e22d09668297efaf0884ca6f861f2f1a508e62af499a7a4999e0d7ca32c04740

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_5ea0a59432a0b8888cd60d76b796b4f4_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Size 15.3MB
Sample260730-aekltavfrc
SHA256 e22d09668297efaf0884ca6f861f2f1a508e62af499a7a4999e0d7ca32c04740
MD5 5ea0a59432a0b8888cd60d76b796b4f4
SHA1 8b2210f057a4f6c185014c6f00fb30f6af4e29d0
SHA512 a1d7f12fd8d105eab0ae3313f0e0842de2b3ab9d222f83e676eae34cefcbde9356054d354c4a284d4340a04859a6f17eedd09724fa31b0c8e65281e77db35a08
SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUm:5sPJYtJqwXmFt+
TLSH
T1EDF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence spyware trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3576	powershell.exe
5660	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
3024	svchost_task.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\svchost_task.exe"	2026-07-29_5ea0a59432a0b8888cd60d76b796b4f4_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\svchost_task.exe"	svchost_task.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_5ea0a59432a0b8888cd60d76b796b4f4_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_task.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B	svchost_task.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 6b000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda0f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f335090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda7f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997e00000001000000080000000080826f22e7dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b19000000010000001000000021d008b47b7a2a81c8435903ded424c92000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	svchost_task.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 5c00000001000000040000000008000019000000010000001000000021d008b47b7a2a81c8435903ded424c903000000010000001400000047beabc922eae80e78783462a79f45c254fde68b7e00000001000000080000000080826f22e7dc011d000000010000001000000070253fbcbde32a014d38c1993098ad991400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde7f0000000100000016000000301406082b0601050507030306082b0601050507030462000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda53000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f3356b000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda2000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	svchost_task.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3576	powershell.exe
3576	powershell.exe
5660	powershell.exe
5660	powershell.exe
5660	powershell.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	3576	powershell.exe
Token: SeIncreaseQuotaPrivilege	3576	powershell.exe
Token: SeSecurityPrivilege	3576	powershell.exe
Token: SeTakeOwnershipPrivilege	3576	powershell.exe
Token: SeLoadDriverPrivilege	3576	powershell.exe
Token: SeSystemProfilePrivilege	3576	powershell.exe
Token: SeSystemtimePrivilege	3576	powershell.exe
Token: SeProfSingleProcessPrivilege	3576	powershell.exe
Token: SeIncBasePriorityPrivilege	3576	powershell.exe
Token: SeCreatePagefilePrivilege	3576	powershell.exe
Token: SeBackupPrivilege	3576	powershell.exe
Token: SeRestorePrivilege	3576	powershell.exe
Token: SeShutdownPrivilege	3576	powershell.exe
Token: SeDebugPrivilege	3576	powershell.exe
Token: SeSystemEnvironmentPrivilege	3576	powershell.exe
Token: SeRemoteShutdownPrivilege	3576	powershell.exe
Token: SeUndockPrivilege	3576	powershell.exe
Token: SeManageVolumePrivilege	3576	powershell.exe
Token: 33	3576	powershell.exe
Token: 34	3576	powershell.exe
Token: 35	3576	powershell.exe
Token: 36	3576	powershell.exe
Token: SeDebugPrivilege	5660	powershell.exe
Token: SeIncreaseQuotaPrivilege	5660	powershell.exe
Token: SeSecurityPrivilege	5660	powershell.exe
Token: SeTakeOwnershipPrivilege	5660	powershell.exe
Token: SeLoadDriverPrivilege	5660	powershell.exe
Token: SeSystemProfilePrivilege	5660	powershell.exe
Token: SeSystemtimePrivilege	5660	powershell.exe
Token: SeProfSingleProcessPrivilege	5660	powershell.exe
Token: SeIncBasePriorityPrivilege	5660	powershell.exe
Token: SeCreatePagefilePrivilege	5660	powershell.exe
Token: SeBackupPrivilege	5660	powershell.exe
Token: SeRestorePrivilege	5660	powershell.exe
Token: SeShutdownPrivilege	5660	powershell.exe
Token: SeDebugPrivilege	5660	powershell.exe
Token: SeSystemEnvironmentPrivilege	5660	powershell.exe
Token: SeRemoteShutdownPrivilege	5660	powershell.exe
Token: SeUndockPrivilege	5660	powershell.exe
Token: SeManageVolumePrivilege	5660	powershell.exe
Token: 33	5660	powershell.exe
Token: 34	5660	powershell.exe
Token: 35	5660	powershell.exe
Token: 36	5660	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 3576	1672	2026-07-29_5ea0a59432a0b8888cd60d76b796b4f4_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe	89
PID 3024 wrote to memory of 5660	3024	svchost_task.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-07-29_5ea0a59432a0b8888cd60d76b796b4f4_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_5ea0a59432a0b8888cd60d76b796b4f4_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3576

