Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
08/07/2026, 02:25
General
- Target 2026-07-08_9e767ece71e1cdcfa2700b186ad515b8_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
- Size 15.3MB
- Sample260708-cwpcfaat8p
- SHA256 d9b167093499dce67b23c341ed975c0dc8829a5a94d8f52902e5a76c407aa500
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies system certificate store 2 TTPs 5 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_9e767ece71e1cdcfa2700b186ad515b8_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_9e767ece71e1cdcfa2700b186ad515b8_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\svchost_task.exeC:\Users\Admin\AppData\Roaming\svchost_task.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_rupncjhe.lxr.ps1
svchost_task.exe
memory/2900-67-0x0000000007760000-0x0000000007774000-memory.dmp
memory/2900-66-0x0000000007720000-0x0000000007731000-memory.dmp
memory/2900-65-0x0000000007480000-0x0000000007523000-memory.dmp
memory/2900-57-0x0000000070DA0000-0x0000000070DEC000-memory.dmp
memory/2900-56-0x00000000067B0000-0x00000000067FC000-memory.dmp
memory/2900-54-0x0000000005B50000-0x0000000005EA4000-memory.dmp
memory/2900-45-0x0000000002C30000-0x0000000002C40000-memory.dmp
memory/2900-46-0x0000000002C30000-0x0000000002C40000-memory.dmp
memory/3080-15-0x0000000005C50000-0x0000000005C9C000-memory.dmp
memory/3080-36-0x00000000071E0000-0x00000000071FA000-memory.dmp
memory/3080-27-0x0000000006180000-0x000000000619E000-memory.dmp
memory/3080-28-0x0000000006BE0000-0x0000000006C83000-memory.dmp
memory/3080-29-0x0000000007510000-0x0000000007B8A000-memory.dmp
memory/3080-30-0x0000000006EB0000-0x0000000006ECA000-memory.dmp
memory/3080-31-0x0000000006F10000-0x0000000006F1A000-memory.dmp
memory/3080-32-0x0000000007140000-0x00000000071D6000-memory.dmp
memory/3080-33-0x00000000070B0000-0x00000000070C1000-memory.dmp
memory/3080-34-0x00000000070F0000-0x00000000070FE000-memory.dmp
memory/3080-35-0x0000000007100000-0x0000000007114000-memory.dmp
memory/3080-17-0x0000000006140000-0x0000000006172000-memory.dmp
memory/3080-37-0x0000000007130000-0x0000000007138000-memory.dmp
memory/3080-26-0x00000000046A0000-0x00000000046B0000-memory.dmp
memory/3080-18-0x0000000070F90000-0x0000000070FDC000-memory.dmp
memory/3080-16-0x000000007F650000-0x000000007F660000-memory.dmp
memory/3080-0-0x00000000046A0000-0x00000000046B0000-memory.dmp
memory/3080-14-0x0000000005B90000-0x0000000005BAE000-memory.dmp
memory/3080-13-0x0000000005580000-0x00000000058D4000-memory.dmp
memory/3080-5-0x00000000054D0000-0x0000000005536000-memory.dmp
memory/3080-4-0x00000000053B0000-0x0000000005416000-memory.dmp
memory/3080-3-0x0000000005310000-0x0000000005332000-memory.dmp
memory/3080-2-0x0000000004CE0000-0x0000000005308000-memory.dmp
memory/3080-1-0x00000000045D0000-0x0000000004606000-memory.dmp