1605345b3b91920b903321f524f018cfa93f48af1808c3ab216214c4cdc9278a

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 17:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_85d78dfd6ff0c82c4c979ce663ddcafa_elex_frostygoop_ghostlocker_glassworm_hive_salatstealer_sliver.exe
Size 4.4MB
Sample260722-v4benazgrc
SHA256 1605345b3b91920b903321f524f018cfa93f48af1808c3ab216214c4cdc9278a
MD5 85d78dfd6ff0c82c4c979ce663ddcafa
SHA1 49464ceaedc7096e97bfb8f635ce2dc2c7070a8e
SHA512 a9e628d4c072bd05d9f65978ff347c29e36c078634c8cae63d4de9d675b2c133d7d4ebfbe422105a7dec3241434aa153a9dae07b7c8d4062fc7c661cdf00dd3f
SSDEEP 49152:/U2NLTKNGGTrmjIFV8apVcgx4l4W+wmzR4m7s8AyVc1G7CoiEMQ/lFTjN4:/N3eW08aLx4yzwmzqg1V6o9vLm
TLSH
T195268B11FDCB44B6E943263188EB636F27385D054B26DB87EA447A7EEC372D62832345
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_85d78dfd6ff0c82c4c979ce663ddcafa_elex_frostygoop_ghostlocker_glassworm_hive_salatstealer_sliver.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-22_85d78dfd6ff0c82c4c979ce663ddcafa_elex_frostygoop_ghostlocker_glassworm_hive_salatstealer_sliver.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_85d78dfd6ff0c82c4c979ce663ddcafa_elex_frostygoop_ghostlocker_glassworm_hive_salatstealer_sliver.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3280-0-0x0000000000400000-0x0000000000894000-memory.dmp

Download

memory/3280-1-0x0000000000400000-0x0000000000894000-memory.dmp