Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
04/08/2026, 09:56
General
- Target 2026-08-03_bee436d1e757362e7d3914aa0250ce83_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
- Size 2.9MB
- Sample260804-lyhr4scm3x
- SHA256 1b3f9ec41ea9bb7f3d642bf2744934a54b1dcdc79bddf583d56b2a038dc26421
Malware Config
Signatures
- Checks system information in the registry 2 TTPs 1 IoCs
System information is often read in order to detect sandboxing environments.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_bee436d1e757362e7d3914aa0250ce83_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_bee436d1e757362e7d3914aa0250ce83_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe"1⤵
- Checks system information in the registry
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c timeout /nobreak /t 3 & fsutil file setZeroData offset=0 length=2995552 "C:\Users\Admin\AppData\Local\Temp\2026-08-03_bee436d1e757362e7d3914aa0250ce83_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe" & erase "C:\Users\Admin\AppData\Local\Temp\2026-08-03_bee436d1e757362e7d3914aa0250ce83_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe" & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /nobreak /t 33⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\fsutil.exefsutil file setZeroData offset=0 length=2995552 "C:\Users\Admin\AppData\Local\Temp\2026-08-03_bee436d1e757362e7d3914aa0250ce83_frostygoop_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3352-0-0x00007FFA54800000-0x00007FFA54A63000-memory.dmp
memory/3352-2-0x000001ACE7A30000-0x000001ACE7A31000-memory.dmp
memory/3352-7-0x000001ACEB780000-0x000001ACEB781000-memory.dmp
memory/3352-5-0x000001ACEB4E0000-0x000001ACEB4E1000-memory.dmp
memory/3352-8-0x0000000140000000-0x0000000140965000-memory.dmp
memory/3352-4-0x000001ACEB450000-0x000001ACEB451000-memory.dmp
memory/3352-6-0x000001ACEB770000-0x000001ACEB771000-memory.dmp
memory/3352-3-0x000001ACE9EE0000-0x000001ACE9EE1000-memory.dmp
memory/3352-1-0x000001ACE7150000-0x000001ACE7151000-memory.dmp
memory/3352-9-0x000001ACEC9C0000-0x000001ACEC9C1000-memory.dmp
memory/3352-10-0x0000000140000000-0x0000000140965000-memory.dmp
memory/3352-11-0x000001ACEC9D0000-0x000001ACEC9D1000-memory.dmp
memory/3352-12-0x000001ACEC9E0000-0x000001ACEC9E1000-memory.dmp
memory/3352-13-0x0000000140000000-0x0000000140965000-memory.dmp