Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/08/2026, 09:56
General
- Target 2026-08-03_bee436d1e757362e7d3914aa0250ce83_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
- Size 2.9MB
- Sample260804-lyhr4scm3x
- SHA256 1b3f9ec41ea9bb7f3d642bf2744934a54b1dcdc79bddf583d56b2a038dc26421
Malware Config
Signatures
- Checks system information in the registry 2 TTPs 1 IoCs
System information is often read in order to detect sandboxing environments.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_bee436d1e757362e7d3914aa0250ce83_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_bee436d1e757362e7d3914aa0250ce83_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe"1⤵
- Checks system information in the registry
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c timeout /nobreak /t 3 & fsutil file setZeroData offset=0 length=2995552 "C:\Users\Admin\AppData\Local\Temp\2026-08-03_bee436d1e757362e7d3914aa0250ce83_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe" & erase "C:\Users\Admin\AppData\Local\Temp\2026-08-03_bee436d1e757362e7d3914aa0250ce83_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe" & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /nobreak /t 33⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\fsutil.exefsutil file setZeroData offset=0 length=2995552 "C:\Users\Admin\AppData\Local\Temp\2026-08-03_bee436d1e757362e7d3914aa0250ce83_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3864-1-0x0000000140000000-0x0000000140965000-memory.dmp
memory/3864-0-0x00007FFCD4650000-0x00007FFCD4845000-memory.dmp
memory/3864-3-0x000001B5E1F70000-0x000001B5E1F71000-memory.dmp
memory/3864-2-0x000001B5E1690000-0x000001B5E1691000-memory.dmp
memory/3864-5-0x000001B5E59A0000-0x000001B5E59A1000-memory.dmp
memory/3864-4-0x000001B5E4440000-0x000001B5E4441000-memory.dmp
memory/3864-8-0x000001B5E5CD0000-0x000001B5E5CD1000-memory.dmp
memory/3864-7-0x000001B5E5CC0000-0x000001B5E5CC1000-memory.dmp
memory/3864-6-0x000001B5E5A30000-0x000001B5E5A31000-memory.dmp
memory/3864-9-0x000001B5E6850000-0x000001B5E6851000-memory.dmp
memory/3864-10-0x0000000140000000-0x0000000140965000-memory.dmp
memory/3864-12-0x000001B5E6870000-0x000001B5E6871000-memory.dmp
memory/3864-11-0x000001B5E6860000-0x000001B5E6861000-memory.dmp
memory/3864-13-0x0000000140000000-0x0000000140965000-memory.dmp