Analysis
- max time kernel
148s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/08/2026, 11:16
General
- Target 2026-08-03_770134e9721a0aea6adfa436373bdaaf_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
- Size 15.3MB
- Sample260804-ndh89aab73
- SHA256 045417c9e54af3d87204a1c9966b1f3ec7e0f87e2372123422d925a61207af37
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies system certificate store 2 TTPs 5 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_770134e9721a0aea6adfa436373bdaaf_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_770134e9721a0aea6adfa436373bdaaf_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\svchost_task.exeC:\Users\Admin\AppData\Roaming\svchost_task.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_psxic13e.3qk.ps1
svchost_task.exe
memory/1112-69-0x0000000007070000-0x0000000007084000-memory.dmp
memory/1112-68-0x0000000007020000-0x0000000007031000-memory.dmp
memory/1112-59-0x00000000704F0000-0x000000007053C000-memory.dmp
memory/1112-67-0x0000000006AC0000-0x0000000006B63000-memory.dmp
memory/1112-58-0x0000000005B60000-0x0000000005BAC000-memory.dmp
memory/1112-49-0x00000000054C0000-0x0000000005814000-memory.dmp
memory/1112-47-0x0000000004600000-0x0000000004610000-memory.dmp
memory/1112-48-0x0000000004600000-0x0000000004610000-memory.dmp
memory/3776-15-0x0000000005FC0000-0x0000000005FDE000-memory.dmp
memory/3776-38-0x0000000007630000-0x000000000764A000-memory.dmp
memory/3776-26-0x0000000004D00000-0x0000000004D10000-memory.dmp
memory/3776-25-0x0000000004D00000-0x0000000004D10000-memory.dmp
memory/3776-29-0x0000000007170000-0x000000000718E000-memory.dmp
memory/3776-30-0x00000000071A0000-0x0000000007243000-memory.dmp
memory/3776-31-0x0000000007920000-0x0000000007F9A000-memory.dmp
memory/3776-32-0x00000000072E0000-0x00000000072FA000-memory.dmp
memory/3776-33-0x0000000007340000-0x000000000734A000-memory.dmp
memory/3776-34-0x0000000007570000-0x0000000007606000-memory.dmp
memory/3776-35-0x00000000074E0000-0x00000000074F1000-memory.dmp
memory/3776-36-0x0000000007510000-0x000000000751E000-memory.dmp
memory/3776-37-0x0000000007520000-0x0000000007534000-memory.dmp
memory/3776-19-0x00000000706E0000-0x000000007072C000-memory.dmp
memory/3776-39-0x0000000007560000-0x0000000007568000-memory.dmp
memory/3776-18-0x0000000007130000-0x0000000007162000-memory.dmp
memory/3776-17-0x000000007F1B0000-0x000000007F1C0000-memory.dmp
memory/3776-16-0x0000000005FF0000-0x000000000603C000-memory.dmp
memory/3776-0-0x0000000004D00000-0x0000000004D10000-memory.dmp
memory/3776-14-0x0000000005AE0000-0x0000000005E34000-memory.dmp
memory/3776-11-0x0000000005970000-0x00000000059D6000-memory.dmp
memory/3776-5-0x00000000051A0000-0x0000000005206000-memory.dmp
memory/3776-4-0x0000000005100000-0x0000000005122000-memory.dmp
memory/3776-3-0x0000000005340000-0x0000000005968000-memory.dmp
memory/3776-2-0x0000000004D00000-0x0000000004D10000-memory.dmp
memory/3776-1-0x00000000026B0000-0x00000000026E6000-memory.dmp