094200749356da339dc25dcfb13791405ab66a4f8ce991df755640cf8188ef86

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_ff2146e6cc8ba99b96bde18b3e2c2e23_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Size 15.3MB
Sample260721-csfacsdy71
SHA256 094200749356da339dc25dcfb13791405ab66a4f8ce991df755640cf8188ef86
MD5 ff2146e6cc8ba99b96bde18b3e2c2e23
SHA1 db0bc8ed41b8f6f9811104c5bebe05bc2dfb048a
SHA512 b37c0df5b30aa65c7294fdde03ba1839e342443ca8dbc46045418421aa9b03cd5fc3ff895d6051cc3374af383a646d589b07533b55f38892d13a643fdb35e0c9
SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUC:5sPJYtJqwXmFta
TLSH
T195F61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence spyware trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5364	powershell.exe
3400	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
5704	svchost_task.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\svchost_task.exe"	2026-07-21_ff2146e6cc8ba99b96bde18b3e2c2e23_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\svchost_task.exe"	svchost_task.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_ff2146e6cc8ba99b96bde18b3e2c2e23_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_task.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B	svchost_task.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 6b000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda0f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f335090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda7f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997e00000001000000080000000080826f22e7dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b19000000010000001000000021d008b47b7a2a81c8435903ded424c92000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	svchost_task.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 5c00000001000000040000000008000019000000010000001000000021d008b47b7a2a81c8435903ded424c903000000010000001400000047beabc922eae80e78783462a79f45c254fde68b7e00000001000000080000000080826f22e7dc011d000000010000001000000070253fbcbde32a014d38c1993098ad991400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde7f0000000100000016000000301406082b0601050507030306082b0601050507030462000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda53000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f3356b000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda2000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	svchost_task.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
5364	powershell.exe
5364	powershell.exe
3400	powershell.exe
3400	powershell.exe
3400	powershell.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	5364	powershell.exe
Token: SeIncreaseQuotaPrivilege	5364	powershell.exe
Token: SeSecurityPrivilege	5364	powershell.exe
Token: SeTakeOwnershipPrivilege	5364	powershell.exe
Token: SeLoadDriverPrivilege	5364	powershell.exe
Token: SeSystemProfilePrivilege	5364	powershell.exe
Token: SeSystemtimePrivilege	5364	powershell.exe
Token: SeProfSingleProcessPrivilege	5364	powershell.exe
Token: SeIncBasePriorityPrivilege	5364	powershell.exe
Token: SeCreatePagefilePrivilege	5364	powershell.exe
Token: SeBackupPrivilege	5364	powershell.exe
Token: SeRestorePrivilege	5364	powershell.exe
Token: SeShutdownPrivilege	5364	powershell.exe
Token: SeDebugPrivilege	5364	powershell.exe
Token: SeSystemEnvironmentPrivilege	5364	powershell.exe
Token: SeRemoteShutdownPrivilege	5364	powershell.exe
Token: SeUndockPrivilege	5364	powershell.exe
Token: SeManageVolumePrivilege	5364	powershell.exe
Token: 33	5364	powershell.exe
Token: 34	5364	powershell.exe
Token: 35	5364	powershell.exe
Token: 36	5364	powershell.exe
Token: SeDebugPrivilege	3400	powershell.exe
Token: SeIncreaseQuotaPrivilege	3400	powershell.exe
Token: SeSecurityPrivilege	3400	powershell.exe
Token: SeTakeOwnershipPrivilege	3400	powershell.exe
Token: SeLoadDriverPrivilege	3400	powershell.exe
Token: SeSystemProfilePrivilege	3400	powershell.exe
Token: SeSystemtimePrivilege	3400	powershell.exe
Token: SeProfSingleProcessPrivilege	3400	powershell.exe
Token: SeIncBasePriorityPrivilege	3400	powershell.exe
Token: SeCreatePagefilePrivilege	3400	powershell.exe
Token: SeBackupPrivilege	3400	powershell.exe
Token: SeRestorePrivilege	3400	powershell.exe
Token: SeShutdownPrivilege	3400	powershell.exe
Token: SeDebugPrivilege	3400	powershell.exe
Token: SeSystemEnvironmentPrivilege	3400	powershell.exe
Token: SeRemoteShutdownPrivilege	3400	powershell.exe
Token: SeUndockPrivilege	3400	powershell.exe
Token: SeManageVolumePrivilege	3400	powershell.exe
Token: 33	3400	powershell.exe
Token: 34	3400	powershell.exe
Token: 35	3400	powershell.exe
Token: 36	3400	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 5364	1884	2026-07-21_ff2146e6cc8ba99b96bde18b3e2c2e23_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe	88
PID 5704 wrote to memory of 3400	5704	svchost_task.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-07-21_ff2146e6cc8ba99b96bde18b3e2c2e23_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_ff2146e6cc8ba99b96bde18b3e2c2e23_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5364

