Analysis
- max time kernel
148s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
20/07/2026, 09:58
General
- Target 2026-07-20_4a5475e61866e7d7c3b3320505417ca1_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
- Size 15.3MB
- Sample260720-lzh49sgw21
- SHA256 9cbecd9793c252759d17c10ddb2efd3580e4335c3dae1f456926e09b8d93ef1e
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_4a5475e61866e7d7c3b3320505417ca1_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_4a5475e61866e7d7c3b3320505417ca1_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\svchost_task.exeC:\Users\Admin\AppData\Roaming\svchost_task.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_z1ytzgdq.wak.ps1
svchost_task.exe
memory/1116-70-0x0000000007500000-0x0000000007514000-memory.dmp
memory/1116-69-0x00000000074D0000-0x00000000074E1000-memory.dmp
memory/1116-68-0x0000000007010000-0x00000000070B3000-memory.dmp
memory/1116-60-0x00000000702D0000-0x000000007031C000-memory.dmp
memory/1116-59-0x0000000006500000-0x000000000654C000-memory.dmp
memory/1116-57-0x00000000058B0000-0x0000000005C04000-memory.dmp
memory/1116-48-0x0000000004A30000-0x0000000004A40000-memory.dmp
memory/1116-49-0x0000000004A30000-0x0000000004A40000-memory.dmp
memory/4040-15-0x00000000061D0000-0x00000000061EE000-memory.dmp
memory/4040-38-0x0000000007790000-0x0000000007798000-memory.dmp
memory/4040-27-0x00000000029B0000-0x00000000029C0000-memory.dmp
memory/4040-28-0x00000000073B0000-0x00000000073CE000-memory.dmp
memory/4040-29-0x00000000073E0000-0x0000000007483000-memory.dmp
memory/4040-30-0x0000000007B50000-0x00000000081CA000-memory.dmp
memory/4040-31-0x0000000007510000-0x000000000752A000-memory.dmp
memory/4040-32-0x0000000007570000-0x000000000757A000-memory.dmp
memory/4040-33-0x00000000077A0000-0x0000000007836000-memory.dmp
memory/4040-34-0x0000000007710000-0x0000000007721000-memory.dmp
memory/4040-35-0x0000000007740000-0x000000000774E000-memory.dmp
memory/4040-36-0x0000000007750000-0x0000000007764000-memory.dmp
memory/4040-37-0x0000000007860000-0x000000000787A000-memory.dmp
memory/4040-19-0x00000000706A0000-0x00000000706EC000-memory.dmp
memory/4040-18-0x00000000067C0000-0x00000000067F2000-memory.dmp
memory/4040-17-0x000000007F480000-0x000000007F490000-memory.dmp
memory/4040-16-0x0000000006220000-0x000000000626C000-memory.dmp
memory/4040-0-0x00000000029B0000-0x00000000029C0000-memory.dmp
memory/4040-14-0x0000000005BC0000-0x0000000005F14000-memory.dmp
memory/4040-5-0x00000000059F0000-0x0000000005A56000-memory.dmp
memory/4040-6-0x0000000005A60000-0x0000000005AC6000-memory.dmp
memory/4040-4-0x0000000005320000-0x0000000005342000-memory.dmp
memory/4040-3-0x0000000005350000-0x0000000005978000-memory.dmp
memory/4040-2-0x00000000029B0000-0x00000000029C0000-memory.dmp
memory/4040-1-0x00000000028D0000-0x0000000002906000-memory.dmp