Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 03:58
Behavioral task
behavioral1
Sample
2026-08-07_0b4c14215f0ba5ebbf261ee2557534b1_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_0b4c14215f0ba5ebbf261ee2557534b1_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
21 signatures
150 seconds
General
- Target 2026-08-07_0b4c14215f0ba5ebbf261ee2557534b1_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe
- Size 12.0MB
- Sample260807-ejgg6sxble
- SHA256 e1c6dea2243dd7a0f862a1eeb7a520d742966f8433f81da185eaea8c2b4c5088
- MD5 0b4c14215f0ba5ebbf261ee2557534b1
- SHA1 4ca6ebaf90d9662edaa292ec0c7d8d45f47188af
- SHA512 222d5ef203af12a34035717e3aa4fca6e28031e4bd9d204b5822ccf52f33d57c9efb22df4093c10904bc0b904c884aa2cb7ca83d7c9d06d76404ceb52efb58a4
- SSDEEP 98304:vOPx8QETY4C2uMbZlg6XBJ4S3HVduETO/:m8AQukzdJTRTO/
- TLSH T1F0C65B11FACB54F6F9036831416BB27F23315D048B28DB9BEB583B6BF877691186A305
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 1 IoCs
resource yara_rule behavioral2/files/0x000c00000001c59d-4.dat family_salatstealer - Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
resource yara_rule behavioral2/files/0x000c00000001c59d-4.dat INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
resource yara_rule behavioral2/files/0x000c00000001c59d-4.dat INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
resource yara_rule behavioral2/files/0x000c00000001c59d-4.dat INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - Badlisted process makes network request 7 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 20 2816 powershell.exe 21 2816 powershell.exe 22 2816 powershell.exe 23 2816 powershell.exe 24 2816 powershell.exe 25 2816 powershell.exe 26 2816 powershell.exe - Downloads MZ/PE file 1 IoCs
flow pid Process 26 2816 powershell.exe - Executes dropped EXE 4 IoCs
pid Process 6076 OfficeClickToRun.exe 5636 OfficeClickToRun.exe 5836 Staem.exe 3520 Staem.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SteamWorker = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Staem.exe" Staem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SteamWorker = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Staem.exe" Staem.exe - Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 raw.githubusercontent.com 26 raw.githubusercontent.com - Drops file in Program Files directory 11 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Windows Photo Viewer\smartscreen.exe 2026-08-07_0b4c14215f0ba5ebbf261ee2557534b1_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\OfficeClickToRun.exe OfficeClickToRun.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\csrss.exe 2026-08-07_0b4c14215f0ba5ebbf261ee2557534b1_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe File opened for modification C:\Program Files (x86)\Windows Mail\1a037222-c15e-433b-6d94-f6fd1d6122c1 2026-08-07_0b4c14215f0ba5ebbf261ee2557534b1_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\1a037222-c15e-433b-6d94-f6fd1d6122c1 2026-08-07_0b4c14215f0ba5ebbf261ee2557534b1_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\1a037222-c15e-433b-6d94-f6fd1d6122c1 2026-08-07_0b4c14215f0ba5ebbf261ee2557534b1_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\OfficeClickToRun.exe 2026-08-07_0b4c14215f0ba5ebbf261ee2557534b1_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\1a037222-c15e-433b-6d94-f6fd1d6122c1 2026-08-07_0b4c14215f0ba5ebbf261ee2557534b1_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe File opened for modification C:\Program