f63c6700dfdbca563c741c862e159d2cadf669b386dc0cf7ee1aea57f10bf7d0

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/06/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-05_ae78d6cbdf6014353e2c68f8265a2604_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
Size 6.5MB
Sample260605-tkp82acs2p
SHA256 f63c6700dfdbca563c741c862e159d2cadf669b386dc0cf7ee1aea57f10bf7d0
MD5 ae78d6cbdf6014353e2c68f8265a2604
SHA1 8fc0b9fee63640681a766d90c905eefa48f7866a
SHA512 ab9807cec2caac5135a8ad016f91fcdcf6142b64f7f9fb162f60bc058213482145cdf37011da45a1352fabd290428b1995a765cf58ea708085c03b528b4d4d34
SSDEEP 49152:pAT2FAo5CotnR1R7Z2UO5K7chfTovUIqnPkd:p7bX7cJEcpMd
TLSH
T164665B07BC9109E9C0AAB3318DB66292BB75BC480B3623C72E91B7782E737D05D76754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery persistence spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4736 created 3272	4736	AutoIt3.exe	56

Downloads MZ/PE file 1 IoCs

flow	pid	Process
11	1116	2026-06-05_ae78d6cbdf6014353e2c68f8265a2604_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	2026-06-05_ae78d6cbdf6014353e2c68f8265a2604_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe

Executes dropped EXE 2 IoCs

pid	Process
1404	pOHerUq6gn5uGYGt2F0TTTZ6.exe
4736	AutoIt3.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	pOHerUq6gn5uGYGt2F0TTTZ6.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	api.myip.com
8	api.myip.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4736	AutoIt3.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoIt3.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5028	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4736	AutoIt3.exe
4736	AutoIt3.exe
4736	AutoIt3.exe
4736	AutoIt3.exe
4736	AutoIt3.exe
4736	AutoIt3.exe
4736	AutoIt3.exe
4736	AutoIt3.exe
4736	AutoIt3.exe
3616	chrome.exe
3616	chrome.exe
4736	AutoIt3.exe
4736	AutoIt3.exe
4736	AutoIt3.exe
4736	AutoIt3.exe
4736	AutoIt3.exe
4736	AutoIt3.exe
4736	AutoIt3.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4736	AutoIt3.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3616	chrome.exe
Token: SeCreatePagefilePrivilege	3616	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
4736	AutoIt3.exe
4736	AutoIt3.exe
4736	AutoIt3.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4736	AutoIt3.exe
4736	AutoIt3.exe
4736	AutoIt3.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 1404	1116	2026-06-05_ae78d6cbdf6014353e2c68f8265a2604_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe	91
PID 1404 wrote to memory of 4736	1404	pOHerUq6gn5uGYGt2F0TTTZ6.exe	92
PID 4736 wrote to memory of 3616	4736	AutoIt3.exe	109
PID 3616 wrote to memory of 2128	3616	chrome.exe	110
PID 3616 wrote to memory of 4856	3616	chrome.exe	111
PID 3616 wrote to memory of 5028	3616	chrome.exe	112
PID 3616 wrote to memory of 4856	3616	chrome.exe	111
PID 3616 wrote to memory of 3416	3616	chrome.exe	113
PID 3616 wrote to memory of 3416	3616	chrome.exe	113
PID 3616 wrote to memory of 3368	3616	chrome.exe	114
PID 3616 wrote to memory of 3368	3616	chrome.exe	114
PID 3616 wrote to memory of 1852	3616	chrome.exe	115
PID 3616 wrote to memory of 1852	3616	chrome.exe	115
PID 3616 wrote to memory of 4000	3616	chrome.exe	117
PID 3616 wrote to memory of 4000	3616	chrome.exe	117
PID 3616 wrote to memory of 3928	3616	chrome.exe	118
PID 3616 wrote to memory of 3928	3616	chrome.exe	118

