Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
29/05/2026, 15:47
General
- Target 2026-05-29_1ed95a06c8079f7dcec191521083e622_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
- Size 3.1MB
- Sample260529-s8elrshw4j
- SHA256 e0ad30d3587be86f17733492d4b774601356ff5b5e09c17f536704a4ced88f9e
Malware Config
Signatures
- Family: CastleRAT
CastleRAT is a trojan available in both Python and C variants.
- Detects C variant of CastleRAT. 26 IoCs
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 26 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 26 IoCs
- Downloads MZ/PE file 1 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 14 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-29_1ed95a06c8079f7dcec191521083e622_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-29_1ed95a06c8079f7dcec191521083e622_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe"1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\Screenshot album\vhxU4H2wDLxG6PuE0Q9RKrrD.exe"C:\Users\Admin\Documents\Screenshot album\vhxU4H2wDLxG6PuE0Q9RKrrD.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\hPF664Nop9\pythonw.exe"C:\ProgramData\hPF664Nop9\pythonw.exe" "C:\ProgramData\hPF664Nop9\install.pyc"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\hPF664Nop9\pythonw.exe"C:\ProgramData\hPF664Nop9\pythonw.exe" "C:\ProgramData\hPF664Nop9\install.pyc"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\ProgramData\hPF664Nop9\pythonw.exeC:\ProgramData\hPF664Nop9\pythonw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
_ctypes.pyd
install.pyc
libffi-8.dll
python3.dll
python313._pth
python313.dll
python313.zip
pythonw.exe
vcruntime140.dll
veQcBTuTnPwMD.Ar
__PSScriptPolicyTest_i25qxahw.0ae.ps1
vhxU4H2wDLxG6PuE0Q9RKrrD.exe
memory/1696-22-0x0000000140000000-0x0000000140095000-memory.dmp
memory/1696-0-0x0000000140000000-0x0000000140095000-memory.dmp
memory/2020-156-0x00000129EC030000-0x00000129EC1D2000-memory.dmp
memory/2020-195-0x00000129EC030000-0x00000129EC1D2000-memory.dmp
memory/2020-221-0x00000129EC030000-0x00000129EC1D2000-memory.dmp
memory/2020-210-0x00000129EC030000-0x00000129EC1D2000-memory.dmp
memory/2020-209-0x00000129EC030000-0x00000129EC1D2000-memory.dmp
memory/2020-200-0x00000129EC030000-0x00000129EC1D2000-memory.dmp
memory/2020-199-0x00000129EC030000-0x00000129EC1D2000-memory.dmp
memory/2020-201-0x00000129EC030000-0x00000129EC1D2000-memory.dmp
memory/2020-202-0x00000129EC030000-0x00000129EC1D2000-memory.dmp
memory/2020-203-0x00000129EC030000-0x00000129EC1D2000-memory.dmp
memory/2020-204-0x00000129EC030000-0x00000129EC1D2000-memory.dmp
memory/2020-205-0x00000129EC030000-0x00000129EC1D2000-memory.dmp
memory/2020-206-0x00000129EC030000-0x00000129EC1D2000-memory.dmp
memory/2020-207-0x00000129EC030000-0x00000129EC1D2000-memory.dmp
memory/2020-198-0x00000129EC030000-0x00000129EC1D2000-memory.dmp
memory/2020-197-0x00000129EC030000-0x00000129EC1D2000-memory.dmp
memory/2020-155-0x00000129EC030000-0x00000129EC1D2000-memory.dmp
memory/2020-196-0x00000129EC030000-0x00000129EC1D2000-memory.dmp
memory/2020-159-0x00000129EC030000-0x00000129EC1D2000-memory.dmp
memory/2020-158-0x00000129EC030000-0x00000129EC1D2000-memory.dmp
memory/2020-157-0x00000129EC030000-0x00000129EC1D2000-memory.dmp
memory/3060-179-0x000002593EEF0000-0x000002593EFA5000-memory.dmp
memory/3060-167-0x000002593EB60000-0x000002593EBA4000-memory.dmp
memory/3060-168-0x000002593EE70000-0x000002593EEE6000-memory.dmp
memory/3060-180-0x000002593EE50000-0x000002593EE6C000-memory.dmp
memory/3060-188-0x000002593EBC0000-0x000002593EBCA000-memory.dmp
memory/3060-189-0x000002593EE50000-0x000002593EE6A000-memory.dmp
memory/3060-190-0x000002593EBD0000-0x000002593EBD8000-memory.dmp
memory/3060-191-0x000002593EE30000-0x000002593EE36000-memory.dmp
memory/3060-192-0x000002593EE40000-0x000002593EE4A000-memory.dmp
memory/3840-24-0x00007FF40B6A0000-0x00007FF40B6B0000-memory.dmp
memory/3840-37-0x000000001E3F0000-0x000000001E3FA000-memory.dmp
memory/3840-36-0x000000001E400000-0x000000001E412000-memory.dmp
memory/3840-35-0x00000000029A0000-0x00000000029B0000-memory.dmp
memory/3840-12-0x0000000000820000-0x000000000082C000-memory.dmp
memory/3840-34-0x000000001E4D0000-0x000000001E4DA000-memory.dmp
memory/3840-33-0x000000001E410000-0x000000001E4C5000-memory.dmp
memory/3840-32-0x000000001E3F0000-0x000000001E40C000-memory.dmp
memory/3840-20-0x00000000029A0000-0x00000000029B0000-memory.dmp
memory/3840-21-0x00000000029C0000-0x00000000029E2000-memory.dmp
memory/4216-145-0x0000024131980000-0x0000024131B22000-memory.dmp
memory/4216-142-0x0000024131980000-0x0000024131B22000-memory.dmp
memory/4216-141-0x0000024130B20000-0x0000024130B21000-memory.dmp
memory/4216-144-0x0000024131980000-0x0000024131B22000-memory.dmp
memory/4216-143-0x0000024131980000-0x0000024131B22000-memory.dmp
memory/4216-146-0x0000024131980000-0x0000024131B22000-memory.dmp