Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/07/2026, 12:05
General
- Target 2026-07-20_06b144f6c7a639a843f70c7f0ef21daa_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
- Size 15.3MB
- Sample260720-n876vsbw9z
- SHA256 792fb9a9db4e676135d548bfa7918195ca347262117b722f33183fdce800c851
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies system certificate store 2 TTPs 5 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 44 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_06b144f6c7a639a843f70c7f0ef21daa_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_06b144f6c7a639a843f70c7f0ef21daa_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\svchost_task.exeC:\Users\Admin\AppData\Roaming\svchost_task.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_baagtx3n.4an.ps1
svchost_task.exe
memory/2388-10-0x0000000005870000-0x0000000005BCB000-memory.dmp
memory/2388-24-0x0000000007210000-0x000000000721A000-memory.dmp
memory/2388-5-0x0000000005630000-0x0000000005652000-memory.dmp
memory/2388-6-0x00000000056D0000-0x0000000005736000-memory.dmp
memory/2388-7-0x0000000005740000-0x00000000057A6000-memory.dmp
memory/2388-0-0x0000000074A92000-0x0000000074A93000-memory.dmp
memory/2388-11-0x0000000005DB0000-0x0000000005DCE000-memory.dmp
memory/2388-12-0x0000000005E60000-0x0000000005EAC000-memory.dmp
memory/2388-23-0x00000000071A0000-0x00000000071BA000-memory.dmp
memory/2388-18-0x0000000006F70000-0x0000000006F90000-memory.dmp
memory/2388-14-0x0000000074A80000-0x000000007523C000-memory.dmp
memory/2388-13-0x0000000006F90000-0x0000000006FC6000-memory.dmp
memory/2388-20-0x0000000074A80000-0x000000007523C000-memory.dmp
memory/2388-19-0x0000000007060000-0x0000000007103000-memory.dmp
memory/2388-4-0x0000000074A80000-0x000000007523C000-memory.dmp
memory/2388-21-0x0000000074A80000-0x000000007523C000-memory.dmp
memory/2388-15-0x0000000070CD0000-0x0000000070D1C000-memory.dmp
memory/2388-22-0x00000000077E0000-0x0000000007E5C000-memory.dmp
memory/2388-25-0x0000000007410000-0x00000000074A6000-memory.dmp
memory/2388-26-0x0000000074A80000-0x000000007523C000-memory.dmp
memory/2388-28-0x0000000074A80000-0x000000007523C000-memory.dmp
memory/2388-3-0x0000000074A80000-0x000000007523C000-memory.dmp
memory/2388-1-0x00000000025C0000-0x00000000025F6000-memory.dmp
memory/2388-2-0x0000000004FE0000-0x000000000562A000-memory.dmp
memory/4928-35-0x0000000074850000-0x000000007500C000-memory.dmp
memory/4928-33-0x0000000074850000-0x000000007500C000-memory.dmp
memory/4928-38-0x0000000005F20000-0x000000000627B000-memory.dmp
memory/4928-34-0x0000000074850000-0x000000007500C000-memory.dmp
memory/4928-40-0x0000000006370000-0x00000000063BC000-memory.dmp
memory/4928-41-0x0000000070AA0000-0x0000000070AEC000-memory.dmp
memory/4928-44-0x00000000075F0000-0x0000000007693000-memory.dmp
memory/4928-46-0x0000000074850000-0x000000007500C000-memory.dmp