Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/08/2026, 09:27
General
- Target 2026-08-03_d82f8e488d14641cfb91cc3018ed719f_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
- Size 15.3MB
- Sample260804-levbsswgre
- SHA256 1d5b7030c646f873673d31cee10186c20153ce494bc661cea0122b3429738f21
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies system certificate store 2 TTPs 5 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_d82f8e488d14641cfb91cc3018ed719f_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_d82f8e488d14641cfb91cc3018ed719f_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\svchost_task.exeC:\Users\Admin\AppData\Roaming\svchost_task.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_jldp3jzi.jcs.ps1
svchost_task.exe
memory/4536-29-0x0000000008300000-0x000000000897A000-memory.dmp
memory/4536-32-0x0000000007F50000-0x0000000007FE6000-memory.dmp
memory/4536-4-0x00000000062A0000-0x0000000006306000-memory.dmp
memory/4536-13-0x0000000006380000-0x00000000066D4000-memory.dmp
memory/4536-14-0x0000000006990000-0x00000000069AE000-memory.dmp
memory/4536-15-0x00000000069C0000-0x0000000006A0C000-memory.dmp
memory/4536-16-0x000000007F9B0000-0x000000007F9C0000-memory.dmp
memory/4536-18-0x0000000070A10000-0x0000000070A5C000-memory.dmp
memory/4536-19-0x0000000003450000-0x0000000003460000-memory.dmp
memory/4536-17-0x0000000006F60000-0x0000000006F92000-memory.dmp
memory/4536-27-0x0000000006F40000-0x0000000006F5E000-memory.dmp
memory/4536-28-0x0000000007960000-0x0000000007A03000-memory.dmp
memory/4536-0-0x0000000003450000-0x0000000003460000-memory.dmp
memory/4536-30-0x0000000007CC0000-0x0000000007CDA000-memory.dmp
memory/4536-31-0x0000000007D20000-0x0000000007D2A000-memory.dmp
memory/4536-5-0x0000000006310000-0x0000000006376000-memory.dmp
memory/4536-33-0x0000000007EC0000-0x0000000007ED1000-memory.dmp
memory/4536-34-0x0000000007EF0000-0x0000000007EFE000-memory.dmp
memory/4536-35-0x0000000007F00000-0x0000000007F14000-memory.dmp
memory/4536-36-0x0000000008010000-0x000000000802A000-memory.dmp
memory/4536-37-0x0000000007F40000-0x0000000007F48000-memory.dmp
memory/4536-3-0x0000000005AC0000-0x0000000005AE2000-memory.dmp
memory/4536-2-0x0000000005B80000-0x00000000061A8000-memory.dmp
memory/4536-1-0x00000000033A0000-0x00000000033D6000-memory.dmp
memory/4748-51-0x00000000056A0000-0x00000000059F4000-memory.dmp
memory/4748-45-0x0000000004750000-0x0000000004760000-memory.dmp
memory/4748-55-0x0000000005D40000-0x0000000005D8C000-memory.dmp
memory/4748-56-0x0000000070820000-0x000000007086C000-memory.dmp
memory/4748-64-0x0000000006CB0000-0x0000000006D53000-memory.dmp
memory/4748-65-0x0000000007230000-0x0000000007241000-memory.dmp
memory/4748-66-0x0000000007260000-0x0000000007274000-memory.dmp