0x0000000005C70000-0x0000000005CD6000-memory.dmp
memory/3376-5-0x0000000005C00000-0x0000000005C66000-memory.dmp
memory/3376-4-0x0000000005B60000-0x0000000005B82000-memory.dmp
memory/3376-3-0x0000000005D50000-0x000000000637A000-memory.dmp
memory/3376-2-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/3376-1-0x0000000003110000-0x0000000003146000-memory.dmp