Analysis
- max time kernel
150s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 03:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-20_5a90b14edd4d599ee7e0bee18609bbef_coinminer_dosia_elex_poet-rat_quasar-rat_sliver_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_5a90b14edd4d599ee7e0bee18609bbef_coinminer_dosia_elex_poet-rat_quasar-rat_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-20_5a90b14edd4d599ee7e0bee18609bbef_coinminer_dosia_elex_poet-rat_quasar-rat_sliver_snatch.exe
- Size 23.5MB
- Sample260720-dmktbsgs2w
- SHA256 fb9406f8ca1726c8e23896d09f5b712290a5e53e98ccb23e26c3f648b27f6c2d
- MD5 5a90b14edd4d599ee7e0bee18609bbef
- SHA1 6d6554ba0d2e54239b9f3201ef9a10d26595ad17
- SHA512 eccec87d55315ba42dd2d028f428674008de4f1fdba598b705406b139531e87acd0e7e2a06168b844637a769f0699f0f01f7e400164b2cdbffca4d04e9847d32
- SSDEEP 393216:bs7aXpYtSjrMM2j7isIfmvbrBCDprYCf:47aPjrMM2j7inmvbrW
- TLSH T1EF474A15F9CB06F6E447883060A6622F23356E08C735C6A3E7D47B69F9F3761887724A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3936 SecurityHealthSystray.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe" 2026-07-20_5a90b14edd4d599ee7e0bee18609bbef_coinminer_dosia_elex_poet-rat_quasar-rat_sliver_snatch.exe - Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 1 ip-api.com 2 api.ipify.org 5 api.ipify.org - System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_5a90b14edd4d599ee7e0bee18609bbef_coinminer_dosia_elex_poet-rat_quasar-rat_sliver_snatch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SecurityHealthSystray.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe - GoLang User-Agent 2 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 3 Go-http-client/1.1 HTTP User-Agent header 6 Go-http-client/1.1 - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2476 wmic.exe 2476 wmic.exe 2476 wmic.exe 2476 wmic.exe 6064 wmic.exe 6064 wmic.exe 6064 wmic.exe 6064 wmic.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2128 2026-07-20_5a90b14edd4d599ee7e0bee18609bbef_coinminer_dosia_elex_poet-rat_quasar-rat_sliver_snatch.exe Token: SeIncreaseQuotaPrivilege 2476 wmic.exe Token: SeSecurityPrivilege 2476 wmic.exe Token: SeTakeOwnershipPrivilege 2476 wmic.exe Token: SeLoadDriverPrivilege 2476 wmic.exe Token: SeSystemProfilePrivilege 2476 wmic.exe Token: SeSystemtimePrivilege 2476 wmic.exe Token: SeProfSingleProcessPrivilege 2476 wmic.exe Token: SeIncBasePriorityPrivilege 2476 wmic.exe Token: SeCreatePagefilePrivilege 2476 wmic.exe Token: SeBackupPrivilege 2476 wmic.exe Token: SeRestorePrivilege 2476 wmic.exe Token: SeShutdownPrivilege 2476 wmic.exe Token: SeDebugPrivilege 2476 wmic.exe Token: SeSystemEnvironmentPrivilege 2476 wmic.exe Token: SeRemoteShutdownPrivilege 2476 wmic.exe Token: SeUndockPrivilege 2476 wmic.exe Token: SeManageVolumePrivilege 2476 wmic.exe Token: 33 2476 wmic.exe Token: 34 2476 wmic.exe Token: 35 2476 wmic.exe Token: 36 2476 wmic.exe Token: SeIncreaseQuotaPrivilege 2476 wmic.exe Token: SeSecurityPrivilege 2476 wmic.exe Token: SeTakeOwnershipPrivilege 2476 wmic.exe Token: SeLoadDriverPrivilege 2476 wmic.exe Token: SeSystemProfilePrivilege 2476 wmic.exe Token: SeSystemtimePrivilege 2476 wmic.exe Token: SeProfSingleProcessPrivilege 2476 wmic.exe Token: SeIncBasePriorityPrivilege 2476 wmic.exe Token: SeCreatePagefilePrivilege 2476 wmic.exe Token: SeBackupPrivilege 2476 wmic.exe Token: SeRestorePrivilege 2476 wmic.exe Token: SeShutdownPrivilege 2476 wmic.exe Token: SeDebugPrivilege 2476 