Files (x86)\Windows Mail\StartMenuExperienceHost.exe 2026-08-07_0b4c14215f0ba5ebbf261ee2557534b1_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe File opened for modification C:\Program Files (x86)\Common Files\1a037222-c15e-433b-6d94-f6fd1d6122c1 2026-08-07_0b4c14215f0ba5ebbf261ee2557534b1_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe File opened for modification C:\Program Files (x86)\Common Files\WUDFHost.exe 2026-08-07_0b4c14215f0ba5ebbf261ee2557534b1_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_0b4c14215f0ba5ebbf261ee2557534b1_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5052 2026-08-07_0b4c14215f0ba5ebbf261ee2557534b1_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe 5052 2026-08-07_0b4c14215f0ba5ebbf261ee2557534b1_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe 5052 2026-08-07_0b4c14215f0ba5ebbf261ee2557534b1_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe 5052 2026-08-07_0b4c14215f0ba5ebbf261ee2557534b1_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 2816 powershell.exe 2816 powershell.exe 2816 powershell.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 6076 OfficeClickToRun.exe 5836 Staem.exe 5836 Staem.exe 3520 Staem.exe 3520 Staem.exe 5836 Staem.exe 5836 Staem.exe 3520 Staem.exe 3520 Staem.exe 5836 Staem.exe 5836 Staem.exe 3520 Staem.exe 3520 Staem.exe 5836 Staem.exe 5836 Staem.exe 3520 Staem.exe 3520 Staem.exe 5836 Staem.exe 5836 Staem.exe 3520 Staem.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 6076 OfficeClickToRun.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2816 powershell.exe Token: SeDebugPrivilege 6076 OfficeClickToRun.exe Token: SeIncreaseQuotaPrivilege 2816 powershell.exe Token: SeSecurityPrivilege 2816 powershell.exe Token: SeTakeOwnershipPrivilege 2816 powershell.exe Token: SeLoadDriverPrivilege 2816 powershell.exe Token: SeSystemProfilePrivilege 2816 powershell.exe Token: SeSystemtimePrivilege 2816 powershell.exe Token: SeProfSingleProcessPrivilege 2816 powershell.exe Token: SeIncBasePriorityPrivilege 2816 powershell.exe Token: SeCreatePagefilePrivilege 2816 powershell.exe Token: SeBackupPrivilege 2816 powershell.exe Token: SeRestorePrivilege 2816 powershell.exe Token: SeShutdownPrivilege 2816 powershell.exe Token: SeDebugPrivilege 2816 powershell.exe Token: SeSystemEnvironmentPrivilege 2816 powershell.exe Token: SeRemoteShutdownPrivilege 2816 powershell.exe Token: SeUndockPrivilege 2816 powershell.exe Token: SeManageVolumePrivilege 2816 powershell.exe Token: 33 2816 powershell.exe Token: 34 2816 powershell.exe Token: 35 2816 powershell.exe Token: 36 2816 powershell.exe Token: SeIncreaseQuotaPrivilege 2816 powershell.exe Token: SeSecurityPrivilege 2816 powershell.exe Token: SeTakeOwnershipPrivilege 2816 powershell.exe Token: SeLoadDriverPrivilege 2816 powershell.exe Token: SeSystemProfilePrivilege 2816 powershell.exe Token: SeSystemtimePrivilege 2816 powershell.exe Token: SeProfSingleProcessPrivilege 2816 powershell.exe Token: SeIncBasePriorityPrivilege 2816 powershell.exe Token: SeCreatePagefilePrivilege 2816 powershell.exe Token: SeBackupPrivilege 2816 powershell.exe Token: SeRestorePrivilege 2816 powershell.exe Token: SeShutdownPrivilege 2816 powershell.exe Token: SeDebugPrivilege 2816 powershell.exe Token: SeSystemEnvironmentPrivilege 2816 powershell.exe Token: SeRemoteShutdownPrivilege 2816 powershell.exe Token: SeUndockPrivilege 2816 powershell.exe Token: SeManageVolumePrivilege 2816 powershell.exe Token: 33 2816 