Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
01/06/2026, 13:04
General
- Target 2026-06-01_fc045af3f8e3b04b72ad866c1fb87af3_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
- Size 15.2MB
- Sample260601-qa3vlaez3m
- SHA256 3612e801f0279b621dfa94aadcf07d72efae9a4a4781963696226b28b24c77ab
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies system certificate store 2 TTPs 5 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-01_fc045af3f8e3b04b72ad866c1fb87af3_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-01_fc045af3f8e3b04b72ad866c1fb87af3_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\svchost_task.exeC:\Users\Admin\AppData\Roaming\svchost_task.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_1rbjespf.wcf.ps1
svchost_task.exe
memory/4100-14-0x0000000006460000-0x000000000647E000-memory.dmp
memory/4100-32-0x0000000007AE0000-0x0000000007B76000-memory.dmp
memory/4100-6-0x0000000005ED0000-0x0000000005F36000-memory.dmp
memory/4100-4-0x00000000055D0000-0x00000000055F2000-memory.dmp
memory/4100-13-0x0000000005F80000-0x00000000062D7000-memory.dmp
memory/4100-0-0x00000000030E0000-0x00000000030F0000-memory.dmp
memory/4100-15-0x00000000064A0000-0x00000000064EC000-memory.dmp
memory/4100-16-0x000000007FE20000-0x000000007FE30000-memory.dmp
memory/4100-17-0x0000000007640000-0x0000000007674000-memory.dmp
memory/4100-18-0x0000000071300000-0x000000007134C000-memory.dmp
memory/4100-26-0x00000000030E0000-0x00000000030F0000-memory.dmp
memory/4100-27-0x0000000006A60000-0x0000000006A7E000-memory.dmp
memory/4100-25-0x00000000030E0000-0x00000000030F0000-memory.dmp
memory/4100-28-0x0000000007700000-0x00000000077A4000-memory.dmp
memory/4100-29-0x0000000007E80000-0x00000000084FA000-memory.dmp
memory/4100-30-0x0000000007840000-0x000000000785A000-memory.dmp
memory/4100-31-0x00000000078B0000-0x00000000078BA000-memory.dmp
memory/4100-5-0x0000000005780000-0x00000000057E6000-memory.dmp
memory/4100-33-0x0000000007A50000-0x0000000007A61000-memory.dmp
memory/4100-34-0x0000000007A90000-0x0000000007A9E000-memory.dmp
memory/4100-35-0x0000000007AA0000-0x0000000007AB5000-memory.dmp
memory/4100-36-0x0000000007BA0000-0x0000000007BBA000-memory.dmp
memory/4100-37-0x0000000007B80000-0x0000000007B88000-memory.dmp
memory/4100-3-0x00000000057F0000-0x0000000005E1A000-memory.dmp
memory/4100-1-0x0000000002FE0000-0x0000000003016000-memory.dmp
memory/4100-2-0x00000000030E0000-0x00000000030F0000-memory.dmp
memory/5548-45-0x0000000005270000-0x0000000005280000-memory.dmp
memory/5548-53-0x0000000006190000-0x00000000064E7000-memory.dmp
memory/5548-46-0x0000000005270000-0x0000000005280000-memory.dmp
memory/5548-55-0x0000000006C50000-0x0000000006C9C000-memory.dmp
memory/5548-63-0x00000000078F0000-0x0000000007994000-memory.dmp
memory/5548-56-0x0000000070F40000-0x0000000070F8C000-memory.dmp
memory/5548-64-0x0000000007C50000-0x0000000007C61000-memory.dmp
memory/5548-65-0x0000000007CA0000-0x0000000007CB5000-memory.dmp