C:\Users\Admin\AppData\Roaming\svchost_task.exe
C:\Users\Admin\AppData\Roaming\svchost_task.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:5704
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 1272d935bfa9e54b8ce921642347aa5bfa339689f9198d70762b58b076bebf9e
MD5 a6d56c23aa1a93be43e7bcff393ce08a
SHA1 fc34ba023510a0f07d6776d4159292d4c3de584a
SHA512 72ef3c90704616ffe7bcd70204bda7491e3c0d65984fae8798fc3f043881b3d6b364884b152ed05917966db9a1a44338f8f0d6722d77ab6102155749ee6e3fbb
SSDEEP 384:a1eBaoT1iBG+GW14bt63n0OU+geYRr2PndIAgF4hcWtv88KlYvYbhNzPYlR/TZRB:KexZ6GNWi563nI+U61IA4OxK3bhNzPgN
TLSH
T17EA2C578213F6DC7D8D222B410D50AF7FBE4D489DAB611D4AF2BDE2F4C90EB64A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_juk2fj2j.pgg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_juk2fj2j.pgg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

svchost_task.exe

Path C:\Users\Admin\AppData\Roaming\svchost_task.exe
Size 15.3MB
SHA256 65b8eef61e10d4049331a6e2f73e6186230428e9f7863fc05d4f22f8e4091deb
MD5 8d49a0b9d68d1e25db40e59c15d41466
SHA1 d767353c8bd11ad3567c228e89431e23d8ac5609
SHA512 b64a0513663bb22eec426da75aed6602e30ae6635243e06a3cd1070cf7c6e832741b4877e07a97a79e46293cc2db5d738c34dfcf318ca7b31d60b99ae090f91f
SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUL:5sPJYtJqwXmFtD
TLSH
T147F61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3400-47-0x00000000749A0000-0x000000007515C000-memory.dmp

Download

memory/3400-45-0x0000000006E40000-0x0000000006EE3000-memory.dmp

Download

memory/3400-42-0x0000000070CF0000-0x0000000070D3C000-memory.dmp

Download

memory/3400-41-0x0000000005BC0000-0x0000000005C0C000-memory.dmp

Download

memory/3400-35-0x00000000749A0000-0x000000007515C000-memory.dmp

Download

memory/3400-39-0x0000000005820000-0x0000000005B7B000-memory.dmp

Download

memory/3400-38-0x00000000749A0000-0x000000007515C000-memory.dmp

Download

memory/3400-34-0x00000000749A0000-0x000000007515C000-memory.dmp

Download

memory/5364-10-0x0000000005F40000-0x000000000629B000-memory.dmp

Download

memory/5364-27-0x0000000074F00000-0x00000000756BC000-memory.dmp

Download

memory/5364-16-0x0000000074F00000-0x00000000756BC000-memory.dmp

Download

memory/5364-19-0x00000000069B0000-0x00000000069D0000-memory.dmp

Download

memory/5364-15-0x0000000071150000-0x000000007119C000-memory.dmp

Download

memory/5364-20-0x0000000007610000-0x00000000076B3000-memory.dmp

Download

memory/5364-22-0x0000000007730000-0x000000000774A000-memory.dmp

Download

memory/5364-21-0x0000000007D70000-0x00000000083EC000-memory.dmp

Download

memory/5364-23-0x00000000077A0000-0x00000000077AA000-memory.dmp

Download

memory/5364-24-0x00000000079A0000-0x0000000007A36000-memory.dmp

Download

memory/5364-25-0x0000000074F00000-0x00000000756BC000-memory.dmp

Download

memory/5364-14-0x00000000075D0000-0x0000000007606000-memory.dmp

Download

memory/5364-13-0x0000000074F00000-0x00000000756BC000-memory.dmp

Download

memory/5364-12-0x0000000006410000-0x000000000645C000-memory.dmp

Download

memory/5364-11-0x00000000063C0000-0x00000000063DE000-memory.dmp

Download

memory/5364-0-0x0000000074F12000-0x0000000074F13000-memory.dmp

Download

memory/5364-7-0x0000000005D50000-0x0000000005DB6000-memory.dmp

Download

memory/5364-6-0x0000000005CE0000-0x0000000005D46000-memory.dmp

Download

memory/5364-5-0x0000000005C40000-0x0000000005C62000-memory.dmp

Download

memory/5364-4-0x0000000074F00000-0x00000000756BC000-memory.dmp

Download

memory/5364-2-0x0000000074F00000-0x00000000756BC000-memory.dmp

Download

memory/5364-3-0x00000000055C0000-0x0000000005C0A000-memory.dmp

Download

memory/5364-1-0x0000000002ED0000-0x0000000002F06000-memory.dmp

Download