f394fb522663505727c6c4122b562020ba0e1c62e0a7245210d0303d36a1eb5d

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 05:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_07f08e2176977fb5a5799ba87181678a_frostygoop_ghostlocker_hive_knight_luca-stealer_salatstealer_sliver.exe
Size 3.4MB
Sample260930-gml8yascnf
SHA256 f394fb522663505727c6c4122b562020ba0e1c62e0a7245210d0303d36a1eb5d
MD5 07f08e2176977fb5a5799ba87181678a
SHA1 6881e6126b613185d6fef016972cde112f243689
SHA512 410f155d9b2863408a74aa1ed255a916ee7dcb6f027ee5ed550944af6b9964439a216cf8d5bec6883d4133e300e9bff29608f5054e8ed8c61aa984b61604d8e7
SSDEEP 49152:0Xr5IX+Ps+4wCNsO9w/6jIUDUokFG2r5g39U3sSc:0E2ksZaZgVr5g3K3sJ
TLSH
T12FF59E07BCD548B9C09AAF328AB752927A75BC490B3223DB3A50B3782F727F06575744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2316	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2316	powershell.exe
2316	powershell.exe
2316	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2316	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 2316	4288	2026-09-29_07f08e2176977fb5a5799ba87181678a_frostygoop_ghostlocker_hive_knight_luca-stealer_salatstealer_sliver.exe	88
PID 2316 wrote to memory of 2004	2316	powershell.exe	90
PID 2004 wrote to memory of 2576	2004	csc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-09-29_07f08e2176977fb5a5799ba87181678a_frostygoop_ghostlocker_hive_knight_luca-stealer_salatstealer_sliver.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_07f08e2176977fb5a5799ba87181678a_frostygoop_ghostlocker_hive_knight_luca-stealer_salatstealer_sliver.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\ProgramData\TosomDiwa\Tosom_Diwa_GUI.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\53lv0jcu\53lv0jcu.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES964B.tmp" "c:\Users\Admin\AppData\Local\Temp\53lv0jcu\CSC444DE1BB79084168B4928EA8919B865D.TMP"
      4⤵
      PID:2576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Tosom_Diwa_GUI.ps1

Path C:\ProgramData\TosomDiwa\Tosom_Diwa_GUI.ps1
Size 6KB
SHA256 27e4da3b4bc1e165413a3970eddcd0061248e430e3a78524c75635aabc29c8d9
MD5 9374b4d962f31085334ffeb3b2daab23
SHA1 fa909fea18f0a9e7f337ac0fca6ca7350b7dac48
SHA512 cf511f75ac46e2e88b0f0c2a9105b1238a293e9bd7c672f9a5c9347c915019bccd53f48630ac7ce36ba63bfd12fe1f29d617f40eb72984770c59ab34cb5f1763
SSDEEP 96:7eaCQNW0YYr0MYpYoM6uJOLStkJy4mQ1/je0TsNpT4SRLbij3E0KpHLSRVbRXGxQ:TUswKJh6mQ1reosfptiEOTeevxAi
TLSH
T185D13138B32F92920F73182F9CAF21956D1A14372148AE147E5FD2C8EFD92ACD306394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tosom_Diwa_UI.png

Path C:\ProgramData\TosomDiwa\Tosom_Diwa_UI.png
Size 815KB
SHA256 35de7c31ad917fa33e4002a10559c6cc79b2f31adb09e3624c2c1ce875dac0eb
MD5 419a33706a79347e8d76a7afb9c2273a
SHA1 a097402c825c18236e9fc8eaa8754014fe2f7176
SHA512 965d3410887c0b7bb3fcf90cbb938fe7cfbca9c73969d4048ce298d35ceec4d271fd4f89d6ec31dc34462f8b2233fdb5b6f0fb6b58a3c5efad649acad5eecf1f
SSDEEP 12288:wCC1yvEmnApk/l4aTedRO+g8ymslV5bC+p6W03e1slBqIR9ipfi:wC1/CxO+g8ymsVCi0O1KBzefi
TLSH
T1C005330A445E00B02EA04D7FE5BE5967E60EF8CDC6841517EF16810A71BAB39F58D8AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

53lv0jcu.dll

Path C:\Users\Admin\AppData\Local\Temp\53lv0jcu\53lv0jcu.dll
Size 3KB
SHA256 1c7a7d7026450b3e6eca6ca757f8d61b8ced6f5e62a0c2460de5f1a74606c276
MD5 4f9235f7c33ff5f86132e445fb90c5f9
SHA1 4bfa14d870d959534b923efeb8419b349a056118
SHA512 25fcdd959b866673400f41415dec806a7238e7be8067481d4b05947dd8fd9d26d8ccab793f8d9d6bf63c05cddf71f05b6a2f2bf618e5295a64db44a5d8907009
TLSH
T11E51D60793F8462FE4670732AEF3432737B4FD609B32676E09904269AC65B605E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

