Analysis
- max time kernel
150s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 22:06
General
- Target 2026-08-04_edc252e38012ae3cf1c4c477f3ef1bba_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
- Size 4.3MB
- Sample260804-1z91bahf35
- SHA256 ff201194afa61aeed0d6a1c64e120a49566c5bb7599ecf5974e4a0e51d6b95eb
Malware Config
Signatures
- Checks system information in the registry 2 TTPs 1 IoCs
System information is often read in order to detect sandboxing environments.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_edc252e38012ae3cf1c4c477f3ef1bba_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_edc252e38012ae3cf1c4c477f3ef1bba_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"1⤵
- Checks system information in the registry
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c timeout /nobreak /t 3 & fsutil file setZeroData offset=0 length=4548432 "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edc252e38012ae3cf1c4c477f3ef1bba_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe" & erase "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edc252e38012ae3cf1c4c477f3ef1bba_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe" & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /nobreak /t 33⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\fsutil.exefsutil file setZeroData offset=0 length=4548432 "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edc252e38012ae3cf1c4c477f3ef1bba_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4544-7-0x0000029B41170000-0x0000029B41171000-memory.dmp
memory/4544-6-0x0000029B41160000-0x0000029B41161000-memory.dmp
memory/4544-5-0x0000029B40ED0000-0x0000029B40ED1000-memory.dmp
memory/4544-0-0x00007FFAEEA60000-0x00007FFAEECC3000-memory.dmp
memory/4544-3-0x0000029B40020000-0x0000029B40021000-memory.dmp
memory/4544-4-0x0000029B40E40000-0x0000029B40E41000-memory.dmp
memory/4544-2-0x0000029B7D410000-0x0000029B7D411000-memory.dmp
memory/4544-1-0x0000029B7CB30000-0x0000029B7CB31000-memory.dmp
memory/4544-8-0x0000000140000000-0x0000000140966000-memory.dmp
memory/4544-9-0x0000029B423B0000-0x0000029B423B1000-memory.dmp
memory/4544-10-0x0000000140000000-0x0000000140966000-memory.dmp
memory/4544-11-0x0000029B423C0000-0x0000029B423C1000-memory.dmp
memory/4544-12-0x0000029B423D0000-0x0000029B423D1000-memory.dmp
memory/4544-13-0x0000000140000000-0x0000000140966000-memory.dmp