wmic.exe Token: SeSystemEnvironmentPrivilege 2476 wmic.exe Token: SeRemoteShutdownPrivilege 2476 wmic.exe Token: SeUndockPrivilege 2476 wmic.exe Token: SeManageVolumePrivilege 2476 wmic.exe Token: 33 2476 wmic.exe Token: 34 2476 wmic.exe Token: 35 2476 wmic.exe Token: 36 2476 wmic.exe Token: SeDebugPrivilege 3936 SecurityHealthSystray.exe Token: SeIncreaseQuotaPrivilege 6064 wmic.exe Token: SeSecurityPrivilege 6064 wmic.exe Token: SeTakeOwnershipPrivilege 6064 wmic.exe Token: SeLoadDriverPrivilege 6064 wmic.exe Token: SeSystemProfilePrivilege 6064 wmic.exe Token: SeSystemtimePrivilege 6064 wmic.exe Token: SeProfSingleProcessPrivilege 6064 wmic.exe Token: SeIncBasePriorityPrivilege 6064 wmic.exe Token: SeCreatePagefilePrivilege 6064 wmic.exe Token: SeBackupPrivilege 6064 wmic.exe Token: SeRestorePrivilege 6064 wmic.exe Token: SeShutdownPrivilege 6064 wmic.exe Token: SeDebugPrivilege 6064 wmic.exe Token: SeSystemEnvironmentPrivilege 6064 wmic.exe Token: SeRemoteShutdownPrivilege 6064 wmic.exe Token: SeUndockPrivilege 6064 wmic.exe Token: SeManageVolumePrivilege 6064 wmic.exe Token: 33 6064 wmic.exe Token: 34 6064 wmic.exe Token: 35 6064 wmic.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2128 wrote to memory of 4984 2128 2026-07-20_5a90b14edd4d599ee7e0bee18609bbef_coinminer_dosia_elex_poet-rat_quasar-rat_sliver_snatch.exe 89 PID 2128 wrote to memory of 1884 2128 2026-07-20_5a90b14edd4d599ee7e0bee18609bbef_coinminer_dosia_elex_poet-rat_quasar-rat_sliver_snatch.exe 91 PID 2128 wrote to memory of 2476 2128 2026-07-20_5a90b14edd4d599ee7e0bee18609bbef_coinminer_dosia_elex_poet-rat_quasar-rat_sliver_snatch.exe 93 PID 3936 wrote to memory of 1828 3936 SecurityHealthSystray.exe 98 PID 3936 wrote to memory of 6064 3936 SecurityHealthSystray.exe 100 - Views/modifies file attributes 1 TTPs 3 IoCs
pid Process 4984 attrib.exe 1884 attrib.exe 1828 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_5a90b14edd4d599ee7e0bee18609bbef_coinminer_dosia_elex_poet-rat_quasar-rat_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_5a90b14edd4d599ee7e0bee18609bbef_coinminer_dosia_elex_poet-rat_quasar-rat_sliver_snatch.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-20_5a90b14edd4d599ee7e0bee18609bbef_coinminer_dosia_elex_poet-rat_quasar-rat_sliver_snatch.exe2⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:4984
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe2⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:1884
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic csproduct get UUID2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2476
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Windows\SysWOW64\attrib.exeattrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe2⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:1828
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic csproduct get UUID2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6064
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
- Size 23.5MB
- SHA256 fb9406f8ca1726c8e23896d09f5b712290a5e53e98ccb23e26c3f648b27f6c2d
- MD5 5a90b14edd4d599ee7e0bee18609bbef
- SHA1 6d6554ba0d2e54239b9f3201ef9a10d26595ad17
- SHA512 eccec87d55315ba42dd2d028f428674008de4f1fdba598b705406b139531e87acd0e7e2a06168b844637a769f0699f0f01f7e400164b2cdbffca4d04e9847d32
- SSDEEP 393216:bs7aXpYtSjrMM2j7isIfmvbrBCDprYCf:47aPjrMM2j7inmvbrW
- TLSH T1EF474A15F9CB06F6E447883060A6622F23356E08C735C6A3E7D47B69F9F3761887724A
- MD5 SHA1 SHA512 SSDEEP TLSH