Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
05/07/2026, 01:26
General
- Target 2026-07-05_817a1a5f276a6846335b5776a6d3f158_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
- Size 15.3MB
- Sample260705-bt2pbaf15x
- SHA256 a4e2615619a57722ca49192cab81dbb8cd78c250e256f581d774370cf71ebd09
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_817a1a5f276a6846335b5776a6d3f158_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_817a1a5f276a6846335b5776a6d3f158_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\svchost_task.exeC:\Users\Admin\AppData\Roaming\svchost_task.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_ngn1zgk2.ygv.ps1
svchost_task.exe
memory/1056-71-0x00000000078E0000-0x00000000078F4000-memory.dmp
memory/1056-70-0x00000000078A0000-0x00000000078B1000-memory.dmp
memory/1056-69-0x0000000007550000-0x00000000075F3000-memory.dmp
memory/1056-61-0x0000000070630000-0x000000007067C000-memory.dmp
memory/1056-60-0x00000000063C0000-0x000000000640C000-memory.dmp
memory/1056-58-0x0000000005CF0000-0x0000000006044000-memory.dmp
memory/1056-47-0x0000000001250000-0x0000000001260000-memory.dmp
memory/1056-48-0x0000000001250000-0x0000000001260000-memory.dmp
memory/2628-15-0x0000000006260000-0x000000000627E000-memory.dmp
memory/2628-38-0x00000000078E0000-0x00000000078FA000-memory.dmp
memory/2628-29-0x00000000071F0000-0x000000000720E000-memory.dmp
memory/2628-28-0x0000000002840000-0x0000000002850000-memory.dmp
memory/2628-27-0x0000000002840000-0x0000000002850000-memory.dmp
memory/2628-30-0x0000000007460000-0x0000000007503000-memory.dmp
memory/2628-31-0x0000000007BE0000-0x000000000825A000-memory.dmp
memory/2628-32-0x0000000007590000-0x00000000075AA000-memory.dmp
memory/2628-33-0x0000000007600000-0x000000000760A000-memory.dmp
memory/2628-34-0x0000000007820000-0x00000000078B6000-memory.dmp
memory/2628-35-0x0000000007790000-0x00000000077A1000-memory.dmp
memory/2628-36-0x00000000077C0000-0x00000000077CE000-memory.dmp
memory/2628-37-0x00000000077D0000-0x00000000077E4000-memory.dmp
memory/2628-19-0x0000000070A00000-0x0000000070A4C000-memory.dmp
memory/2628-39-0x0000000007810000-0x0000000007818000-memory.dmp
memory/2628-18-0x0000000007210000-0x0000000007242000-memory.dmp
memory/2628-17-0x000000007FD00000-0x000000007FD10000-memory.dmp
memory/2628-16-0x00000000062A0000-0x00000000062EC000-memory.dmp
memory/2628-0-0x0000000002840000-0x0000000002850000-memory.dmp
memory/2628-14-0x0000000005C40000-0x0000000005F94000-memory.dmp
memory/2628-6-0x0000000005B90000-0x0000000005BF6000-memory.dmp
memory/2628-5-0x0000000005AB0000-0x0000000005B16000-memory.dmp
memory/2628-4-0x00000000052A0000-0x00000000052C2000-memory.dmp
memory/2628-3-0x0000000005310000-0x0000000005938000-memory.dmp
memory/2628-2-0x0000000002840000-0x0000000002850000-memory.dmp
memory/2628-1-0x00000000028E0000-0x0000000002916000-memory.dmp