Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
20/07/2026, 02:43
General
- Target 2026-07-20_a7e9f0f6f5a4b1a0e38f6dd761b51e7a_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
- Size 15.3MB
- Sample260720-c7rxpscz2m
- SHA256 bb7b06292ff63f746d23a42ff2ca26393c1ef461a41484204b4470a56cb187df
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies system certificate store 2 TTPs 5 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_a7e9f0f6f5a4b1a0e38f6dd761b51e7a_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_a7e9f0f6f5a4b1a0e38f6dd761b51e7a_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\svchost_task.exeC:\Users\Admin\AppData\Roaming\svchost_task.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_lrius4gx.q0o.ps1
svchost_task.exe
memory/2220-68-0x00000000078B0000-0x00000000078C4000-memory.dmp
memory/2220-67-0x0000000007880000-0x0000000007891000-memory.dmp
memory/2220-66-0x0000000007590000-0x0000000007633000-memory.dmp
memory/2220-58-0x00000000709F0000-0x0000000070A3C000-memory.dmp
memory/2220-57-0x0000000006620000-0x000000000666C000-memory.dmp
memory/2220-55-0x0000000005DC0000-0x0000000006114000-memory.dmp
memory/2220-47-0x0000000004E40000-0x0000000004E50000-memory.dmp
memory/2220-46-0x0000000004E40000-0x0000000004E50000-memory.dmp
memory/2456-15-0x0000000006220000-0x000000000623E000-memory.dmp
memory/2456-38-0x00000000077C0000-0x00000000077C8000-memory.dmp
memory/2456-28-0x00000000067C0000-0x00000000067DE000-memory.dmp
memory/2456-27-0x0000000002C30000-0x0000000002C40000-memory.dmp
memory/2456-19-0x0000000070DA0000-0x0000000070DEC000-memory.dmp
memory/2456-30-0x0000000007B90000-0x000000000820A000-memory.dmp
memory/2456-31-0x0000000007540000-0x000000000755A000-memory.dmp
memory/2456-32-0x00000000075A0000-0x00000000075AA000-memory.dmp
memory/2456-33-0x00000000077D0000-0x0000000007866000-memory.dmp
memory/2456-34-0x0000000007740000-0x0000000007751000-memory.dmp
memory/2456-35-0x0000000007770000-0x000000000777E000-memory.dmp
memory/2456-36-0x0000000007780000-0x0000000007794000-memory.dmp
memory/2456-37-0x0000000007890000-0x00000000078AA000-memory.dmp
memory/2456-29-0x0000000007400000-0x00000000074A3000-memory.dmp
memory/2456-18-0x00000000067E0000-0x0000000006812000-memory.dmp
memory/2456-17-0x000000007F550000-0x000000007F560000-memory.dmp
memory/2456-16-0x0000000006240000-0x000000000628C000-memory.dmp
memory/2456-0-0x0000000002C30000-0x0000000002C40000-memory.dmp
memory/2456-13-0x0000000005BE0000-0x0000000005F34000-memory.dmp
memory/2456-6-0x0000000005AB0000-0x0000000005B16000-memory.dmp
memory/2456-5-0x0000000005A40000-0x0000000005AA6000-memory.dmp
memory/2456-4-0x00000000059A0000-0x00000000059C2000-memory.dmp
memory/2456-3-0x0000000005300000-0x0000000005928000-memory.dmp
memory/2456-2-0x0000000002C30000-0x0000000002C40000-memory.dmp
memory/2456-1-0x0000000002C40000-0x0000000002C76000-memory.dmp