b7f156cb177147263c3afa6f793798965454ab8f0556e5afc6421b4c91c3fd72

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 10:37

Target
2026-08-10_40cea3a078902dfbbea10c408aae0b77_frostygoop_ghostlocker_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
Size 15.4MB
Sample260810-mntx3axalg
SHA256 b7f156cb177147263c3afa6f793798965454ab8f0556e5afc6421b4c91c3fd72
MD5 40cea3a078902dfbbea10c408aae0b77
SHA1 7e8c8d30e649c6bf80f1a08ba386e72be3bd2244
SHA512 4ac635f6e560cbd7cf2a35927e1b82ff33a91dc7cb6d92aaeacc6010fed687ed663b2a3f023749f5aa156ab4eec1589904a90d4c14a118b977825e5ac868f3f8
SSDEEP 196608:7cZg6DCP7jl3xpJiWn9ePFcFdokPiqqCBheyCWK3UJqflNlnN6Zt3orBJ:7ug6QN3ZLUckqqCteflNatYf
TLSH
T1E5F6DF43E9A305DAC8ADD631CDA652137A707C490B7263DB2B50B3383EB7BD15A7A704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5112	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5112	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2728	2026-08-10_40cea3a078902dfbbea10c408aae0b77_frostygoop_ghostlocker_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
2728	2026-08-10_40cea3a078902dfbbea10c408aae0b77_frostygoop_ghostlocker_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-10_40cea3a078902dfbbea10c408aae0b77_frostygoop_ghostlocker_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_40cea3a078902dfbbea10c408aae0b77_frostygoop_ghostlocker_hive_knight_luca-stealer_salatstealer_sliver_snatch.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2728

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004E0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5112