Analysis
- max time kernel
148s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
05/07/2026, 03:32
General
- Target 2026-07-05_ba6eba78e45ba74c331adb97552d99bf_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
- Size 15.2MB
- Sample260705-d3pr8ag14t
- SHA256 4f71738fbc67007c0985383dd1033a776a1efac40fa58894e918712baadef688
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_ba6eba78e45ba74c331adb97552d99bf_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_ba6eba78e45ba74c331adb97552d99bf_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\svchost_task.exeC:\Users\Admin\AppData\Roaming\svchost_task.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
77EC63BDA74BD0D0E0426DC8F8008506
77EC63BDA74BD0D0E0426DC8F8008506
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_1nv1tf1z.bhr.ps1
svchost_task.exe
memory/1676-66-0x0000000006F30000-0x0000000006FD3000-memory.dmp
memory/1676-58-0x000000006FE30000-0x000000006FE7C000-memory.dmp
memory/1676-57-0x00000000062C0000-0x000000000630C000-memory.dmp
memory/1676-67-0x0000000007270000-0x0000000007281000-memory.dmp
memory/1676-55-0x00000000057B0000-0x0000000005B04000-memory.dmp
memory/1676-47-0x0000000004790000-0x00000000047A0000-memory.dmp
memory/1676-46-0x0000000004790000-0x00000000047A0000-memory.dmp
memory/1676-68-0x00000000072B0000-0x00000000072C4000-memory.dmp
memory/4080-15-0x0000000006980000-0x00000000069CC000-memory.dmp
memory/4080-27-0x0000000006F20000-0x0000000006F3E000-memory.dmp
memory/4080-29-0x0000000007B50000-0x0000000007BF3000-memory.dmp
memory/4080-30-0x00000000082B0000-0x000000000892A000-memory.dmp
memory/4080-31-0x0000000007C70000-0x0000000007C8A000-memory.dmp
memory/4080-32-0x0000000007CD0000-0x0000000007CDA000-memory.dmp
memory/4080-33-0x0000000007F00000-0x0000000007F96000-memory.dmp
memory/4080-34-0x0000000007E70000-0x0000000007E81000-memory.dmp
memory/4080-35-0x0000000007EB0000-0x0000000007EBE000-memory.dmp
memory/4080-36-0x0000000007EC0000-0x0000000007ED4000-memory.dmp
memory/4080-37-0x0000000007FA0000-0x0000000007FBA000-memory.dmp
memory/4080-38-0x0000000007EF0000-0x0000000007EF8000-memory.dmp
memory/4080-26-0x0000000003550000-0x0000000003560000-memory.dmp
memory/4080-17-0x0000000007B10000-0x0000000007B42000-memory.dmp
memory/4080-28-0x0000000003550000-0x0000000003560000-memory.dmp
memory/4080-18-0x00000000701E0000-0x000000007022C000-memory.dmp
memory/4080-16-0x000000007F640000-0x000000007F650000-memory.dmp
memory/4080-0-0x0000000003550000-0x0000000003560000-memory.dmp
memory/4080-14-0x0000000006940000-0x000000000695E000-memory.dmp
memory/4080-13-0x0000000006350000-0x00000000066A4000-memory.dmp
memory/4080-5-0x0000000005AA0000-0x0000000005B06000-memory.dmp
memory/4080-4-0x0000000005A30000-0x0000000005A96000-memory.dmp
memory/4080-3-0x0000000005980000-0x00000000059A2000-memory.dmp
memory/4080-2-0x0000000005BB0000-0x00000000061D8000-memory.dmp
memory/4080-1-0x0000000003010000-0x0000000003046000-memory.dmp