Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/08/2026, 09:25
General
- Target 2026-08-03_da01401c843e78c38642458505e684ab_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
- Size 15.3MB
- Sample260804-ld2dqasthy
- SHA256 44f62ce481504a74eaa9337ef4fbf8c2fbbae5aa68119c6399a878ad8d7f7cb1
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_da01401c843e78c38642458505e684ab_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_da01401c843e78c38642458505e684ab_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\svchost_task.exeC:\Users\Admin\AppData\Roaming\svchost_task.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_uwix30ov.vme.ps1
svchost_task.exe
memory/1824-15-0x0000000006730000-0x000000000677C000-memory.dmp
memory/1824-34-0x0000000007C20000-0x0000000007C31000-memory.dmp
memory/1824-4-0x0000000005F20000-0x0000000005F86000-memory.dmp
memory/1824-13-0x0000000006100000-0x0000000006454000-memory.dmp
memory/1824-14-0x00000000066F0000-0x000000000670E000-memory.dmp
memory/1824-0-0x0000000003130000-0x0000000003140000-memory.dmp
memory/1824-16-0x000000007F6A0000-0x000000007F6B0000-memory.dmp
memory/1824-17-0x00000000078C0000-0x00000000078F2000-memory.dmp
memory/1824-18-0x0000000070E70000-0x0000000070EBC000-memory.dmp
memory/1824-28-0x0000000006CE0000-0x0000000006CFE000-memory.dmp
memory/1824-27-0x0000000003130000-0x0000000003140000-memory.dmp
memory/1824-26-0x0000000003130000-0x0000000003140000-memory.dmp
memory/1824-29-0x0000000007900000-0x00000000079A3000-memory.dmp
memory/1824-30-0x0000000008070000-0x00000000086EA000-memory.dmp
memory/1824-31-0x0000000007A20000-0x0000000007A3A000-memory.dmp
memory/1824-32-0x0000000007A90000-0x0000000007A9A000-memory.dmp
memory/1824-33-0x0000000007CB0000-0x0000000007D46000-memory.dmp
memory/1824-5-0x0000000005F90000-0x0000000005FF6000-memory.dmp
memory/1824-35-0x0000000007C50000-0x0000000007C5E000-memory.dmp
memory/1824-36-0x0000000007C60000-0x0000000007C74000-memory.dmp
memory/1824-37-0x0000000007D70000-0x0000000007D8A000-memory.dmp
memory/1824-38-0x0000000007CA0000-0x0000000007CA8000-memory.dmp
memory/1824-3-0x0000000005820000-0x0000000005842000-memory.dmp
memory/1824-2-0x00000000058F0000-0x0000000005F18000-memory.dmp
memory/1824-1-0x0000000003140000-0x0000000003176000-memory.dmp
memory/3660-48-0x0000000004BB0000-0x0000000004BC0000-memory.dmp
memory/3660-57-0x0000000005C30000-0x0000000005F84000-memory.dmp
memory/3660-49-0x0000000004BB0000-0x0000000004BC0000-memory.dmp
memory/3660-59-0x0000000006600000-0x000000000664C000-memory.dmp
memory/3660-60-0x0000000070AA0000-0x0000000070AEC000-memory.dmp
memory/3660-68-0x0000000007350000-0x00000000073F3000-memory.dmp
memory/3660-69-0x0000000007600000-0x0000000007611000-memory.dmp
memory/3660-70-0x0000000007630000-0x0000000007644000-memory.dmp