Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
09/07/2026, 16:28
General
- Target 2026-07-09_cbfcf1d7909ad850d965fbf870066b00_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
- Size 3.0MB
- Sample260709-tyrn1set8w
- SHA256 706a7162b440037e8ac2e6cdf862c1c4ee90b3aef6e0adb778a6cffe3a798188
Malware Config
Signatures
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_cbfcf1d7909ad850d965fbf870066b00_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_cbfcf1d7909ad850d965fbf870066b00_coinminer_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ef6ecedb
memory/2288-0-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-1-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-4-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-5-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-6-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-7-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-8-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-9-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-10-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-11-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-12-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-13-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-14-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-15-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-16-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-17-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-18-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-19-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-42-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-31-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-49-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-67-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-76-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-74-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-82-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-79-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-83-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-84-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-78-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-85-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-73-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-70-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-54-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-53-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-52-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-51-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-50-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-87-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-88-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-89-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-90-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-91-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-92-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-93-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-94-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-95-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-96-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-98-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-97-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-99-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-100-0x0000000410000000-0x000000041021A000-memory.dmp
memory/2288-101-0x0000000410000000-0x000000041021A000-memory.dmp