Analysis
- max time kernel
149s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
08/08/2026, 03:52
General
- Target 2026-08-08_2e2e608dca159a047cbe1a667347f49e_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
- Size 15.3MB
- Sample260808-eflbyssybw
- SHA256 efd5c52c611605b821cd54c32eea185910750c9addfc4bd639a79baa7046a523
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 44 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2e2e608dca159a047cbe1a667347f49e_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_2e2e608dca159a047cbe1a667347f49e_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\svchost_task.exeC:\Users\Admin\AppData\Roaming\svchost_task.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_f001xec1.stc.ps1
svchost_task.exe
memory/2940-46-0x0000000074670000-0x0000000074E2C000-memory.dmp
memory/2940-44-0x0000000006F80000-0x0000000007023000-memory.dmp
memory/2940-41-0x00000000708C0000-0x000000007090C000-memory.dmp
memory/2940-40-0x0000000006310000-0x000000000635C000-memory.dmp
memory/2940-36-0x0000000005A00000-0x0000000005D5B000-memory.dmp
memory/2940-35-0x0000000074670000-0x0000000074E2C000-memory.dmp
memory/2940-34-0x0000000074670000-0x0000000074E2C000-memory.dmp
memory/2940-33-0x0000000074670000-0x0000000074E2C000-memory.dmp
memory/5956-10-0x0000000005790000-0x0000000005AEB000-memory.dmp
memory/5956-26-0x00000000748A0000-0x000000007505C000-memory.dmp
memory/5956-15-0x0000000070AF0000-0x0000000070B3C000-memory.dmp
memory/5956-19-0x0000000006E80000-0x0000000006EA0000-memory.dmp
memory/5956-18-0x00000000748A0000-0x000000007505C000-memory.dmp
memory/5956-20-0x00000000748A0000-0x000000007505C000-memory.dmp
memory/5956-21-0x0000000006EE0000-0x0000000006F83000-memory.dmp
memory/5956-22-0x0000000007650000-0x0000000007CCC000-memory.dmp
memory/5956-23-0x0000000007010000-0x000000000702A000-memory.dmp
memory/5956-24-0x0000000007080000-0x000000000708A000-memory.dmp
memory/5956-25-0x0000000007280000-0x0000000007316000-memory.dmp
memory/5956-14-0x0000000006EA0000-0x0000000006ED6000-memory.dmp
memory/5956-28-0x00000000748A0000-0x000000007505C000-memory.dmp
memory/5956-13-0x00000000748A0000-0x000000007505C000-memory.dmp
memory/5956-12-0x0000000005CE0000-0x0000000005D2C000-memory.dmp
memory/5956-11-0x0000000005CB0000-0x0000000005CCE000-memory.dmp
memory/5956-0-0x00000000748B2000-0x00000000748B3000-memory.dmp
memory/5956-7-0x00000000748A0000-0x000000007505C000-memory.dmp
memory/5956-6-0x0000000005720000-0x0000000005786000-memory.dmp
memory/5956-5-0x00000000056B0000-0x0000000005716000-memory.dmp
memory/5956-4-0x0000000004EC0000-0x0000000004EE2000-memory.dmp
memory/5956-2-0x00000000748A0000-0x000000007505C000-memory.dmp
memory/5956-3-0x0000000004F70000-0x00000000055BA000-memory.dmp
memory/5956-1-0x00000000027F0000-0x0000000002826000-memory.dmp