Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
19/08/2026, 03:59
General
- Target 2026-08-19_e9388b132075b187aaaee1f6838c3b40_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe
- Size 15.3MB
- Sample260819-ej3emsdk8s
- SHA256 cfef6c1c419cb540a200bef8aff78e660760d2c3440df61daef03319c0d35beb
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_e9388b132075b187aaaee1f6838c3b40_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_e9388b132075b187aaaee1f6838c3b40_coinminer_elex_frostygoop_hive_poet-rat_salatstealer_sliver_snatch.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\svchost_task.exeC:\Users\Admin\AppData\Roaming\svchost_task.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_sglqflqm.ohl.ps1
svchost_task.exe
memory/2588-66-0x00000000074A0000-0x00000000074B4000-memory.dmp
memory/2588-65-0x0000000007460000-0x0000000007471000-memory.dmp
memory/2588-64-0x0000000006F60000-0x0000000007003000-memory.dmp
memory/2588-56-0x0000000070BA0000-0x0000000070BEC000-memory.dmp
memory/2588-55-0x0000000006400000-0x000000000644C000-memory.dmp
memory/2588-46-0x0000000005860000-0x0000000005BB4000-memory.dmp
memory/2588-44-0x0000000004960000-0x0000000004970000-memory.dmp
memory/2588-45-0x0000000004960000-0x0000000004970000-memory.dmp
memory/4532-14-0x0000000006820000-0x000000000683E000-memory.dmp
memory/4532-36-0x0000000007DC0000-0x0000000007DC8000-memory.dmp
memory/4532-27-0x00000000077F0000-0x0000000007893000-memory.dmp
memory/4532-28-0x0000000008190000-0x000000000880A000-memory.dmp
memory/4532-29-0x0000000007B40000-0x0000000007B5A000-memory.dmp
memory/4532-30-0x0000000007BA0000-0x0000000007BAA000-memory.dmp
memory/4532-31-0x0000000007DD0000-0x0000000007E66000-memory.dmp
memory/4532-32-0x0000000007D40000-0x0000000007D51000-memory.dmp
memory/4532-33-0x0000000007D70000-0x0000000007D7E000-memory.dmp
memory/4532-34-0x0000000007D80000-0x0000000007D94000-memory.dmp
memory/4532-35-0x0000000007E90000-0x0000000007EAA000-memory.dmp
memory/4532-26-0x0000000006DD0000-0x0000000006DEE000-memory.dmp
memory/4532-18-0x0000000070D90000-0x0000000070DDC000-memory.dmp
memory/4532-17-0x0000000006DF0000-0x0000000006E22000-memory.dmp
memory/4532-16-0x000000007FB90000-0x000000007FBA0000-memory.dmp
memory/4532-15-0x0000000006850000-0x000000000689C000-memory.dmp
memory/4532-0-0x0000000005260000-0x0000000005270000-memory.dmp
memory/4532-13-0x0000000006210000-0x0000000006564000-memory.dmp
memory/4532-4-0x0000000006120000-0x0000000006186000-memory.dmp
memory/4532-5-0x0000000006190000-0x00000000061F6000-memory.dmp
memory/4532-3-0x0000000005F80000-0x0000000005FA2000-memory.dmp
memory/4532-2-0x00000000058E0000-0x0000000005F08000-memory.dmp
memory/4532-1-0x0000000005270000-0x00000000052A6000-memory.dmp