Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
22/09/2026, 04:38
General
- Target 2026-09-21_08d4c0ca2c61a1b73a59f8c178bd10dd_coinminer_dosia_elex_frostygoop_glassworm_hive_http-brow.exe
- Size 13.6MB
- Sample260922-e9e22avxb1
- SHA256 b96c98325b61ef08ee846b1f825c16fcf93541a3de4130bdc9d701e5265bc4f6
Malware Config
Signatures
- Family: Defendnot
Defendnot is a tool designed to disable Microsoft Defender.
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 11 IoCs
- Detects Defendnot 1 IoCs
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 11 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 11 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 11 IoCs
- UPX dump on OEP (original entry point) 13 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 2 IoCs
- UPX packed file 13 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 5 IoCs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-21_08d4c0ca2c61a1b73a59f8c178bd10dd_coinminer_dosia_elex_frostygoop_glassworm_hive_http-brow.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-21_08d4c0ca2c61a1b73a59f8c178bd10dd_coinminer_dosia_elex_frostygoop_glassworm_hive_http-brow.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Microsoft2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath C:\Windows2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TKwEmE43\defendnot-loader.exeC:\Windows\TKwEmE43\defendnot-loader.exe --silent2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c pause3⤵
- Executes a command shell one-liner
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command C:\Users\Admin\AppData\Local\Temp\dn-2454834995.ps12⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Microsoft\updater_RgdWolYJ.exeC:\Users\Admin\AppData\Local\Microsoft\updater_RgdWolYJ.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
updater_RgdWolYJ.exe
__PSScriptPolicyTest_4pk1suxq.ueu.ps1
dn-2454834995.ps1
defendnot-loader.exe
memory/3128-19-0x00000000705D0000-0x000000007061C000-memory.dmp
memory/3128-5-0x0000000005A30000-0x0000000005A96000-memory.dmp
memory/3128-15-0x0000000006830000-0x000000000684E000-memory.dmp
memory/3128-16-0x00000000068C0000-0x000000000690C000-memory.dmp
memory/3128-17-0x000000007F1E0000-0x000000007F1F0000-memory.dmp
memory/3128-18-0x0000000006DF0000-0x0000000006E22000-memory.dmp
memory/3128-0-0x0000000002FC0000-0x0000000002FD0000-memory.dmp
memory/3128-27-0x0000000002FC0000-0x0000000002FD0000-memory.dmp
memory/3128-28-0x0000000006DD0000-0x0000000006DEE000-memory.dmp
memory/3128-29-0x0000000007A00000-0x0000000007AA3000-memory.dmp
memory/3128-30-0x00000000081A0000-0x000000000881A000-memory.dmp
memory/3128-31-0x0000000007B50000-0x0000000007B6A000-memory.dmp
memory/3128-32-0x0000000007BB0000-0x0000000007BBA000-memory.dmp
memory/3128-33-0x0000000007DE0000-0x0000000007E76000-memory.dmp
memory/3128-34-0x0000000007D50000-0x0000000007D61000-memory.dmp
memory/3128-35-0x0000000007D80000-0x0000000007D8E000-memory.dmp
memory/3128-36-0x0000000007D90000-0x0000000007DA4000-memory.dmp
memory/3128-37-0x0000000007EA0000-0x0000000007EBA000-memory.dmp
memory/3128-38-0x0000000007DD0000-0x0000000007DD8000-memory.dmp
memory/3128-1-0x0000000002F00000-0x0000000002F36000-memory.dmp
memory/3128-6-0x0000000006120000-0x0000000006186000-memory.dmp
memory/3128-2-0x0000000002FC0000-0x0000000002FD0000-memory.dmp
memory/3128-3-0x0000000005AF0000-0x0000000006118000-memory.dmp
memory/3128-12-0x0000000006210000-0x0000000006564000-memory.dmp
memory/3128-4-0x0000000005990000-0x00000000059B2000-memory.dmp
memory/5284-96-0x00000000006E0000-0x0000000001337000-memory.dmp
memory/5284-91-0x00000000006E0000-0x0000000001337000-memory.dmp
memory/5284-102-0x00000000006E0000-0x0000000001337000-memory.dmp
memory/5284-101-0x00000000006E0000-0x0000000001337000-memory.dmp
memory/5284-100-0x00000000006E0000-0x0000000001337000-memory.dmp
memory/5284-89-0x00000000006E0000-0x0000000001337000-memory.dmp
memory/5284-98-0x00000000006E0000-0x0000000001337000-memory.dmp
memory/5284-95-0x00000000006E0000-0x0000000001337000-memory.dmp
memory/5284-90-0x00000000006E0000-0x0000000001337000-memory.dmp
memory/5284-94-0x00000000006E0000-0x0000000001337000-memory.dmp
memory/5284-93-0x00000000006E0000-0x0000000001337000-memory.dmp
memory/5284-92-0x00000000006E0000-0x0000000001337000-memory.dmp
memory/5600-51-0x0000000005AF0000-0x0000000005E44000-memory.dmp
memory/5600-62-0x0000000002940000-0x0000000002950000-memory.dmp
memory/5600-42-0x0000000002940000-0x0000000002950000-memory.dmp
memory/5600-63-0x0000000002940000-0x0000000002950000-memory.dmp
memory/5600-43-0x0000000002940000-0x0000000002950000-memory.dmp
memory/5600-53-0x00000000705D0000-0x000000007061C000-memory.dmp
memory/5600-61-0x000000007EE90000-0x000000007EEA0000-memory.dmp
memory/5928-81-0x0000000005780000-0x0000000005AD4000-memory.dmp