Analysis
- max time kernel
150s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 21:30
General
- Target 2026-06-04_1fcc89b18189f0550e22462ef37a32db_coinminer_elex_emotet_glassworm_icedid_poet-rat_remcos_wannacry.exe
- Size 14.4MB
- Sample260604-1cn5bsfy21
- SHA256 e5fa19356fe4499e09b571158eac661cdf101739f9493870e11bdd49645e12d2
Malware Config
Signatures
- Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
- Family: PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect PurpleFox Rootkit 10 IoCs
Detect PurpleFox Rootkit.
- Detect SalatStealer payload 1 IoCs
- Gh0st RAT payload 11 IoCs
- Custom signatureDetect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
- Custom signatureDetects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
- Custom signatureDetects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
- Custom signatureUPX dump on OEP (original entry point) 12 IoCs
- Drops file in Drivers directory 1 IoCs
- Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Executes dropped EXE 17 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 10 IoCs
- Drops file in System32 directory 4 IoCs
- UPX packed file 12 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 18 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_1fcc89b18189f0550e22462ef37a32db_coinminer_elex_emotet_glassworm_icedid_poet-rat_remcos_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_1fcc89b18189f0550e22462ef37a32db_coinminer_elex_emotet_glassworm_icedid_poet-rat_remcos_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HD_2026-06-04_1fcc89b18189f0550e22462ef37a32db_coinminer_elex_emotet_glassworm_icedid_poet-rat_remcos_wannacry.exeC:\Users\Admin\AppData\Local\Temp\HD_2026-06-04_1fcc89b18189f0550e22462ef37a32db_coinminer_elex_emotet_glassworm_icedid_poet-rat_remcos_wannacry.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\spoolsv.exeC:\Users\Admin\AppData\Local\Microsoft\spoolsv.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k "Remote Data"1⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Comms\WUDFHost.exeC:\Users\Admin\AppData\Local\Comms\WUDFHost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\PeerDistRepub\winlogon.exeC:\Users\Admin\AppData\Local\PeerDistRepub\winlogon.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Google\RuntimeBroker.exeC:\Users\Admin\AppData\Local\Google\RuntimeBroker.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Windows Photo Viewer\sihost.exe"C:\Program Files (x86)\Windows Photo Viewer\sihost.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Mozilla Maintenance Service\csrss.exe"C:\Program Files (x86)\Mozilla Maintenance Service\csrss.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Windows Sidebar\OfficeClickToRun.exe"C:\Program Files (x86)\Windows Sidebar\OfficeClickToRun.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Windows NT\wininit.exe"C:\Program Files (x86)\Windows NT\wininit.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\wininit.exe"C:\Program Files\Google\Chrome\Application\wininit.exe" -2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\wininit.exe"C:\Program Files (x86)\Microsoft\Edge\Application\wininit.exe" -2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft.NET\fontdrvhost.exe"C:\Program Files (x86)\Microsoft.NET\fontdrvhost.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Adobe\SppExtComObj.ExeC:\Users\Admin\AppData\Local\Adobe\SppExtComObj.Exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
HD_2026-06-04_1fcc89b18189f0550e22462ef37a32db_coinminer_elex_emotet_glassworm_icedid_poet-rat_remcos_wannacry.exe
HD_X.dat
N.exe
R.exe
240659859.txt
memory/1176-38-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/1176-42-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/1176-32-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/1804-25-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/1804-31-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/1804-24-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/1804-22-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/1804-23-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/2472-14-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/2472-18-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/2472-15-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/2472-12-0x0000000010000000-0x00000000101B6000-memory.dmp