Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/07/2026, 17:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-06_9e9eefef4988ad80794b9fa420b43e47_coinminer_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_9e9eefef4988ad80794b9fa420b43e47_coinminer_snatch.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target 2026-07-06_9e9eefef4988ad80794b9fa420b43e47_coinminer_snatch.exe
- Size 9.1MB
- Sample260706-wgc6eaax2x
- SHA256 56bb75479e44709d3c5b7d5fdccfadb833f5fc0af827247a0ec5426f36895088
- MD5 9e9eefef4988ad80794b9fa420b43e47
- SHA1 0f64c3b14ca71828dd27fec112f36c66927bb404
- SHA512 2567e3ff40045f65f8425e5a7eafcfb68dbe13e70b0b88ce573934fbee93ddc65a53d6a3e7b3ae4dd863aab4fbaa86f03994ad927dcd66e0e366c7a39b5c5122
- SSDEEP 24576:7N90ke24rJqh+nw+OTJV7NZ/HcRm+W2vY1DuQBp2FldzYaOsQ85diVj/xi/YbWI7:7N90T24rJqh+w+O19WXW/ai
- TLSH T116A6BFB9B9042CE6E56F5277CAA2ACD923713D125F9766CB4060B7C20DB37E1ED32904
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 16 IoCs
resource yara_rule behavioral2/memory/5732-6-0x0000000000100000-0x0000000000D57000-memory.dmp family_salatstealer behavioral2/memory/5732-7-0x0000000000100000-0x0000000000D57000-memory.dmp family_salatstealer behavioral2/memory/5732-8-0x0000000000100000-0x0000000000D57000-memory.dmp family_salatstealer behavioral2/memory/5732-9-0x0000000000100000-0x0000000000D57000-memory.dmp family_salatstealer behavioral2/memory/5732-11-0x0000000000100000-0x0000000000D57000-memory.dmp family_salatstealer behavioral2/memory/5732-21-0x0000000000100000-0x0000000000D57000-memory.dmp family_salatstealer behavioral2/memory/3940-23-0x0000000000490000-0x00000000010E7000-memory.dmp family_salatstealer behavioral2/memory/3940-24-0x0000000000490000-0x00000000010E7000-memory.dmp family_salatstealer behavioral2/memory/2444-46-0x0000000000AF0000-0x0000000001747000-memory.dmp family_salatstealer behavioral2/memory/776-54-0x0000000000C20000-0x0000000001877000-memory.dmp family_salatstealer behavioral2/memory/3940-73-0x0000000000490000-0x00000000010E7000-memory.dmp family_salatstealer behavioral2/memory/3940-75-0x0000000000490000-0x00000000010E7000-memory.dmp family_salatstealer behavioral2/memory/3940-76-0x0000000000490000-0x00000000010E7000-memory.dmp family_salatstealer behavioral2/memory/3940-77-0x0000000000490000-0x00000000010E7000-memory.dmp family_salatstealer behavioral2/memory/3940-78-0x0000000000490000-0x00000000010E7000-memory.dmp family_salatstealer behavioral2/memory/3940-79-0x0000000000490000-0x00000000010E7000-memory.dmp family_salatstealer - Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 16 IoCs
resource yara_rule behavioral2/memory/5732-6-0x0000000000100000-0x0000000000D57000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/5732-7-0x0000000000100000-0x0000000000D57000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/5732-8-0x0000000000100000-0x0000000000D57000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/5732-9-0x0000000000100000-0x0000000000D57000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/5732-11-0x0000000000100000-0x0000000000D57000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/5732-21-0x0000000000100000-0x0000000000D57000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3940-23-0x0000000000490000-0x00000000010E7000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3940-24-0x0000000000490000-0x00000000010E7000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/2444-46-0x0000000000AF0000-0x0000000001747000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/776-54-0x0000000000C20000-0x0000000001877000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3940-73-0x0000000000490000-0x00000000010E7000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3940-75-0x0000000000490000-0x00000000010E7000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3940-76-0x0000000000490000-0x00000000010E7000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3940-77-0x0000000000490000-0x00000000010E7000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3940-78-0x0000000000490000-0x00000000010E7000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/3940-79-0x0000000000490000-0x00000000010E7000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 16 IoCs
