Analysis
- max time kernel
147s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
30/07/2026, 23:41
General
- Target 2026-07-30_1b12312bd9bc89a92dad372ddbfd19a6_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
- Size 15.3MB
- Sample260730-3pxckshd77
- SHA256 8bfcd687cbbcdddea8839593229948ddb00b99be00a0ac423329f84d2b132daf
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_1b12312bd9bc89a92dad372ddbfd19a6_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_1b12312bd9bc89a92dad372ddbfd19a6_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\svchost_task.exeC:\Users\Admin\AppData\Roaming\svchost_task.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_31xp0ook.u5j.ps1
svchost_task.exe
memory/2992-69-0x0000000007900000-0x0000000007914000-memory.dmp
memory/2992-68-0x00000000078C0000-0x00000000078D1000-memory.dmp
memory/2992-67-0x0000000007570000-0x0000000007613000-memory.dmp
memory/2992-59-0x0000000070E60000-0x0000000070EAC000-memory.dmp
memory/2992-58-0x00000000068F0000-0x000000000693C000-memory.dmp
memory/2992-56-0x0000000005E10000-0x0000000006164000-memory.dmp
memory/2992-47-0x0000000004E30000-0x0000000004E40000-memory.dmp
memory/2992-48-0x0000000004E30000-0x0000000004E40000-memory.dmp
memory/4624-15-0x00000000062C0000-0x00000000062DE000-memory.dmp
memory/4624-38-0x0000000007950000-0x000000000796A000-memory.dmp
memory/4624-29-0x00000000068B0000-0x00000000068CE000-memory.dmp
memory/4624-28-0x0000000002EA0000-0x0000000002EB0000-memory.dmp
memory/4624-27-0x0000000002EA0000-0x0000000002EB0000-memory.dmp
memory/4624-30-0x00000000074D0000-0x0000000007573000-memory.dmp
memory/4624-31-0x0000000007C40000-0x00000000082BA000-memory.dmp
memory/4624-32-0x0000000007600000-0x000000000761A000-memory.dmp
memory/4624-33-0x0000000007660000-0x000000000766A000-memory.dmp
memory/4624-34-0x0000000007890000-0x0000000007926000-memory.dmp
memory/4624-35-0x0000000007800000-0x0000000007811000-memory.dmp
memory/4624-36-0x0000000007830000-0x000000000783E000-memory.dmp
memory/4624-37-0x0000000007840000-0x0000000007854000-memory.dmp
memory/4624-19-0x0000000071050000-0x000000007109C000-memory.dmp
memory/4624-39-0x0000000007880000-0x0000000007888000-memory.dmp
memory/4624-18-0x0000000007490000-0x00000000074C2000-memory.dmp
memory/4624-17-0x000000007F810000-0x000000007F820000-memory.dmp
memory/4624-16-0x0000000006310000-0x000000000635C000-memory.dmp
memory/4624-0-0x0000000002EA0000-0x0000000002EB0000-memory.dmp
memory/4624-14-0x0000000005D00000-0x0000000006054000-memory.dmp
memory/4624-6-0x0000000005650000-0x00000000056B6000-memory.dmp
memory/4624-5-0x00000000054B0000-0x0000000005516000-memory.dmp
memory/4624-4-0x0000000005410000-0x0000000005432000-memory.dmp
memory/4624-3-0x00000000056D0000-0x0000000005CF8000-memory.dmp
memory/4624-2-0x0000000002EA0000-0x0000000002EB0000-memory.dmp
memory/4624-1-0x0000000002990000-0x00000000029C6000-memory.dmp