Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
28/08/2026, 23:04
General
- Target 2026-08-28_068d4034602a251a4aeaf18c9716ba7c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
- Size 7.2MB
- Sample260828-22gl8aed24
- SHA256 39c8c59cf15c353292f7b55529a0aa6daf98bebe6748210c6a7a092c56b85815
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- UPX dump on OEP (original entry point) 31 IoCs
- XMRig Miner payload 15 IoCs
- Executes dropped EXE 1 IoCs
- UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-28_068d4034602a251a4aeaf18c9716ba7c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-28_068d4034602a251a4aeaf18c9716ba7c_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c start /b C:\Users\Admin\AppData\Roaming\javaxs.exe -c C:\Users\Admin\AppData\Roaming\config.json2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\javaxs.exeC:\Users\Admin\AppData\Roaming\javaxs.exe -c C:\Users\Admin\AppData\Roaming\config.json3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
config.json
config.json
javaxs.exe
memory/2724-16-0x000001EFC8680000-0x000001EFC86A0000-memory.dmp
memory/2724-19-0x00007FF62DAC0000-0x00007FF62E2A0000-memory.dmp
memory/2724-6-0x000001EFC6D10000-0x000001EFC6D30000-memory.dmp
memory/2724-11-0x00007FF62DAC0000-0x00007FF62E2A0000-memory.dmp
memory/2724-13-0x00007FF62DAC0000-0x00007FF62E2A0000-memory.dmp
memory/2724-43-0x00007FF62DAC0000-0x00007FF62E2A0000-memory.dmp
memory/2724-4-0x00007FF62DAC0000-0x00007FF62E2A0000-memory.dmp
memory/2724-15-0x00007FF62DAC0000-0x00007FF62E2A0000-memory.dmp
memory/2724-17-0x000001EFC6DA0000-0x000001EFC6DC0000-memory.dmp
memory/2724-31-0x00007FF62DAC0000-0x00007FF62E2A0000-memory.dmp
memory/2724-41-0x00007FF62DAC0000-0x00007FF62E2A0000-memory.dmp
memory/2724-9-0x000001EFC6D80000-0x000001EFC6DA0000-memory.dmp
memory/2724-21-0x000001EFC6DA0000-0x000001EFC6DC0000-memory.dmp
memory/2724-20-0x000001EFC8680000-0x000001EFC86A0000-memory.dmp
memory/2724-23-0x00007FF62DAC0000-0x00007FF62E2A0000-memory.dmp
memory/2724-39-0x00007FF62DAC0000-0x00007FF62E2A0000-memory.dmp
memory/2724-37-0x00007FF62DAC0000-0x00007FF62E2A0000-memory.dmp
memory/2724-25-0x00007FF62DAC0000-0x00007FF62E2A0000-memory.dmp
memory/2724-27-0x00007FF62DAC0000-0x00007FF62E2A0000-memory.dmp
memory/2724-35-0x00007FF62DAC0000-0x00007FF62E2A0000-memory.dmp
memory/2724-33-0x00007FF62DAC0000-0x00007FF62E2A0000-memory.dmp
memory/2724-29-0x00007FF62DAC0000-0x00007FF62E2A0000-memory.dmp
memory/4528-14-0x00007FF625EC0000-0x00007FF626645000-memory.dmp
memory/4528-30-0x00007FF625EC0000-0x00007FF626645000-memory.dmp
memory/4528-28-0x00007FF625EC0000-0x00007FF626645000-memory.dmp
memory/4528-32-0x00007FF625EC0000-0x00007FF626645000-memory.dmp
memory/4528-26-0x00007FF625EC0000-0x00007FF626645000-memory.dmp
memory/4528-34-0x00007FF625EC0000-0x00007FF626645000-memory.dmp
memory/4528-36-0x00007FF625EC0000-0x00007FF626645000-memory.dmp
memory/4528-24-0x00007FF625EC0000-0x00007FF626645000-memory.dmp
memory/4528-38-0x00007FF625EC0000-0x00007FF626645000-memory.dmp
memory/4528-22-0x00007FF625EC0000-0x00007FF626645000-memory.dmp
memory/4528-40-0x00007FF625EC0000-0x00007FF626645000-memory.dmp
memory/4528-18-0x00007FF625EC0000-0x00007FF626645000-memory.dmp
memory/4528-42-0x00007FF625EC0000-0x00007FF626645000-memory.dmp
memory/4528-12-0x00007FF625EC0000-0x00007FF626645000-memory.dmp