resource yara_rule behavioral2/memory/5732-6-0x0000000000100000-0x0000000000D57000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5732-7-0x0000000000100000-0x0000000000D57000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5732-8-0x0000000000100000-0x0000000000D57000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5732-9-0x0000000000100000-0x0000000000D57000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5732-11-0x0000000000100000-0x0000000000D57000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5732-21-0x0000000000100000-0x0000000000D57000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3940-23-0x0000000000490000-0x00000000010E7000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3940-24-0x0000000000490000-0x00000000010E7000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2444-46-0x0000000000AF0000-0x0000000001747000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/776-54-0x0000000000C20000-0x0000000001877000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3940-73-0x0000000000490000-0x00000000010E7000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3940-75-0x0000000000490000-0x00000000010E7000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3940-76-0x0000000000490000-0x00000000010E7000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3940-77-0x0000000000490000-0x00000000010E7000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3940-78-0x0000000000490000-0x00000000010E7000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/3940-79-0x0000000000490000-0x00000000010E7000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables containing SQL queries to confidential data stores. Observed in infostealers 16 IoCs
resource yara_rule behavioral2/memory/5732-6-0x0000000000100000-0x0000000000D57000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/5732-7-0x0000000000100000-0x0000000000D57000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/5732-8-0x0000000000100000-0x0000000000D57000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/5732-9-0x0000000000100000-0x0000000000D57000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/5732-11-0x0000000000100000-0x0000000000D57000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/5732-21-0x0000000000100000-0x0000000000D57000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3940-23-0x0000000000490000-0x00000000010E7000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3940-24-0x0000000000490000-0x00000000010E7000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/2444-46-0x0000000000AF0000-0x0000000001747000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/776-54-0x0000000000C20000-0x0000000001877000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3940-73-0x0000000000490000-0x00000000010E7000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3940-75-0x0000000000490000-0x00000000010E7000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3940-76-0x0000000000490000-0x00000000010E7000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3940-77-0x0000000000490000-0x00000000010E7000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3940-78-0x0000000000490000-0x00000000010E7000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/3940-79-0x0000000000490000-0x00000000010E7000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - UPX dump on OEP (original entry point) 21 IoCs
resource yara_rule behavioral2/files/0x001000000001c593-3.dat UPX behavioral2/memory/5732-5-0x0000000000100000-0x0000000000D57000-memory.dmp UPX behavioral2/memory/5732-6-0x0000000000100000-0x0000000000D57000-memory.dmp UPX behavioral2/memory/5732-7-0x0000000000100000-0x0000000000D57000-memory.dmp UPX behavioral2/memory/5732-8-0x0000000000100000-0x0000000000D57000-memory.dmp UPX behavioral2/memory/5732-9-0x0000000000100000-0x0000000000D57000-memory.dmp UPX behavioral2/memory/5732-11-0x0000000000100000-0x0000000000D57000-memory.dmp UPX behavioral2/memory/5732-21-0x0000000000100000-0x0000000000D57000-memory.dmp UPX behavioral2/memory/3940-22-0x0000000000490000-0x00000000010E7000-memory.dmp UPX behavioral2/memory/3940-23-0x0000000000490000-0x00000000010E7000-memory.dmp UPX behavioral2/memory/3940-24-0x0000000000490000-0x00000000010E7000-memory.dmp UPX behavioral2/memory/2444-32-0x0000000000AF0000-0x0000000001747000-memory.dmp UPX behavioral2/memory/2444-46-0x0000000000AF0000-0x0000000001747000-memory.dmp UPX behavioral2/memory/776-52-0x0000000000C20000-0x0000000001877000-memory.dmp UPX behavioral2/memory/776-54-0x0000000000C20000-0x0000000001877000-memory.dmp UPX behavioral2/memory/3940-73-0x0000000000490000-0x00000000010E7000-memory.dmp UPX behavioral2/memory/3940-75-0x0000000000490000-0x00000000010E7000-memory.dmp UPX behavioral2/memory/3940-76-0x0000000000490000-0x00000000010E7000-memory.dmp UPX behavioral2/memory/3940-77-0x0000000000490000-0x00000000010E7000-memory.dmp UPX behavioral2/memory/3940-78-0x0000000000490000-0x00000000010E7000-memory.dmp UPX behavioral2/memory/3940-79-0x0000000000490000-0x00000000010E7000-memory.dmp UPX - Executes dropped EXE 4 IoCs
