Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
03/08/2026, 02:57
General
- Target 2026-08-03_16321865f32ae92e96ed7c28ee1dca56_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
- Size 15.3MB
- Sample260803-dfphyabk91
- SHA256 a89eb4db3612460f97941a58d582ee7979bc5749bff24ba0adb5d6d8f499fa3a
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_16321865f32ae92e96ed7c28ee1dca56_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_16321865f32ae92e96ed7c28ee1dca56_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\svchost_task.exeC:\Users\Admin\AppData\Roaming\svchost_task.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_arqb0zff.olg.ps1
svchost_task.exe
memory/1952-16-0x0000000005F00000-0x0000000005F4C000-memory.dmp
memory/1952-34-0x0000000007480000-0x0000000007516000-memory.dmp
memory/1952-6-0x0000000005840000-0x00000000058A6000-memory.dmp
memory/1952-4-0x0000000005630000-0x0000000005652000-memory.dmp
memory/1952-14-0x00000000058D0000-0x0000000005C24000-memory.dmp
memory/1952-0-0x00000000048D0000-0x00000000048E0000-memory.dmp
memory/1952-15-0x0000000005EE0000-0x0000000005EFE000-memory.dmp
memory/1952-17-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1952-18-0x00000000064A0000-0x00000000064D2000-memory.dmp
memory/1952-19-0x0000000070DF0000-0x0000000070E3C000-memory.dmp
memory/1952-21-0x00000000048D0000-0x00000000048E0000-memory.dmp
memory/1952-20-0x00000000048D0000-0x00000000048E0000-memory.dmp
memory/1952-29-0x00000000064E0000-0x00000000064FE000-memory.dmp
memory/1952-30-0x00000000070C0000-0x0000000007163000-memory.dmp
memory/1952-31-0x0000000007840000-0x0000000007EBA000-memory.dmp
memory/1952-32-0x00000000071F0000-0x000000000720A000-memory.dmp
memory/1952-33-0x0000000007250000-0x000000000725A000-memory.dmp
memory/1952-5-0x00000000057D0000-0x0000000005836000-memory.dmp
memory/1952-35-0x00000000073F0000-0x0000000007401000-memory.dmp
memory/1952-36-0x0000000007420000-0x000000000742E000-memory.dmp
memory/1952-37-0x0000000007430000-0x0000000007444000-memory.dmp
memory/1952-38-0x0000000007540000-0x000000000755A000-memory.dmp
memory/1952-39-0x0000000007470000-0x0000000007478000-memory.dmp
memory/1952-3-0x0000000004F90000-0x00000000055B8000-memory.dmp
memory/1952-2-0x00000000048D0000-0x00000000048E0000-memory.dmp
memory/1952-1-0x0000000004920000-0x0000000004956000-memory.dmp
memory/3900-49-0x0000000004A80000-0x0000000004A90000-memory.dmp
memory/3900-58-0x00000000057B0000-0x0000000005B04000-memory.dmp
memory/3900-50-0x0000000004A80000-0x0000000004A90000-memory.dmp
memory/3900-60-0x00000000063F0000-0x000000000643C000-memory.dmp
memory/3900-61-0x0000000070A20000-0x0000000070A6C000-memory.dmp
memory/3900-69-0x0000000007040000-0x00000000070E3000-memory.dmp
memory/3900-70-0x00000000071D0000-0x00000000071E1000-memory.dmp
memory/3900-71-0x0000000007490000-0x00000000074A4000-memory.dmp