85653065a3e7a86fb2bdc5e06c7a54808b24740b798089ca081ebd87bfceea93

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 01:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_9fbf2a2b5d2124146c57ed9640d3cf00_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
Size 4.9MB
Sample260716-b112csdy7w
SHA256 85653065a3e7a86fb2bdc5e06c7a54808b24740b798089ca081ebd87bfceea93
MD5 9fbf2a2b5d2124146c57ed9640d3cf00
SHA1 419efcb4cd496ab2e9676102035847b6a82b6118
SHA512 bd4417fe9c0da7f213f444f78eca04e092987b821ff6cf70d974f12f36ee4103435d59bc8a5d5965f602dcfa664ffe2c2e92ef1719d970203af3d2a80213cbe5
SSDEEP 49152:w/JLvVBMzvLYxRSpa8p/E41Q3BJ4aJC35NZpkFLLV/oTkW/9UUXhuQb5g+Sne3fn:w1Xr9CJxILLqTV/hVSoTRvQjdYFp
TLSH
T11A36AE07BDA108E9C49AE23189B69256BB74BC0C5B3233D72E50BB782F727D05D39B54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3416	2026-07-15_9fbf2a2b5d2124146c57ed9640d3cf00_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com
2	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3416 set thread context of 4800	3416	2026-07-15_9fbf2a2b5d2124146c57ed9640d3cf00_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	87

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3276	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3416	2026-07-15_9fbf2a2b5d2124146c57ed9640d3cf00_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3416	2026-07-15_9fbf2a2b5d2124146c57ed9640d3cf00_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3416	2026-07-15_9fbf2a2b5d2124146c57ed9640d3cf00_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3416	2026-07-15_9fbf2a2b5d2124146c57ed9640d3cf00_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4800	chrome.exe
4800	chrome.exe
3416	2026-07-15_9fbf2a2b5d2124146c57ed9640d3cf00_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3416	2026-07-15_9fbf2a2b5d2124146c57ed9640d3cf00_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3416	2026-07-15_9fbf2a2b5d2124146c57ed9640d3cf00_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
3416	2026-07-15_9fbf2a2b5d2124146c57ed9640d3cf00_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 4800	3416	2026-07-15_9fbf2a2b5d2124146c57ed9640d3cf00_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	87
PID 4800 wrote to memory of 3396	4800	chrome.exe	88
PID 4800 wrote to memory of 3276	4800	chrome.exe	89
PID 4800 wrote to memory of 3268	4800	chrome.exe	90
PID 4800 wrote to memory of 3268	4800	chrome.exe	90
PID 4800 wrote to memory of 5468	4800	chrome.exe	91
PID 4800 wrote to memory of 5468	4800	chrome.exe	91
PID 4800 wrote to memory of 2960	4800	chrome.exe	93
PID 4800 wrote to memory of 2960	4800	chrome.exe	93
PID 4800 wrote to memory of 3840	4800	chrome.exe	94
PID 4800 wrote to memory of 3840	4800	chrome.exe	94
PID 4800 wrote to memory of 1736	4800	chrome.exe	95
PID 4800 wrote to memory of 1736	4800	chrome.exe	95
PID 4800 wrote to memory of 5052	4800	chrome.exe	96
PID 4800 wrote to memory of 5052	4800	chrome.exe	96
PID 3416 wrote to memory of 4800	3416	2026-07-15_9fbf2a2b5d2124146c57ed9640d3cf00_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-15_9fbf2a2b5d2124146c57ed9640d3cf00_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_9fbf2a2b5d2124146c57ed9640d3cf00_coinminer_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff91a40c728,0x7ff91a40c734,0x7ff91a40c740
    3⤵
    PID:3396
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1496,i,11294987004710066581,4528632208045149355,524288 --field-trial-handle=2040,i,13428433294447698556,16809990133432463388,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3276
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,14546647952057117212,17047418441511245350,262144 --field-trial-handle=2040,i,13428433294447698556,16809990133432463388,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:2
    3⤵
    PID:3268
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,13438323494150417232,6186839715094487552,524288 --field-trial-handle=2040,i,13428433294447698556,16809990133432463388,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:13
    3⤵
    PID:5468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,6724646956367236840,12018769158006096172,2097152 --field-trial-handle=2040,i,13428433294447698556,16809990133432463388,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:2960
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,13670472073183589242,5456910521007201062,2097152 --field-trial-handle=2040,i,13428433294447698556,16809990133432463388,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:1
    3⤵
    PID:3840
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4672,i,2612347035931599896,15611419566440168783,2097152 --field-trial-handle=2040,i,13428433294447698556,16809990133432463388,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:1
    3⤵
    PID:1736
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4860,i,14755793714432503974,12734158702068627126,524288 --field-trial-handle=2040,i,13428433294447698556,16809990133432463388,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
    3⤵
    PID:5052