pid Process 5732 spoolsv_svc.exe 3940 lsass.exe 2444 lsass.exe 776 lsass.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
resource yara_rule behavioral2/files/0x001000000001c593-3.dat upx behavioral2/memory/5732-5-0x0000000000100000-0x0000000000D57000-memory.dmp upx behavioral2/memory/5732-6-0x0000000000100000-0x0000000000D57000-memory.dmp upx behavioral2/memory/5732-7-0x0000000000100000-0x0000000000D57000-memory.dmp upx behavioral2/memory/5732-8-0x0000000000100000-0x0000000000D57000-memory.dmp upx behavioral2/memory/5732-9-0x0000000000100000-0x0000000000D57000-memory.dmp upx behavioral2/memory/5732-11-0x0000000000100000-0x0000000000D57000-memory.dmp upx behavioral2/memory/5732-21-0x0000000000100000-0x0000000000D57000-memory.dmp upx behavioral2/memory/3940-22-0x0000000000490000-0x00000000010E7000-memory.dmp upx behavioral2/memory/3940-23-0x0000000000490000-0x00000000010E7000-memory.dmp upx behavioral2/memory/3940-24-0x0000000000490000-0x00000000010E7000-memory.dmp upx behavioral2/memory/2444-32-0x0000000000AF0000-0x0000000001747000-memory.dmp upx behavioral2/memory/2444-46-0x0000000000AF0000-0x0000000001747000-memory.dmp upx behavioral2/memory/776-52-0x0000000000C20000-0x0000000001877000-memory.dmp upx behavioral2/memory/776-54-0x0000000000C20000-0x0000000001877000-memory.dmp upx behavioral2/memory/3940-73-0x0000000000490000-0x00000000010E7000-memory.dmp upx behavioral2/memory/3940-75-0x0000000000490000-0x00000000010E7000-memory.dmp upx behavioral2/memory/3940-76-0x0000000000490000-0x00000000010E7000-memory.dmp upx behavioral2/memory/3940-77-0x0000000000490000-0x00000000010E7000-memory.dmp upx behavioral2/memory/3940-78-0x0000000000490000-0x00000000010E7000-memory.dmp upx behavioral2/memory/3940-79-0x0000000000490000-0x00000000010E7000-memory.dmp upx - Drops file in Program Files directory 8 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Windows Photo Viewer\a80cb364-7733-3a7c-5a03-2e1dd0766477 spoolsv_svc.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe spoolsv_svc.exe File opened for modification C:\Program Files (x86)\MSBuild\a80cb364-7733-3a7c-5a03-2e1dd0766477 spoolsv_svc.exe File opened for modification C:\Program Files (x86)\MSBuild\lsass.exe spoolsv_svc.exe File opened for modification C:\Program Files\Google\Chrome\Application\lsass.exe lsass.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\lsass.exe lsass.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\a80cb364-7733-3a7c-5a03-2e1dd0766477 spoolsv_svc.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\WmiPrvSE.exe spoolsv_svc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv_svc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe - Suspicious behavior: EnumeratesProcesses 43 IoCs
pid Process 5732 spoolsv_svc.exe 5732 spoolsv_svc.exe 5732 spoolsv_svc.exe 5732 spoolsv_svc.exe 3940 lsass.exe 3940 lsass.exe 3940 lsass.exe 3940 lsass.exe 5204 powershell.exe 5204 powershell.exe 5204 powershell.exe 3940 lsass.exe 3940 lsass.exe 3940 lsass.exe 3940 lsass.exe 3940 lsass.exe 3940 lsass.exe 3940 lsass.exe 3940 lsass.exe 3940 lsass.exe 3940 lsass.exe 3940 lsass.exe 3940 lsass.exe 3940 lsass.exe 3940 lsass.exe 3940 lsass.exe 3940 lsass.exe 3940 lsass.exe 3940 lsass.exe 3940 lsass.exe 3940 lsass.exe 3940 lsass.exe 3940 lsass.exe 3940 lsass.exe 3940 lsass.exe 3940 lsass.exe 3940 lsass.exe 3940 lsass.exe 3940 lsass.exe 3940 lsass.exe 3940 lsass.exe 3940 lsass.exe 3940 lsass.