RES964B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES964B.tmp
Size 1KB
SHA256 9eada738647182aadb8f061cbcbfa2843bbb408ca873638a8e32c981fcf1e673
MD5 28ec172d38075911be7471b06ca1bb97
SHA1 1c2ab3ab564047e3af6025028962bed70e71b6a1
SHA512 7766c01c380113d5beb5fbe35e94202a81428a6075cb53ab9983e0a3ace2fe9cc7f0196cd22739d79951603b4bfe7385c84dcee254dc3100efa66a1b7f43927e
TLSH
T19D21CC0153EC471FF0B3473269FA075F9574FDA5DFA2939A884042282C41504EEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

53lv0jcu.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\53lv0jcu\53lv0jcu.0.cs
Size 277B
SHA256 11358c56b5d51262a433f3ff636e87a6d1e2d001c0765fdc6a738b5de1291fe5
MD5 f393a28f73837a0f7ae973f7117d7d4e
SHA1 e940d7541449988e46886a31725d8ab66d0601f1
SHA512 929166b7a717d9f262fd0563bb346960069ba67d3f7467c7e6c00d8b231460e671af2de5721f365bc15d58ac26dce5ae32fcf6ffc88306d9669b99823589d1af
TLSH
T1B3D02B186B63FA245043480E9C8490B9F72BA22933BF3A14A5BD07414F2F4980275629
MD5 SHA1 SHA512 TLSH

Submit Download

53lv0jcu.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\53lv0jcu\53lv0jcu.cmdline
Size 369B
SHA256 a3e1e7f6c48895b2724c65b18e53c29455b6148882a0b7c761a1a110cc5cfbff
MD5 54673d658bd0d08531ec81d0de69d791
SHA1 ea29f00d7a50ee56d472fdce97f0f1be7dd7771e
SHA512 65f1d7ca32f6fc23d22f3c080cdd2f3f1bfd7faeca87dbb1823d5759b21b2b8f5102dafbbffe842c64709cc4b0e65b686bed3d160a42707bf098c66efadec893
TLSH
T112E0C02A4247C6BE05DD100F2569D5ADC272074379813F8C54A0C80DD01B80137D1F65
MD5 SHA1 SHA512 TLSH

Submit Download

CSC444DE1BB79084168B4928EA8919B865D.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\53lv0jcu\CSC444DE1BB79084168B4928EA8919B865D.TMP
Size 652B
SHA256 69ae2b792f356d0858fee78ae9afd46b83ff7c14397fb9b60d98240b0ec08d1a
MD5 b68e4c0570505ea095254b2c9cd45f71
SHA1 8ed7061ca78955f08b2aa3021ab21bbec8dca1bf
SHA512 16afcd3be0bc24fb69749ad7fe45a9039e1d2b2c6a33f17a3e8b26ee952f5dcd153a54b7f29a886420953e517b1cfe5e264fa0f21eac33f30bfa1dae08955574
TLSH
T188F05E0963F8020EF4F34B31BEF6436395A9BC65DE3293ED185403192864A108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2316-14-0x00007FF8328D0000-0x00007FF833274000-memory.dmp

Download

memory/2316-10-0x00007FF8328D0000-0x00007FF833274000-memory.dmp

Download

memory/2316-12-0x00007FF8328D0000-0x00007FF833274000-memory.dmp

Download

memory/2316-16-0x00007FF8328D0000-0x00007FF833274000-memory.dmp

Download

memory/2316-17-0x00007FF8328D0000-0x00007FF833274000-memory.dmp

Download

memory/2316-3-0x00007FF832A5F000-0x00007FF832A60000-memory.dmp

Download

memory/2316-11-0x00007FF8328D0000-0x00007FF833274000-memory.dmp

Download

memory/2316-19-0x00007FF8328D0000-0x00007FF833274000-memory.dmp

Download

memory/2316-20-0x00007FF8328D0000-0x00007FF833274000-memory.dmp

Download

memory/2316-13-0x00007FF8328D0000-0x00007FF833274000-memory.dmp

Download

memory/2316-9-0x00007FF8328D0000-0x00007FF833274000-memory.dmp

Download

memory/2316-34-0x00000231EDDE0000-0x00000231EDDE8000-memory.dmp

Download

memory/2316-8-0x00007FF8328D0000-0x00007FF833274000-memory.dmp

Download

memory/2316-5-0x00007FF8328D0000-0x00007FF833274000-memory.dmp

Download

memory/2316-4-0x00000231ED760000-0x00000231ED782000-memory.dmp

Download

memory/2316-28-0x00007FF8328D0000-0x00007FF833274000-memory.dmp

Download

memory/2316-36-0x00007FF8328D0000-0x00007FF833274000-memory.dmp

Download

memory/2316-37-0x00007FF8328D0000-0x00007FF833274000-memory.dmp

Download