C:\Users\Admin\AppData\Roaming\svchost_task.exe
C:\Users\Admin\AppData\Roaming\svchost_task.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 618606b759f9fe0c8529788937f320fb1aecbecf8e5f76403fd5e29014cb5af3
MD5 ece74d96a9758a693d93db1139185038
SHA1 3f90a73aa66b45f75a8522c6ab08660f11212968
SHA512 8d8b18306ea7ec1eecd6e92cff96a56aba0176292ef1f4d2ddcbaae3676ce11f4a52ade749ff3df06831cd26f848c2598e24b31dc53d757b3c8b2e864bf59e95
SSDEEP 384:T1eBaoT1iBG5GW14byX8KSEM+KLrrMPnNIAgF4hyVWdS8PKl8vYbhNzPMlR/nZRF:BexZ6G8WiWsKA+K4lIA4Oy/dzbhNzP0t
TLSH
T103A2B578213F6DC7D8D226B010D10AF7FBE4D489DAB650D8BF1BDE2F4C90AB64A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_54iux0bd.fdd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_54iux0bd.fdd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

svchost_task.exe

Path C:\Users\Admin\AppData\Roaming\svchost_task.exe
Size 15.3MB
SHA256 7900edc966da4a10456e9d24178ba3f48a6c5c150124311a3a2d10c027fc60ed
MD5 9964c3d8aa84e0da4751f49af6ce6770
SHA1 7630234d74614023f31032d2d3024e3900340ac8
SHA512 f29aef5daa185301c324d1d72f30afc3f557a14b358f11cbfb2a9ebf7aa8f54d33ff7f186448e5cca8b8aa07fce6d69515a360c6c192dd532fb52b9301c7128b
SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QU5:5sPJYtJqwXmFtx
TLSH
T1FAF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3576-20-0x00000000079C0000-0x0000000007A63000-memory.dmp

Download

memory/3576-27-0x0000000074BB0000-0x000000007536C000-memory.dmp

Download

memory/3576-5-0x0000000005A80000-0x0000000005AE6000-memory.dmp

Download

memory/3576-6-0x0000000006150000-0x00000000061B6000-memory.dmp

Download

memory/3576-9-0x00000000063B0000-0x000000000670B000-memory.dmp

Download

memory/3576-10-0x0000000006780000-0x000000000679E000-memory.dmp

Download

memory/3576-11-0x00000000067E0000-0x000000000682C000-memory.dmp

Download

memory/3576-12-0x0000000074BB0000-0x000000007536C000-memory.dmp

Download

memory/3576-13-0x0000000007950000-0x0000000007986000-memory.dmp

Download

memory/3576-14-0x0000000070E00000-0x0000000070E4C000-memory.dmp

Download

memory/3576-18-0x0000000007990000-0x00000000079B0000-memory.dmp

Download

memory/3576-19-0x0000000074BB0000-0x000000007536C000-memory.dmp

Download

memory/3576-17-0x0000000074BB0000-0x000000007536C000-memory.dmp

Download

memory/3576-0-0x0000000074BC2000-0x0000000074BC3000-memory.dmp

Download

memory/3576-4-0x00000000059E0000-0x0000000005A02000-memory.dmp

Download

memory/3576-23-0x0000000007B70000-0x0000000007B7A000-memory.dmp

Download

memory/3576-22-0x0000000007B00000-0x0000000007B1A000-memory.dmp

Download

memory/3576-24-0x0000000007D70000-0x0000000007E06000-memory.dmp

Download

memory/3576-25-0x0000000074BB0000-0x000000007536C000-memory.dmp

Download

memory/3576-21-0x0000000008140000-0x00000000087BC000-memory.dmp

Download

memory/3576-3-0x0000000005B00000-0x000000000614A000-memory.dmp

Download

memory/3576-1-0x0000000002F90000-0x0000000002FC6000-memory.dmp

Download

memory/3576-2-0x0000000074BB0000-0x000000007536C000-memory.dmp

Download

memory/5660-35-0x00000000059C0000-0x0000000005D1B000-memory.dmp

Download

memory/5660-34-0x0000000074650000-0x0000000074E0C000-memory.dmp

Download

memory/5660-39-0x0000000006170000-0x00000000061BC000-memory.dmp

Download

memory/5660-40-0x00000000709A0000-0x00000000709EC000-memory.dmp

Download

memory/5660-43-0x00000000071B0000-0x0000000007253000-memory.dmp

Download

memory/5660-45-0x0000000074650000-0x0000000074E0C000-memory.dmp

Download