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5204 powershell.exe Token: SeIncreaseQuotaPrivilege 5204 powershell.exe Token: SeSecurityPrivilege 5204 powershell.exe Token: SeTakeOwnershipPrivilege 5204 powershell.exe Token: SeLoadDriverPrivilege 5204 powershell.exe Token: SeSystemProfilePrivilege 5204 powershell.exe Token: SeSystemtimePrivilege 5204 powershell.exe Token: SeProfSingleProcessPrivilege 5204 powershell.exe Token: SeIncBasePriorityPrivilege 5204 powershell.exe Token: SeCreatePagefilePrivilege 5204 powershell.exe Token: SeBackupPrivilege 5204 powershell.exe Token: SeRestorePrivilege 5204 powershell.exe Token: SeShutdownPrivilege 5204 powershell.exe Token: SeDebugPrivilege 5204 powershell.exe Token: SeSystemEnvironmentPrivilege 5204 powershell.exe Token: SeRemoteShutdownPrivilege 5204 powershell.exe Token: SeUndockPrivilege 5204 powershell.exe Token: SeManageVolumePrivilege 5204 powershell.exe Token: 33 5204 powershell.exe Token: 34 5204 powershell.exe Token: 35 5204 powershell.exe Token: 36 5204 powershell.exe Token: SeIncreaseQuotaPrivilege 5204 powershell.exe Token: SeSecurityPrivilege 5204 powershell.exe Token: SeTakeOwnershipPrivilege 5204 powershell.exe Token: SeLoadDriverPrivilege 5204 powershell.exe Token: SeSystemProfilePrivilege 5204 powershell.exe Token: SeSystemtimePrivilege 5204 powershell.exe Token: SeProfSingleProcessPrivilege 5204 powershell.exe Token: SeIncBasePriorityPrivilege 5204 powershell.exe Token: SeCreatePagefilePrivilege 5204 powershell.exe Token: SeBackupPrivilege 5204 powershell.exe Token: SeRestorePrivilege 5204 powershell.exe Token: SeShutdownPrivilege 5204 powershell.exe Token: SeDebugPrivilege 5204 powershell.exe Token: SeSystemEnvironmentPrivilege 5204 powershell.exe Token: SeRemoteShutdownPrivilege 5204 powershell.exe Token: SeUndockPrivilege 5204 powershell.exe Token: SeManageVolumePrivilege 5204 powershell.exe Token: 33 5204 powershell.exe Token: 34 5204 powershell.exe Token: 35 5204 powershell.exe Token: 36 5204 powershell.exe Token: SeIncreaseQuotaPrivilege 5204 powershell.exe Token: SeSecurityPrivilege 5204 powershell.exe Token: SeTakeOwnershipPrivilege 5204 powershell.exe Token: SeLoadDriverPrivilege 5204 powershell.exe Token: SeSystemProfilePrivilege 5204 powershell.exe Token: SeSystemtimePrivilege 5204 powershell.exe Token: SeProfSingleProcessPrivilege 5204 powershell.exe Token: SeIncBasePriorityPrivilege 5204 powershell.exe Token: SeCreatePagefilePrivilege 5204 powershell.exe Token: SeBackupPrivilege 5204 powershell.exe Token: SeRestorePrivilege 5204 powershell.exe Token: SeShutdownPrivilege 5204 powershell.exe Token: SeDebugPrivilege 5204 powershell.exe Token: SeSystemEnvironmentPrivilege 5204 powershell.exe Token: SeRemoteShutdownPrivilege 5204 powershell.exe Token: SeUndockPrivilege 5204 powershell.exe Token: SeManageVolumePrivilege 5204 powershell.exe Token: 33 5204 powershell.exe Token: 34 5204 powershell.exe Token: 35 5204 powershell.exe Token: 36 5204 powershell.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3088 wrote to memory of 5732 3088 2026-07-06_9e9eefef4988ad80794b9fa420b43e47_coinminer_snatch.exe 89 PID 5732 wrote to memory of 3940 5732 spoolsv_svc.exe 92 PID 3940 wrote to memory of 5204 3940 lsass.exe 93 PID 3940 wrote to memory of 2444 3940 lsass.exe 95 PID 3940 wrote to memory of 776 3940 lsass.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_9e9eefef4988ad80794b9fa420b43e47_coinminer_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_9e9eefef4988ad80794b9fa420b43e47_coinminer_snatch.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\spoolsv_svc.exeC:\Users\Admin\AppData\Local\Temp\spoolsv_svc.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Program Files (x86)\MSBuild\lsass.exe"C:\Program Files (x86)\MSBuild\lsass.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5204
-
-
C:\Program Files\Google\Chrome\Application\lsass.exe"C:\Program Files\Google\Chrome\Application\lsass.exe" -4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\lsass.exe"C:\Program Files (x86)\Microsoft\Edge\Application\lsass.exe" -4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:776
-
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:5488
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:924
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:5724
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zrlipp20.pcn.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\spoolsv_svc.exe
- Size 3.4MB
- SHA256 dde2d30d0c33ad28694cc026c30665b1e8fb469bc7e7c5400c3c3b25071d7538
- MD5 6cf675ca0610e3c05daa80ca052907e4
- SHA1 a1f33b7aee4bb9b204a9fcd310c9707e4e17cabd
- SHA512 7c68ea386b2aa882c12903f547cbbad1d9aa32dcab568c8a2f3aa5431eedd70c5962cf5c53ce274a28f8bdaa3a372f638e706524a260ae310358ef5e78510426
- SSDEEP 49152:RqpxHd8fHtGxwluM8WJZhLIkDiigEa7oEQwVaaBUs1elIvnjCKvVFcgHz:RY9sKcuM8WTlIILgE5PwZOlIFznT
- TLSH T1F8F533CC8B158430FFB6EE37B41397A128BE48031852E3F94EB9716E97394E6B759460
- MD5 SHA1 SHA512 SSDEEP TLSH