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1512

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1116

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 bdc52b5924478501f8fbee32f21af0bb5200425fd358be329e92fb619bab1ada
MD5 a636bc4e10ccfc4d67b101a68d9a9c93
SHA1 ebaf02f09dc5aa6bb0d9087b68d81d6343736b9e
SHA512 5a6f62206c98771874f13aa86d5b62ba6d1969560806dbc6fa1ab3e2532e58583a26fc2df0ddcec078fc8a3a2b8574cdec21fb3d75089cf6f06e1fb6f9cd76bd
SSDEEP 96:gC6Md+qKJku7fby2f2eaPphrn3RDotok5j3D7B6AGyvODqLG/bjv4a:gCjAJr7fbyVlFDUDvFkFqLG/bH
TLSH
T18BA10772B4664C3B59B6D448B6123E03CFA4B2AB7962ABA4DADD0F0C11EB4E80742117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autofill.txt

Path C:\Users\Admin\AppData\Local\Temp\browser\Chrome\autofill.txt
Size 23B
SHA256 dbf3feec622f728bf0ffe5e6b1bd9d4a6f28c5092b242cd8bc5b7db0fd97d750
MD5 8cba7e4568c1ea53495f22724d2d54fb
SHA1 c3fa4d453288763955972e01cdd64160b85904d1
SHA512 d9be144cdddaccba5022e06e6999574997f953e0d3f4dbc59f6722e2b32a2b669eb4b8dc793bd95f80594fd84084fed1905a235b2f05629d4cc8d80907bcb439
MD5 SHA1 SHA512

Submit Download

cards.txt

Path C:\Users\Admin\AppData\Local\Temp\browser\Chrome\cards.txt
Size 22B
SHA256 916fa313666e16a810e8c039fc17b500b81775f21ab2ce14d1d691aa21d44a00
MD5 b2c897773249749e363d2cec3d67ee0a
SHA1 5f5be90c5ad14ef2a68c1819ff2c8798d7addffb
SHA512 7812c27aaf6cf912d2511d50029e17ddc4b66880c89ce003427d187d9c23b1a17a83459f807aaf75313830800e5bd5cef3de128374fc5b94626641dbd13078c2
MD5 SHA1 SHA512

Submit Download

cookies.json

Path C:\Users\Admin\AppData\Local\Temp\browser\Chrome\cookies.json
Size 5B
SHA256 2ba33ca0557f1bb5b7ba88d67f9d0093c7185a36ec51fe2b7bd9372d3e001d6d
MD5 a00049ba79152d03380c34652f2cb612
SHA1 f69593cfcc6a1fbe47b403e08e047420af795491
SHA512 4aef440a8a2705fe70c1684e62e4134d998f6b4b99df64d6f8008190a7af922ea47cf693ac0219bb2a3e012127a6e58cc59269b76bae3d7cf986708d0d0e1b68
MD5 SHA1 SHA512

Submit Download

chrome_key.bin

Path C:\Users\Admin\AppData\Local\Temp\chrome_key.bin
Size 32B
SHA256 8994fdfaf36e4b24ca61e0adcb25a9bd3336bb392ccfd074c9dc9e03f4011935
MD5 851a5b1bfe38b93919d3a908eca227b3
SHA1 45e4d6274a5c51a666a28f137b9e1bda8c2e6390
SHA512 d8d69cba5a3bdedaec0a9bc9476c7ecff275244b4db0aae71636e63f981c89131153e73322fccd0a619e378d860160977d5848f787799809f58b579b27acaabc
MD5 SHA1 SHA512

Submit Download

plg11B9.tmp.dll

Path C:\Users\Admin\AppData\Local\Temp\plg11B9.tmp.dll
Size 802KB
SHA256 9312b84f358545338b8f97e0ac404c679dc9872e5a4abcaaedd4a122b0f6bd9e
MD5 f38fb85272a8aa53733995ff511b25a9
SHA1 71746063d53cbffa059494c0510f854786e6571a
SHA512 0e9d6385fbce4f6db1b8203135df3c57a9cd2ecb33e8537a9af953457bff4727d5ad36f4d45ecfdcb665e16010b7e3f621c3785c11ecd020bbcd1503ff309109
SSDEEP 24576:95KPFoBksvUur/HwoXrsWjjSZhsWdpb1SRuuqz8DyEb:rqULr/HwoXrsMmFM9s8We
TLSH
T13B05AD2CC9299224E329F4FCC41F2F51B1F57728AFB2D4AD520E0CE51B529E85BF4A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3416-0-0x0000000140000000-0x0000000140215000-memory.dmp

Download

memory/3416-5-0x0000000140000000-0x0000000140215000-memory.dmp

Download

memory/3416-4-0x0000000140000000-0x0000000140215000-memory.dmp

Download

memory/3416-3-0x0000000140000000-0x0000000140215000-memory.dmp

Download

memory/3416-83-0x0000000140000000-0x0000000140215000-memory.dmp

Download

memory/4800-39-0x000001D1D5300000-0x000001D1D5322000-memory.dmp

Download