a194ba1ddfa95b30caabd62b85fda1de379bb9be2b134cb0c42089292581a609

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 01:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_19206fe6089f5e1647e97506541a8780_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Size 15.3MB
Sample260807-bfe86ax1bx
SHA256 a194ba1ddfa95b30caabd62b85fda1de379bb9be2b134cb0c42089292581a609
MD5 19206fe6089f5e1647e97506541a8780
SHA1 f3d942b1d9dd9141d84e8959c0ce2c2dae2442f0
SHA512 1cfb5db9ddb99debac5c18fca6c87767611cb1ca4bc4bd3f059dd0ddb94dc40da18fc268cb4404f93523b4ba5167893c0f7c661c10ddbd7df81a02843dfd03ec
SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QU/:5sPJYtJqwXmFtn
TLSH
T1EAF61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence spyware trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5180	powershell.exe
1980	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4388	svchost_task.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\svchost_task.exe"	2026-08-06_19206fe6089f5e1647e97506541a8780_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\svchost_task.exe"	svchost_task.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_19206fe6089f5e1647e97506541a8780_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_task.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B	svchost_task.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 6b000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda0f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f335090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda7f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997e00000001000000080000000080826f22e7dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b19000000010000001000000021d008b47b7a2a81c8435903ded424c92000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	svchost_task.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 5c00000001000000040000000008000019000000010000001000000021d008b47b7a2a81c8435903ded424c903000000010000001400000047beabc922eae80e78783462a79f45c254fde68b7e00000001000000080000000080826f22e7dc011d000000010000001000000070253fbcbde32a014d38c1993098ad991400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde7f0000000100000016000000301406082b0601050507030306082b0601050507030462000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda53000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f3356b000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda2000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	svchost_task.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
5180	powershell.exe
5180	powershell.exe
1980	powershell.exe
1980	powershell.exe
1980	powershell.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	5180	powershell.exe
Token: SeIncreaseQuotaPrivilege	5180	powershell.exe
Token: SeSecurityPrivilege	5180	powershell.exe
Token: SeTakeOwnershipPrivilege	5180	powershell.exe
Token: SeLoadDriverPrivilege	5180	powershell.exe
Token: SeSystemProfilePrivilege	5180	powershell.exe
Token: SeSystemtimePrivilege	5180	powershell.exe
Token: SeProfSingleProcessPrivilege	5180	powershell.exe
Token: SeIncBasePriorityPrivilege	5180	powershell.exe
Token: SeCreatePagefilePrivilege	5180	powershell.exe
Token: SeBackupPrivilege	5180	powershell.exe
Token: SeRestorePrivilege	5180	powershell.exe
Token: SeShutdownPrivilege	5180	powershell.exe
Token: SeDebugPrivilege	5180	powershell.exe
Token: SeSystemEnvironmentPrivilege	5180	powershell.exe
Token: SeRemoteShutdownPrivilege	5180	powershell.exe
Token: SeUndockPrivilege	5180	powershell.exe
Token: SeManageVolumePrivilege	5180	powershell.exe
Token: 33	5180	powershell.exe
Token: 34	5180	powershell.exe
Token: 35	5180	powershell.exe
Token: 36	5180	powershell.exe
Token: SeDebugPrivilege	1980	powershell.exe
Token: SeIncreaseQuotaPrivilege	1980	powershell.exe
Token: SeSecurityPrivilege	1980	powershell.exe
Token: SeTakeOwnershipPrivilege	1980	powershell.exe
Token: SeLoadDriverPrivilege	1980	powershell.exe
Token: SeSystemProfilePrivilege	1980	powershell.exe
Token: SeSystemtimePrivilege	1980	powershell.exe
Token: SeProfSingleProcessPrivilege	1980	powershell.exe
Token: SeIncBasePriorityPrivilege	1980	powershell.exe
Token: SeCreatePagefilePrivilege	1980	powershell.exe
Token: SeBackupPrivilege	1980	powershell.exe
Token: SeRestorePrivilege	1980	powershell.exe
Token: SeShutdownPrivilege	1980	powershell.exe
Token: SeDebugPrivilege	1980	powershell.exe
Token: SeSystemEnvironmentPrivilege	1980	powershell.exe
Token: SeRemoteShutdownPrivilege	1980	powershell.exe
Token: SeUndockPrivilege	1980	powershell.exe
Token: SeManageVolumePrivilege	1980	powershell.exe
Token: 33	1980	powershell.exe
Token: 34	1980	powershell.exe
Token: 35	1980	powershell.exe
Token: 36	1980	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 5180	3080	2026-08-06_19206fe6089f5e1647e97506541a8780_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe	89
PID 4388 wrote to memory of 1980	4388	svchost_task.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-08-06_19206fe6089f5e1647e97506541a8780_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_19206fe6089f5e1647e97506541a8780_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5180

