Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
23/09/2026, 00:05
General
- Target 2026-09-22_a13bcc56c8037a92e6ed2fd78c5f2417_coinminer_dosia_elex_frostygoop_glassworm_hive_http-brow.exe
- Size 13.7MB
- Sample260923-ac7cssvbjf
- SHA256 617739f264479ff970bd61c77cade4750fa49ecb82f1104c91c5a6bce197426b
Malware Config
Signatures
- Family: Defendnot
Defendnot is a tool designed to disable Microsoft Defender.
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 11 IoCs
- Detects Defendnot 1 IoCs
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 11 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 11 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 11 IoCs
- UPX dump on OEP (original entry point) 13 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 2 IoCs
- UPX packed file 13 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 5 IoCs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-22_a13bcc56c8037a92e6ed2fd78c5f2417_coinminer_dosia_elex_frostygoop_glassworm_hive_http-brow.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-22_a13bcc56c8037a92e6ed2fd78c5f2417_coinminer_dosia_elex_frostygoop_glassworm_hive_http-brow.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Microsoft2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath C:\Windows2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\ZKvtKfe9\defendnot-loader.exeC:\Windows\ZKvtKfe9\defendnot-loader.exe --silent2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c pause3⤵
- Executes a command shell one-liner
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command C:\Users\Admin\AppData\Local\Temp\dn-2913659309.ps12⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Microsoft\updater_lJgXYtHA.exeC:\Users\Admin\AppData\Local\Microsoft\updater_lJgXYtHA.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
updater_lJgXYtHA.exe
__PSScriptPolicyTest_n1yjcqzn.bfc.ps1
dn-2913659309.ps1
defendnot-loader.exe
memory/1284-89-0x0000000000480000-0x00000000010D5000-memory.dmp
memory/1284-99-0x0000000000480000-0x00000000010D5000-memory.dmp
memory/1284-92-0x0000000000480000-0x00000000010D5000-memory.dmp
memory/1284-91-0x0000000000480000-0x00000000010D5000-memory.dmp
memory/1284-90-0x0000000000480000-0x00000000010D5000-memory.dmp
memory/1284-94-0x0000000000480000-0x00000000010D5000-memory.dmp
memory/1284-88-0x0000000000480000-0x00000000010D5000-memory.dmp
memory/1284-95-0x0000000000480000-0x00000000010D5000-memory.dmp
memory/1284-97-0x0000000000480000-0x00000000010D5000-memory.dmp
memory/1284-93-0x0000000000480000-0x00000000010D5000-memory.dmp
memory/1284-100-0x0000000000480000-0x00000000010D5000-memory.dmp
memory/1284-101-0x0000000000480000-0x00000000010D5000-memory.dmp
memory/3772-63-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3772-54-0x00000000708A0000-0x00000000708EC000-memory.dmp
memory/3772-62-0x000000007EEC0000-0x000000007EED0000-memory.dmp
memory/3772-45-0x00000000059C0000-0x0000000005D14000-memory.dmp
memory/3772-43-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/3772-44-0x0000000002A90000-0x0000000002AA0000-memory.dmp
memory/6120-18-0x0000000006F10000-0x0000000006F42000-memory.dmp
memory/6120-29-0x0000000006F50000-0x0000000006F6E000-memory.dmp
memory/6120-38-0x0000000007FD0000-0x0000000007FEA000-memory.dmp
memory/6120-37-0x0000000007EC0000-0x0000000007ED4000-memory.dmp
memory/6120-36-0x0000000007EB0000-0x0000000007EBE000-memory.dmp
memory/6120-35-0x0000000007E80000-0x0000000007E91000-memory.dmp
memory/6120-34-0x0000000007F10000-0x0000000007FA6000-memory.dmp
memory/6120-33-0x0000000007CE0000-0x0000000007CEA000-memory.dmp
memory/6120-32-0x0000000007C80000-0x0000000007C9A000-memory.dmp
memory/6120-31-0x00000000082C0000-0x000000000893A000-memory.dmp
memory/6120-30-0x0000000006F80000-0x0000000007023000-memory.dmp
memory/6120-19-0x00000000708A0000-0x00000000708EC000-memory.dmp
memory/6120-27-0x00000000054F0000-0x0000000005500000-memory.dmp
memory/6120-39-0x0000000007F00000-0x0000000007F08000-memory.dmp
memory/6120-28-0x00000000054F0000-0x0000000005500000-memory.dmp
memory/6120-0-0x00000000054F0000-0x0000000005500000-memory.dmp
memory/6120-17-0x000000007F760000-0x000000007F770000-memory.dmp
memory/6120-16-0x0000000006980000-0x00000000069CC000-memory.dmp
memory/6120-15-0x0000000006950000-0x000000000696E000-memory.dmp
memory/6120-14-0x0000000006350000-0x00000000066A4000-memory.dmp
memory/6120-6-0x0000000006160000-0x00000000061C6000-memory.dmp
memory/6120-5-0x0000000005A20000-0x0000000005A86000-memory.dmp
memory/6120-4-0x0000000005980000-0x00000000059A2000-memory.dmp
memory/6120-3-0x0000000005B30000-0x0000000006158000-memory.dmp
memory/6120-2-0x00000000054F0000-0x0000000005500000-memory.dmp
memory/6120-1-0x0000000003370000-0x00000000033A6000-memory.dmp