Analysis
- max time kernel
148s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
08/08/2026, 03:52
General
- Target 2026-08-08_2e2e608dca159a047cbe1a667347f49e_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
- Size 15.3MB
- Sample260808-eflbyssybw
- SHA256 efd5c52c611605b821cd54c32eea185910750c9addfc4bd639a79baa7046a523
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies system certificate store 2 TTPs 5 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2e2e608dca159a047cbe1a667347f49e_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_2e2e608dca159a047cbe1a667347f49e_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\svchost_task.exeC:\Users\Admin\AppData\Roaming\svchost_task.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_pysiyvq3.klm.ps1
svchost_task.exe
memory/412-31-0x0000000006FD0000-0x0000000006FDA000-memory.dmp
memory/412-32-0x00000000071F0000-0x0000000007286000-memory.dmp
memory/412-4-0x00000000054B0000-0x0000000005516000-memory.dmp
memory/412-11-0x0000000005610000-0x0000000005964000-memory.dmp
memory/412-14-0x0000000005C40000-0x0000000005C5E000-memory.dmp
memory/412-15-0x0000000005C60000-0x0000000005CAC000-memory.dmp
memory/412-16-0x000000007EEB0000-0x000000007EEC0000-memory.dmp
memory/412-17-0x0000000006200000-0x0000000006232000-memory.dmp
memory/412-18-0x00000000703F0000-0x000000007043C000-memory.dmp
memory/412-27-0x00000000061E0000-0x00000000061FE000-memory.dmp
memory/412-19-0x00000000047D0000-0x00000000047E0000-memory.dmp
memory/412-28-0x0000000006E10000-0x0000000006EB3000-memory.dmp
memory/412-29-0x00000000075B0000-0x0000000007C2A000-memory.dmp
memory/412-30-0x0000000006F60000-0x0000000006F7A000-memory.dmp
memory/412-0-0x00000000047D0000-0x00000000047E0000-memory.dmp
memory/412-5-0x0000000005520000-0x0000000005586000-memory.dmp
memory/412-33-0x0000000007160000-0x0000000007171000-memory.dmp
memory/412-34-0x0000000007190000-0x000000000719E000-memory.dmp
memory/412-35-0x00000000071A0000-0x00000000071B4000-memory.dmp
memory/412-36-0x00000000072B0000-0x00000000072CA000-memory.dmp
memory/412-37-0x00000000071E0000-0x00000000071E8000-memory.dmp
memory/412-3-0x0000000004D90000-0x0000000004DB2000-memory.dmp
memory/412-2-0x0000000004E10000-0x0000000005438000-memory.dmp
memory/412-1-0x0000000004670000-0x00000000046A6000-memory.dmp
memory/2220-45-0x0000000002C40000-0x0000000002C50000-memory.dmp
memory/2220-47-0x0000000005C20000-0x0000000005F74000-memory.dmp
memory/2220-46-0x0000000002C40000-0x0000000002C50000-memory.dmp
memory/2220-56-0x00000000063F0000-0x000000000643C000-memory.dmp
memory/2220-57-0x0000000070040000-0x000000007008C000-memory.dmp
memory/2220-65-0x0000000007570000-0x0000000007613000-memory.dmp
memory/2220-66-0x0000000007760000-0x0000000007771000-memory.dmp
memory/2220-67-0x0000000007910000-0x0000000007924000-memory.dmp