Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/06/2026, 21:30
General
- Target 2026-06-04_1fcc89b18189f0550e22462ef37a32db_coinminer_elex_emotet_glassworm_icedid_poet-rat_remcos_wannacry.exe
- Size 14.4MB
- Sample260604-1cn5bsfy21
- SHA256 e5fa19356fe4499e09b571158eac661cdf101739f9493870e11bdd49645e12d2
Malware Config
Signatures
- Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
- Family: PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect PurpleFox Rootkit 8 IoCs
Detect PurpleFox Rootkit.
- Detect SalatStealer payload 1 IoCs
- Gh0st RAT payload 9 IoCs
- Custom signatureDetect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
- Custom signatureDetects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
- Custom signatureDetects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
- Custom signatureUPX dump on OEP (original entry point) 10 IoCs
- Drops file in Drivers directory 1 IoCs
- Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Executes dropped EXE 18 IoCs
- Loads dropped DLL 3 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 10 IoCs
- Drops file in System32 directory 6 IoCs
- UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 23 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_1fcc89b18189f0550e22462ef37a32db_coinminer_elex_emotet_glassworm_icedid_poet-rat_remcos_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_1fcc89b18189f0550e22462ef37a32db_coinminer_elex_emotet_glassworm_icedid_poet-rat_remcos_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HD_2026-06-04_1fcc89b18189f0550e22462ef37a32db_coinminer_elex_emotet_glassworm_icedid_poet-rat_remcos_wannacry.exeC:\Users\Admin\AppData\Local\Temp\HD_2026-06-04_1fcc89b18189f0550e22462ef37a32db_coinminer_elex_emotet_glassworm_icedid_poet-rat_remcos_wannacry.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Mozilla Maintenance Service\TextInputHost.exe"C:\Program Files (x86)\Mozilla Maintenance Service\TextInputHost.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Remote Data.exe"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240662734.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k "Remote Data"1⤵
-
C:\Program Files (x86)\Windows NT\svchost.exe"C:\Program Files (x86)\Windows NT\svchost.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Windows Multimedia Platform\spoolsv.exe"C:\Program Files (x86)\Windows Multimedia Platform\spoolsv.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\WindowsPowerShell\WUDFHost.exe"C:\Program Files (x86)\WindowsPowerShell\WUDFHost.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\PeerDistRepub\services.exeC:\Users\Admin\AppData\Local\PeerDistRepub\services.exe1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\services.exe"C:\Program Files\Google\Chrome\Application\services.exe" -2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\services.exe"C:\Program Files (x86)\Microsoft\Edge\Application\services.exe" -2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Windows Defender\StartMenuExperienceHost.exe"C:\Program Files (x86)\Windows Defender\StartMenuExperienceHost.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\MSBuild\RuntimeBroker.exe"C:\Program Files (x86)\MSBuild\RuntimeBroker.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Comms\TXPlatfor.exeC:\Users\Admin\AppData\Local\Comms\TXPlatfor.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Common Files\fontdrvhost.exe"C:\Program Files (x86)\Common Files\fontdrvhost.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Publishers\sppsvc.exeC:\Users\Admin\AppData\Local\Publishers\sppsvc.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
HD_2026-06-04_1fcc89b18189f0550e22462ef37a32db_coinminer_elex_emotet_glassworm_icedid_poet-rat_remcos_wannacry.exe
HD_X.dat
N.exe
R.exe
240662734.txt
Remote Data.exe
memory/1440-29-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/1440-28-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/1440-26-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/1820-40-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/1820-39-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/1820-35-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/3244-17-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/3244-23-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/3244-20-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/3244-19-0x0000000010000000-0x00000000101B6000-memory.dmp