Analysis
- max time kernel
148s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
14/07/2026, 04:27
General
- Target 2026-07-14_18a977ee109b46cb5462a7381a156af0_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
- Size 15.3MB
- Sample260714-e25mqaes6n
- SHA256 bc43eaa4c981e6257e08ff19289e8e881c25d7734ef99c5c6932dd2faeac4efe
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_18a977ee109b46cb5462a7381a156af0_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_18a977ee109b46cb5462a7381a156af0_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\svchost_task.exeC:\Users\Admin\AppData\Roaming\svchost_task.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_5zootxy4.hm1.ps1
svchost_task.exe
memory/4312-15-0x0000000006510000-0x000000000652E000-memory.dmp
memory/4312-34-0x0000000007A30000-0x0000000007A41000-memory.dmp
memory/4312-6-0x0000000005E30000-0x0000000005E96000-memory.dmp
memory/4312-4-0x00000000055C0000-0x00000000055E2000-memory.dmp
memory/4312-14-0x0000000005EA0000-0x00000000061F4000-memory.dmp
memory/4312-0-0x0000000005090000-0x00000000050A0000-memory.dmp
memory/4312-16-0x00000000065A0000-0x00000000065EC000-memory.dmp
memory/4312-17-0x000000007F4B0000-0x000000007F4C0000-memory.dmp
memory/4312-18-0x0000000006AE0000-0x0000000006B12000-memory.dmp
memory/4312-28-0x0000000006AC0000-0x0000000006ADE000-memory.dmp
memory/4312-27-0x0000000005090000-0x00000000050A0000-memory.dmp
memory/4312-19-0x0000000071120000-0x000000007116C000-memory.dmp
memory/4312-29-0x00000000076E0000-0x0000000007783000-memory.dmp
memory/4312-31-0x0000000007830000-0x000000000784A000-memory.dmp
memory/4312-30-0x0000000007E70000-0x00000000084EA000-memory.dmp
memory/4312-32-0x0000000007890000-0x000000000789A000-memory.dmp
memory/4312-33-0x0000000007AC0000-0x0000000007B56000-memory.dmp
memory/4312-5-0x0000000005660000-0x00000000056C6000-memory.dmp
memory/4312-35-0x0000000007A60000-0x0000000007A6E000-memory.dmp
memory/4312-36-0x0000000007A70000-0x0000000007A84000-memory.dmp
memory/4312-37-0x0000000007B80000-0x0000000007B9A000-memory.dmp
memory/4312-38-0x0000000007AB0000-0x0000000007AB8000-memory.dmp
memory/4312-3-0x00000000056D0000-0x0000000005CF8000-memory.dmp
memory/4312-2-0x0000000005090000-0x00000000050A0000-memory.dmp
memory/4312-1-0x0000000002EC0000-0x0000000002EF6000-memory.dmp
memory/4712-48-0x0000000004760000-0x0000000004770000-memory.dmp
memory/4712-57-0x00000000056F0000-0x0000000005A44000-memory.dmp
memory/4712-49-0x0000000004760000-0x0000000004770000-memory.dmp
memory/4712-59-0x0000000005D30000-0x0000000005D7C000-memory.dmp
memory/4712-60-0x0000000070D50000-0x0000000070D9C000-memory.dmp
memory/4712-68-0x0000000006F60000-0x0000000007003000-memory.dmp
memory/4712-69-0x0000000007230000-0x0000000007241000-memory.dmp
memory/4712-70-0x0000000007260000-0x0000000007274000-memory.dmp