Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
27/07/2026, 14:13
General
- Target 2026-07-27_ceb64561278f179bd599830c014d6ea3_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
- Size 15.3MB
- Sample260727-rjfxvsbd68
- SHA256 4f58be008b53191e77fe003390384ff10e618ace120b006430d9bea8f4bdab11
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_ceb64561278f179bd599830c014d6ea3_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_ceb64561278f179bd599830c014d6ea3_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\svchost_task.exeC:\Users\Admin\AppData\Roaming\svchost_task.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_ndnl24s2.53n.ps1
svchost_task.exe
memory/1704-31-0x0000000007500000-0x000000000751A000-memory.dmp
memory/1704-34-0x0000000007700000-0x0000000007711000-memory.dmp
memory/1704-4-0x00000000059E0000-0x0000000005A46000-memory.dmp
memory/1704-13-0x0000000005CB0000-0x0000000006004000-memory.dmp
memory/1704-14-0x00000000061D0000-0x00000000061EE000-memory.dmp
memory/1704-15-0x0000000006210000-0x000000000625C000-memory.dmp
memory/1704-16-0x000000007F160000-0x000000007F170000-memory.dmp
memory/1704-17-0x00000000067A0000-0x00000000067D2000-memory.dmp
memory/1704-18-0x0000000070530000-0x000000007057C000-memory.dmp
memory/1704-27-0x0000000002C20000-0x0000000002C30000-memory.dmp
memory/1704-28-0x00000000073A0000-0x00000000073BE000-memory.dmp
memory/1704-26-0x0000000002C20000-0x0000000002C30000-memory.dmp
memory/1704-29-0x00000000073C0000-0x0000000007463000-memory.dmp
memory/1704-30-0x0000000007B40000-0x00000000081BA000-memory.dmp
memory/1704-0-0x0000000002C20000-0x0000000002C30000-memory.dmp
memory/1704-32-0x0000000007560000-0x000000000756A000-memory.dmp
memory/1704-33-0x0000000007790000-0x0000000007826000-memory.dmp
memory/1704-5-0x0000000005A50000-0x0000000005AB6000-memory.dmp
memory/1704-35-0x0000000007730000-0x000000000773E000-memory.dmp
memory/1704-36-0x0000000007740000-0x0000000007754000-memory.dmp
memory/1704-37-0x0000000007850000-0x000000000786A000-memory.dmp
memory/1704-38-0x0000000007780000-0x0000000007788000-memory.dmp
memory/1704-3-0x0000000005940000-0x0000000005962000-memory.dmp
memory/1704-1-0x0000000002C30000-0x0000000002C66000-memory.dmp
memory/1704-2-0x00000000052E0000-0x0000000005908000-memory.dmp
memory/3196-49-0x0000000004B30000-0x0000000004B40000-memory.dmp
memory/3196-57-0x00000000059D0000-0x0000000005D24000-memory.dmp
memory/3196-48-0x0000000004B30000-0x0000000004B40000-memory.dmp
memory/3196-59-0x0000000006600000-0x000000000664C000-memory.dmp
memory/3196-60-0x0000000070160000-0x00000000701AC000-memory.dmp
memory/3196-68-0x00000000071E0000-0x0000000007283000-memory.dmp
memory/3196-69-0x00000000073A0000-0x00000000073B1000-memory.dmp
memory/3196-70-0x0000000007680000-0x0000000007694000-memory.dmp