powershell.exe Token: 34 2816 powershell.exe Token: 35 2816 powershell.exe Token: 36 2816 powershell.exe Token: SeIncreaseQuotaPrivilege 2816 powershell.exe Token: SeSecurityPrivilege 2816 powershell.exe Token: SeTakeOwnershipPrivilege 2816 powershell.exe Token: SeLoadDriverPrivilege 2816 powershell.exe Token: SeSystemProfilePrivilege 2816 powershell.exe Token: SeSystemtimePrivilege 2816 powershell.exe Token: SeProfSingleProcessPrivilege 2816 powershell.exe Token: SeIncBasePriorityPrivilege 2816 powershell.exe Token: SeCreatePagefilePrivilege 2816 powershell.exe Token: SeBackupPrivilege 2816 powershell.exe Token: SeRestorePrivilege 2816 powershell.exe Token: SeShutdownPrivilege 2816 powershell.exe Token: SeDebugPrivilege 2816 powershell.exe Token: SeSystemEnvironmentPrivilege 2816 powershell.exe Token: SeRemoteShutdownPrivilege 2816 powershell.exe Token: SeUndockPrivilege 2816 powershell.exe Token: SeManageVolumePrivilege 2816 powershell.exe Token: 33 2816 powershell.exe Token: 34 2816 powershell.exe Token: 35 2816 powershell.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5836 Staem.exe 3520 Staem.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5052 wrote to memory of 6076 5052 2026-08-07_0b4c14215f0ba5ebbf261ee2557534b1_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe 90 PID 6076 wrote to memory of 2816 6076 OfficeClickToRun.exe 92 PID 6076 wrote to memory of 5636 6076 OfficeClickToRun.exe 94 PID 2816 wrote to memory of 5836 2816 powershell.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_0b4c14215f0ba5ebbf261ee2557534b1_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_0b4c14215f0ba5ebbf261ee2557534b1_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Program Files (x86)\WindowsPowerShell\OfficeClickToRun.exe"C:\Program Files (x86)\WindowsPowerShell\OfficeClickToRun.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\Staem.exe"C:\Users\Admin\AppData\Local\Temp\Staem.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5836
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\OfficeClickToRun.exe"C:\Program Files (x86)\Microsoft\Edge\Application\OfficeClickToRun.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5636
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\Staem.exeC:\Users\Admin\AppData\Local\Temp\Staem.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3520
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\WindowsPowerShell\OfficeClickToRun.exe
- Size 12.0MB
- SHA256 e1c6dea2243dd7a0f862a1eeb7a520d742966f8433f81da185eaea8c2b4c5088
- MD5 0b4c14215f0ba5ebbf261ee2557534b1
- SHA1 4ca6ebaf90d9662edaa292ec0c7d8d45f47188af
- SHA512 222d5ef203af12a34035717e3aa4fca6e28031e4bd9d204b5822ccf52f33d57c9efb22df4093c10904bc0b904c884aa2cb7ca83d7c9d06d76404ceb52efb58a4
- SSDEEP 98304:vOPx8QETY4C2uMbZlg6XBJ4S3HVduETO/:m8AQukzdJTRTO/
- TLSH T1F0C65B11FACB54F6F9036831416BB27F23315D048B28DB9BEB583B6BF877691186A305
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Staem.exe
- Size 1.3MB
- SHA256 799caef85e443f4ce857587de247f28b90f5bc5173be676be34072db6cb02601
- MD5 ccbf63d0e43fe52b6248ec521a3ea9ff
- SHA1 67c2b8f8bafa5e802154f434ff3096ff076aa29d
- SHA512 1e933b8884d33eb7e9980da8e7ce6a00e1a8db65c46a6b7ca48be65661f4bb06579198de3e7de803eafcd708af1fda9f7509e5f1bea399359d5aa0596f67277b
- SSDEEP 24576:cs54fAy404EW0x8vs/oKz0EGCr+I/MfceLicIfFih39Ewb/onfvsdo9:cXAy4p0SsgW0nI/n4h39Ewb/onQo9
- TLSH T11955AE4673A406E4D1B7D23986969F8BE6713C150720A7DB03EC62992F337E14A7F362
- MD5 SHA1 SHA512 SSDEEP TLSH