764b6fc9fe5eda4d86cf541ee59e2d0123f18fe0a99e706c3dd85ae1a532d7e1

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_554c2af72aa3d6afc06ee1ca11451109_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
Size 4.5MB
Sample260821-e686psgm9t
SHA256 764b6fc9fe5eda4d86cf541ee59e2d0123f18fe0a99e706c3dd85ae1a532d7e1
MD5 554c2af72aa3d6afc06ee1ca11451109
SHA1 88e3f1b2788eb5e68ab8bbdb189a8646fc6f82d9
SHA512 3e18b9356bb4eec851fea8991d43bc4731c3cd04398a45189927cc8016780a461e8d7c2d613fc41964f0ccf01422d401eeb5524dbdc58f678aea166186986857
SSDEEP 49152:OPPvSRYVMMPFx7wadSNA5ZBpQX2kypN0K0s4jEXo0sueftkI7epOSJjLi+0zWsjY:Oq+UsDpN0ns5iueft
TLSH
T138265A17AE9088E5C4A9E731C4BB51666671BC4D8B3033D72E617E782F327C16E3AB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-21_554c2af72aa3d6afc06ee1ca11451109_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-21_554c2af72aa3d6afc06ee1ca11451109_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4132	2026-08-21_554c2af72aa3d6afc06ee1ca11451109_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
4132	2026-08-21_554c2af72aa3d6afc06ee1ca11451109_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 5028	4132	2026-08-21_554c2af72aa3d6afc06ee1ca11451109_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	89
PID 4132 wrote to memory of 5028	4132	2026-08-21_554c2af72aa3d6afc06ee1ca11451109_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	89
PID 4132 wrote to memory of 5244	4132	2026-08-21_554c2af72aa3d6afc06ee1ca11451109_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	92
PID 4132 wrote to memory of 5244	4132	2026-08-21_554c2af72aa3d6afc06ee1ca11451109_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	92
PID 4132 wrote to memory of 1808	4132	2026-08-21_554c2af72aa3d6afc06ee1ca11451109_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	95
PID 4132 wrote to memory of 1808	4132	2026-08-21_554c2af72aa3d6afc06ee1ca11451109_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	95
PID 4132 wrote to memory of 972	4132	2026-08-21_554c2af72aa3d6afc06ee1ca11451109_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	99
PID 4132 wrote to memory of 972	4132	2026-08-21_554c2af72aa3d6afc06ee1ca11451109_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-08-21_554c2af72aa3d6afc06ee1ca11451109_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_554c2af72aa3d6afc06ee1ca11451109_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:972

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4632

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:996

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2548

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:692

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4996

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1057079C-3263-BDF0-FFA4-BBB8972C9300.txt

Path C:\ProgramData\1057079C-3263-BDF0-FFA4-BBB8972C9300.txt
Size 64B
SHA256 3f6bbc0bc197ea3b01ef32bd5913a833e39bd9676f9bc6ff694419a06b3375c1
MD5 a2902d9f8953374ea892de9580cf210b
SHA1 5f1373fb802655c5615743a4417a13fd493a4223
SHA512 5be9c34bc30feec8f81bcdad8660efb4c65a2159e145b7e18f5a4eeb3e11659501ab9101ed885af0def892545fc9844b49a4bff496bd91d1f5af407d2e33155f
TLSH
T1B1A022300830B0C3088CCA0A02A80ECF0C2030E2A0A8822C0000E0020E28000C32800F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4132-4-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/4132-9-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/4132-8-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/4132-10-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/4132-7-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/4132-6-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/4132-5-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/4132-13-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/4132-11-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/4132-0-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/4132-12-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/4132-3-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/4132-1-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/4132-2-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/4132-16-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/4132-17-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/4132-18-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/4132-19-0x0000000140000000-0x00000001400D7000-memory.dmp

Download