Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
14/07/2026, 04:29
General
- Target 2026-07-14_15368af6080f58d47c11d91086452b33_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
- Size 15.2MB
- Sample260714-e4e5vagv71
- SHA256 634504e037adf3ec9b654ef8a8d005596819f6074d4fe8861f2cd7df527154ea
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_15368af6080f58d47c11d91086452b33_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_15368af6080f58d47c11d91086452b33_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\svchost_task.exeC:\Users\Admin\AppData\Roaming\svchost_task.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_tbrzyorq.ipy.ps1
svchost_task.exe
memory/5592-71-0x0000000007A50000-0x0000000007A64000-memory.dmp
memory/5592-70-0x0000000007A10000-0x0000000007A21000-memory.dmp
memory/5592-69-0x00000000076D0000-0x0000000007773000-memory.dmp
memory/5592-61-0x0000000070CE0000-0x0000000070D2C000-memory.dmp
memory/5592-60-0x0000000006990000-0x00000000069DC000-memory.dmp
memory/5592-58-0x0000000005FC0000-0x0000000006314000-memory.dmp
memory/5592-50-0x0000000002FD0000-0x0000000002FE0000-memory.dmp
memory/5592-49-0x0000000002FD0000-0x0000000002FE0000-memory.dmp
memory/6116-15-0x00000000068D0000-0x00000000068EE000-memory.dmp
memory/6116-38-0x0000000007F30000-0x0000000007F4A000-memory.dmp
memory/6116-28-0x0000000005420000-0x0000000005430000-memory.dmp
memory/6116-27-0x0000000005420000-0x0000000005430000-memory.dmp
memory/6116-19-0x00000000710B0000-0x00000000710FC000-memory.dmp
memory/6116-30-0x0000000007AD0000-0x0000000007B73000-memory.dmp
memory/6116-31-0x0000000008250000-0x00000000088CA000-memory.dmp
memory/6116-32-0x0000000007C00000-0x0000000007C1A000-memory.dmp
memory/6116-33-0x0000000007C60000-0x0000000007C6A000-memory.dmp
memory/6116-34-0x0000000007E90000-0x0000000007F26000-memory.dmp
memory/6116-35-0x0000000007E00000-0x0000000007E11000-memory.dmp
memory/6116-36-0x0000000007E40000-0x0000000007E4E000-memory.dmp
memory/6116-37-0x0000000007E50000-0x0000000007E64000-memory.dmp
memory/6116-29-0x0000000007AB0000-0x0000000007ACE000-memory.dmp
memory/6116-39-0x0000000007E80000-0x0000000007E88000-memory.dmp
memory/6116-18-0x0000000006EB0000-0x0000000006EE2000-memory.dmp
memory/6116-17-0x000000007FCD0000-0x000000007FCE0000-memory.dmp
memory/6116-16-0x0000000006910000-0x000000000695C000-memory.dmp
memory/6116-0-0x0000000005420000-0x0000000005430000-memory.dmp
memory/6116-14-0x00000000062B0000-0x0000000006604000-memory.dmp
memory/6116-6-0x0000000006100000-0x0000000006166000-memory.dmp
memory/6116-5-0x00000000059B0000-0x0000000005A16000-memory.dmp
memory/6116-4-0x0000000005910000-0x0000000005932000-memory.dmp
memory/6116-3-0x0000000005A60000-0x0000000006088000-memory.dmp
memory/6116-2-0x0000000005420000-0x0000000005430000-memory.dmp
memory/6116-1-0x0000000005300000-0x0000000005336000-memory.dmp