Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/08/2026, 02:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target 2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
- Size 2.6MB
- Sample260812-cs95qsaa69
- SHA256 39f366b6e4850cc9b64ff60e643c7c8b4c7df4e4a8f9a601fa829ae1d9861371
- MD5 e790e17222b7861785fdd90e72bcb7dc
- SHA1 cc4059643fd978e38a9b06a95a8bd98f16ef5011
- SHA512 6e0613549ce54d92dcd9fc3545ac41117cf372e664f3fa475fc4ae8b6e94adc4f0207c1cb0d853760939ff171baae5a7d025dac09202e9ac2cf075ebca8b8d75
- SSDEEP 49152:HtkxF4vLBs63+reo7zDbkz9BNKxmZ/+y2:Hek3TfwY/+y2
- TLSH T168D55A077E9044E5D0AAE33689A646557B74BC0C8B3133E72EA0BE782F727D19E35B44
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 25 IoCs
resource yara_rule behavioral1/memory/4104-0-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/4104-1-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/4104-3-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/4104-4-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/4104-5-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/4104-6-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/4104-8-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/4104-10-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/4104-20-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/4104-33-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/4104-37-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/4104-40-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/4104-43-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/4104-55-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/4104-57-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/4104-53-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/4104-51-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/4104-49-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/4104-59-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/4104-61-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/4104-67-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/4104-65-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/4104-63-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/4104-68-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/4104-69-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 25 IoCs
resource yara_rule behavioral1/memory/4104-0-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4104-1-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4104-3-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4104-4-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4104-5-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4104-6-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4104-8-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4104-10-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4104-20-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4104-33-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4104-37-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4104-40-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4104-43-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4104-55-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4104-57-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4104-53-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4104-51-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4104-49-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4104-59-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4104-61-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4104-67-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4104-65-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4104-63-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4104-68-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4104-69-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables referencing many Password Manager software clients. Observed in infostealers 25 IoCs
resource yara_rule behavioral1/memory/4104-0-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_PasswordManagers behavioral1/memory/4104-1-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_PasswordManagers behavioral1/memory/4104-3-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_PasswordManagers behavioral1/memory/4104-4-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_PasswordManagers behavioral1/memory/4104-5-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_PasswordManagers behavioral1/memory/4104-6-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_PasswordManagers behavioral1/memory/4104-8-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_PasswordManagers behavioral1/memory/4104-10-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_PasswordManagers behavioral1/memory/4104-20-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_PasswordManagers behavioral1/memory/4104-33-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_PasswordManagers behavioral1/memory/4104-37-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_PasswordManagers behavioral1/memory/4104-40-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_PasswordManagers behavioral1/memory/4104-43-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_PasswordManagers behavioral1/memory/4104-55-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_PasswordManagers behavioral1/memory/4104-57-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_PasswordManagers behavioral1/memory/4104-53-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_PasswordManagers behavioral1/memory/4104-51-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_PasswordManagers behavioral1/memory/4104-49-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_PasswordManagers behavioral1/memory/4104-59-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_PasswordManagers behavioral1/memory/4104-61-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_PasswordManagers behavioral1/memory/4104-67-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_PasswordManagers behavioral1/memory/4104-65-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_PasswordManagers behavioral1/memory/4104-63-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_PasswordManagers behavioral1/memory/4104-68-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_PasswordManagers behavioral1/memory/4104-69-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_PasswordManagers - Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 25 IoCs
resource yara_rule behavioral1/memory/4104-0-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/4104-1-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/4104-3-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/4104-4-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/4104-5-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/4104-6-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/4104-8-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/4104-10-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/4104-20-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/4104-33-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/4104-37-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/4104-40-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/4104-43-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/4104-55-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/4104-57-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/4104-53-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/4104-51-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/4104-49-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/4104-59-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/4104-61-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/4104-67-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/4104-65-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/4104-63-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/4104-68-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/4104-69-0x0000000140000000-0x0000000140031000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store - Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe Key opened \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 api.ipify.org 6 api.ipify.org - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4104 2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe 4104 2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe 4104 2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe 4104 2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe 4104 2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe 4104 2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe 4104 2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe 4104 2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe 4104 2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe 4104 2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe 4104 2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe 4104 2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe 4104 2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe 4104 2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe 4104 2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe 4104 2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe 4104 2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe 4104 2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe 4104 2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe 4104 2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe 4104 2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe 4104 2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4104 wrote to memory of 5044 4104 2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe 86 PID 4104 wrote to memory of 5044 4104 2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe 86 PID 4104 wrote to memory of 5044 4104 2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe 86 PID 4104 wrote to memory of 1692 4104 2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe 89 PID 4104 wrote to memory of 1692 4104 2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe 89 PID 4104 wrote to memory of 1692 4104 2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe 89 - outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_e790e17222b7861785fdd90e72bcb7dc_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_office_path
PID:4104 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window --headless2⤵PID:5044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --headless2⤵PID:1692
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:1108
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3340
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1