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3272
- C:\Users\Admin\AppData\Local\Temp\2026-06-05_ae78d6cbdf6014353e2c68f8265a2604_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-06-05_ae78d6cbdf6014353e2c68f8265a2604_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe"
  2⤵
  - Downloads MZ/PE file
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Users\Admin\Documents\Screenshot album\pOHerUq6gn5uGYGt2F0TTTZ6.exe
    "C:\Users\Admin\Documents\Screenshot album\pOHerUq6gn5uGYGt2F0TTTZ6.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1404
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Reload.a3x
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --new-window
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3616
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff84821c728,0x7ff84821c734,0x7ff84821c740
    3⤵
    PID:2128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,15691109050501697212,11167672364603861984,262144 --field-trial-handle=1980,i,16904770638638824670,13495855021054316613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1976 /prefetch:2
    3⤵
    PID:4856
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1588,i,8392684279652515481,13657825926750504155,524288 --field-trial-handle=1980,i,16904770638638824670,13495855021054316613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2196 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,5748933954530759807,14489471254990447086,524288 --field-trial-handle=1980,i,16904770638638824670,13495855021054316613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2568 /prefetch:8
    3⤵
    PID:3416
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3184,i,9460206911272375013,3413996970424710146,2097152 --field-trial-handle=1980,i,16904770638638824670,13495855021054316613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:1
    3⤵
    PID:3368
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3188,i,13758343676923432165,8244876652751996241,2097152 --field-trial-handle=1980,i,16904770638638824670,13495855021054316613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:1852
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4216,i,479187040419986472,18006742128668912127,2097152 --field-trial-handle=1980,i,16904770638638824670,13495855021054316613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4188 /prefetch:2
    3⤵
    PID:4000
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3168,i,14271118782137037750,11185157160782727242,2097152 --field-trial-handle=1980,i,16904770638638824670,13495855021054316613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4504 /prefetch:1
    3⤵
    PID:3928

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 4011e8a3988454df960119fa9b538f2aea6ad9680905e757c73214a3f7b52680
MD5 e5295ddd734b17a8801db9eaf20e7127
SHA1 78a21eec22b6504dc6f15cb3fed518af7576e947
SHA512 d0595da97439c25d80fc28032cedde43e0af3b8767a96cc168c7e7bdecc3dfee9c85583b45a428dc2fe73058d2e98d6cbe38bdde114cc7ede46ae84cbf03e83b
SSDEEP 3072:SbFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:OFmUi21rSm8uUVNSlzY/
TLSH
T1E6C31300BAE3E9F2FE5930447BEE2A145D6C0D818291C6415273AD419DEF3C75FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reload.a3x

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Reload.a3x
Size 1.2MB
SHA256 6cc8223987f1fc38c128a0a27b2e9dfb5d53a9937839b34221b3e3adf20d51d8
MD5 092c617c4d3ebabec17af1b3c81c48dd
SHA1 ae145d30ada80acfe3847b2657ff5a77a4ca69a4
SHA512 7bd3c9d2c2bbf7be3456b4f5fc1886cc9ca2860a0feb1760e0718137abc2908f8136a8bacea0846dbe709467f1c7371b8250d38d7d4bd6f413c8ac421a847297
SSDEEP 24576:oF8caBJtxFIc5xkQOfs0Q8VwZVAfBYBTG077ZPkFHpPuzRDMVUHZbYBcQY:oFyJqcFTDfPAfSTGvpPwRwVxY
TLSH
T13345339B940E62F3626BB776B3C1986B21BB711700ADFEE43074DFDDA620C176111C6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pOHerUq6gn5uGYGt2F0TTTZ6.exe

Path C:\Users\Admin\Documents\Screenshot album\pOHerUq6gn5uGYGt2F0TTTZ6.exe
Size 2.2MB
SHA256 04fae87ad99118b414439853eb0950d62a0b37bb7ef62c9bfe40fbe70c5dc00e
MD5 b8aa3afaa82d3475f95bd5e6408f5ba2
SHA1 09cb3b39bd1bc0b2e224d18728594cfae3d0c3b0
SHA512 a14cc32c19c2f8d5805cef16a91f10438c21b5649ddee3f7709441da6102ab322d19ba129b130a73f2840f37445b96664991ea229a1e4c2d68e036c74dfbbba6
SSDEEP 49152:YjQX6kX6tF+TYcJIyfK5f3uGJp2WX9evPSJlPUOYwUaEd:FqkqiccJXef3ump9XAvPSPUp
TLSH
T18EB5020B3AC91662D42FA37170B2033F2333F93816665AAB6197F6D8DE637D33512649
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1116-18-0x00007FF866010000-0x00007FF866205000-memory.dmp

Download

memory/1116-0-0x00007FF866010000-0x00007FF866205000-memory.dmp

Download

memory/4736-26-0x00000000053B0000-0x000000000547C000-memory.dmp

Download

memory/4736-20-0x00000000053B0000-0x000000000547C000-memory.dmp

Download

memory/4736-19-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/4736-56-0x00000000053B0000-0x000000000547C000-memory.dmp

Download

memory/4736-57-0x00000000053B0000-0x000000000547C000-memory.dmp

Download

memory/4736-58-0x00000000053B0000-0x000000000547C000-memory.dmp

Download

memory/4736-59-0x00000000053B0000-0x000000000547C000-memory.dmp

Download

memory/4736-60-0x00000000053B0000-0x000000000547C000-memory.dmp

Download

memory/4736-62-0x00000000053B0000-0x000000000547C000-memory.dmp

Download

memory/4736-61-0x00000000053B0000-0x000000000547C000-memory.dmp

Download

memory/4736-63-0x0000000000080000-0x0000000000173000-memory.dmp

Download