Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
07/08/2026, 10:09
General
- Target 2026-08-07_6a8122211cc6db812e09aef56f5fe8a9_elex_frostygoop_hive_salatstealer_sliver.exe
- Size 2.9MB
- Sample260807-l665nsseqc
- SHA256 582f087cbd3706b9ecb6e5bdcc1b38e409c05a5dbbf759e811833e0f85069829
Malware Config
Signatures
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of FindShellTrayWindow 34 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_6a8122211cc6db812e09aef56f5fe8a9_elex_frostygoop_hive_salatstealer_sliver.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_6a8122211cc6db812e09aef56f5fe8a9_elex_frostygoop_hive_salatstealer_sliver.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" trenadne.cyou/api/set_agent?id=1978C743BD24956701AEC7B30ADF174C&token=d996eefc53a7148b563678fe61fb01457d2df308e2ba6f&description=&agent=Chrome2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffe1d88c728,0x7ffe1d88c734,0x7ffe1d88c7403⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,12468045313123547198,8900781271798701918,262144 --field-trial-handle=1948,i,16417427400891611843,17401728495462936669,262144 --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2092,i,13944110440661506642,9204724732563998447,524288 --field-trial-handle=1948,i,16417427400891611843,17401728495462936669,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,14134732451241080430,10628119962839835575,524288 --field-trial-handle=1948,i,16417427400891611843,17401728495462936669,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:133⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3100,i,17718994516818793845,5913397909915513293,2097152 --field-trial-handle=1948,i,16417427400891611843,17401728495462936669,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3092,i,10816549490437514953,4327711976187613997,2097152 --field-trial-handle=1948,i,16417427400891611843,17401728495462936669,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4568,i,749726288145833251,2702561884118905845,524288 --field-trial-handle=1948,i,16417427400891611843,17401728495462936669,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4604,i,8145771761934106525,10491017201323295902,524288 --field-trial-handle=1948,i,16417427400891611843,17401728495462936669,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:123⤵
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
SCT Auditing Pending Reports
Last Version
Local State
memory/5112-0-0x0000000000400000-0x0000000000461000-memory.dmp
memory/5112-27-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-83-0x0000000000400000-0x0000000000461000-memory.dmp
memory/5112-82-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-81-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-80-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-79-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-78-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-77-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-76-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-75-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-74-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-73-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-72-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-71-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-70-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-69-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-68-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-67-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-66-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-65-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-64-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-63-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-62-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-61-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-60-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-59-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-58-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-57-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-56-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-55-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-54-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-53-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-52-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-51-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-50-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-49-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-48-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-47-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-46-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-45-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-44-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-43-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-42-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-41-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-40-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-39-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-38-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-37-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-36-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-35-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-34-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-33-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-32-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-31-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-30-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-28-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-29-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-26-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-99-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-98-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-127-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-132-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-131-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-130-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-129-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-128-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-124-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-126-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-125-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-121-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-119-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-118-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-116-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-115-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-114-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-113-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-112-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-111-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-110-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-109-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-107-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-105-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-104-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-103-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-102-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-100-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-123-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-120-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-122-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-117-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-108-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-106-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-101-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-96-0x00000000237F0000-0x00000000237F1000-memory.dmp
memory/5112-97-0x00000000237F0000-0x00000000237F1000-memory.dmp