C:\Users\Admin\AppData\Roaming\svchost_task.exe
C:\Users\Admin\AppData\Roaming\svchost_task.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 e98915e1f43bc79eb70642e800bda2137092e468cb2a683a3d75d7d2f56d3bef
MD5 d04437674f68ae4979c5405b37012622
SHA1 3dbf7c967485ad4258159a11d08d80200180f8f8
SHA512 44af573e59f8260b91dae6eb38483602d8bd0a836c6d99e84aaf6330ef61307da2b0a4513ab21e75532254f8bb24645b4588f5b6063e5358ab80bbc3402d1e34
SSDEEP 384:n1eBaoT1iBGVGW14bHAzN68+geC6U42Px0s/IAgF4hCVWkcMr8PKlQvYbhNzPwl7:1exZ6GgWiszNV+F4J5IA4OCV1rdPbhNs
TLSH
T1F5A2B478213F6DC7D8D226B410D10AE7FBE4D489DAB611D4AF2BDE2F4C90EB64E60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_1tzqivci.tvj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1tzqivci.tvj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

svchost_task.exe

Path C:\Users\Admin\AppData\Roaming\svchost_task.exe
Size 15.3MB
SHA256 bad542c2af244d2aa2e5f2c33fa93db6b8ff88a4e37d845dc7ce5cc71561d6e2
MD5 c26b09c8c158f7648c609cca941a87df
SHA1 d20adc399df83628a1b01d86d05b70a034734f1c
SHA512 8966f173ee50e9438d5b8fcbd5dcb6a3bd26c1ce57872897f9b9a76a4d044692387a97b2aa99757843fa519342fbe88bb70cc2b8a752b99a525dafd902940da9
SSDEEP 196608:88fsPJXTHhCtbC0cUbqsv6t6m6Ke8to6QUt:5sPJYtJqwXmFtV
TLSH
T128F61825F9CB40E7D48368B1A466222F63346E098B36DAE7E7C0BB15F4737724C7251A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1980-42-0x0000000007260000-0x0000000007303000-memory.dmp

Download

memory/1980-39-0x0000000070690000-0x00000000706DC000-memory.dmp

Download

memory/1980-38-0x0000000005FC0000-0x000000000600C000-memory.dmp

Download

memory/1980-34-0x0000000005A60000-0x0000000005DBB000-memory.dmp

Download

memory/5180-18-0x0000000006820000-0x0000000006840000-memory.dmp

Download

memory/5180-22-0x00000000075B0000-0x00000000075CA000-memory.dmp

Download

memory/5180-12-0x0000000006270000-0x00000000062BC000-memory.dmp

Download

memory/5180-11-0x0000000006230000-0x000000000624E000-memory.dmp

Download

memory/5180-14-0x00000000748A0000-0x000000007505C000-memory.dmp

Download

memory/5180-13-0x0000000007230000-0x0000000007266000-memory.dmp

Download

memory/5180-15-0x0000000070AF0000-0x0000000070B3C000-memory.dmp

Download

memory/5180-0-0x00000000748B2000-0x00000000748B3000-memory.dmp

Download

memory/5180-19-0x00000000748A0000-0x000000007505C000-memory.dmp

Download

memory/5180-24-0x0000000007820000-0x00000000078B6000-memory.dmp

Download

memory/5180-23-0x0000000007620000-0x000000000762A000-memory.dmp

Download

memory/5180-10-0x0000000005D40000-0x000000000609B000-memory.dmp

Download

memory/5180-21-0x0000000007BF0000-0x000000000826C000-memory.dmp

Download

memory/5180-20-0x0000000007470000-0x0000000007513000-memory.dmp

Download

memory/5180-25-0x00000000748A0000-0x000000007505C000-memory.dmp

Download

memory/5180-27-0x00000000748A0000-0x000000007505C000-memory.dmp

Download

memory/5180-6-0x0000000005410000-0x0000000005476000-memory.dmp

Download

memory/5180-7-0x0000000005480000-0x00000000054E6000-memory.dmp

Download

memory/5180-5-0x0000000005370000-0x0000000005392000-memory.dmp

Download

memory/5180-4-0x00000000748A0000-0x000000007505C000-memory.dmp

Download

memory/5180-2-0x00000000748A0000-0x000000007505C000-memory.dmp

Download

memory/5180-3-0x00000000054F0000-0x0000000005B3A000-memory.dmp

Download

memory/5180-1-0x0000000002D60000-0x0000000002D96000-memory.dmp

Download