00086fa7fd67137d34a77d0898a8c44f1c92c2ea7edd115bd0a11aa699279b2f

Resubmissions

14/10/2026, 04:36

261014-e8cwaaee353

13/04/2026, 06:28

260413-g8mftsdw9j3

Analysis

max time kernel
298s
max time network
266s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-ja
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-jalocale:ja-jpos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-13_2b5daf7931b3e4664703126e86bfe43f_elex_frostygoop_ghostlocker_hive_salatstealer_sliver_snatch.exe
Size 4.1MB
Sample261014-e8cwaaee35
SHA256 00086fa7fd67137d34a77d0898a8c44f1c92c2ea7edd115bd0a11aa699279b2f
MD5 2b5daf7931b3e4664703126e86bfe43f
SHA1 112a988f3959b52cc56a71c665194a2240c48a23
SHA512 b50e11237351b8cc4f1302b901939819c724b069523d3c47b6f0bdaf182f1c143119ea2f72afcd226d45ab65eea37b6d2de1c757fe5bda80a904bdb869059639
SSDEEP 98304:Ms2tpyEme4fOTwq2iOLkQmml2/V0cETQ/I:j2nmo8q2dkQmm+Z
TLSH
T116167B01FA9785F6E902163184EB336F27285D096F36DB87EA107B7EEC372D50936249
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-13_2b5daf7931b3e4664703126e86bfe43f_elex_frostygoop_ghostlocker_hive_salatstealer_sliver_snatch.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-13_2b5daf7931b3e4664703126e86bfe43f_elex_frostygoop_ghostlocker_hive_salatstealer_sliver_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-13_2b5daf7931b3e4664703126e86bfe43f_elex_frostygoop_ghostlocker_hive_salatstealer_sliver_snatch.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:6132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/6132-0-0x0000000000400000-0x0000000000846000-memory.dmp

Download

memory/6132-1-0x0000000000400000-0x0000000000846000-memory.dmp