4b9a635d0e505a2a5b25971ad2d7da1e01c3406e96e07a8d0197e1a00584acdb

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 11:45

Target
2026-10-22_5dd9a5a75051ce9dd6b5ec4ca404f407_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
Size 10.2MB
Sample261024-nw88dseh52
SHA256 4b9a635d0e505a2a5b25971ad2d7da1e01c3406e96e07a8d0197e1a00584acdb
MD5 5dd9a5a75051ce9dd6b5ec4ca404f407
SHA1 8e9e1e06257a0a042c026fdd7ef977a6d2de419a
SHA512 13c631a174e0e72edd43aa2b237734e0266c1fb6595b1bdf515888b9213cd4e9215cdd0e77d108f3c24cf195b8a1d1ec1a9caa74af6c39a4cf822a2cbac4b9db
SSDEEP 196608:6yAhTsh/j011gaUKW3XgeGpKEbZ7RbqR2SvGoaTcRLu8kTtlCvL:6yAde/qpUKp5KIqR2SzaARL4g
TLSH
T1E0B60107BCA144E5C4AE92318A7796567B72BC480F3123EB2E90BB782F72BD45D79350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 3180	2136	2026-10-22_5dd9a5a75051ce9dd6b5ec4ca404f407_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-22_5dd9a5a75051ce9dd6b5ec4ca404f407_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_5dd9a5a75051ce9dd6b5ec4ca404f407_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  java -jar C:\Users\Admin\AppData\Local\Temp\mc_loader_3405973271\minimal.jar --input=C:\Users\Admin\AppData\Local\Temp\mc_loader_3405973271\estrogen-global-loader-2e12e703.jar --version=1.21.10 --fabric=0.18.4
  2⤵
  PID:3180

minimal.jar

Path C:\Users\Admin\AppData\Local\Temp\mc_loader_3405973271\minimal.jar
Size 308KB
SHA256 198d640545447a4339d452193588b6718e440c6089cd935de4f4fbed9502c5c5
MD5 defd3d97efe9c45e2c7fcf53d42e3063
SHA1 45901d9228e108848cc96f09690cc6e72ee4458e
SHA512 962c241dd67950b26277bf186e6b3e300b1cb9df53a273d371602b8247a2f6bba631621fdbf70883bf16d95c586a4ad992a02df45e97a18ee889df9a9bb1b74b
SSDEEP 3072:S/Pi7+OifpexBQSHNjwZFDfMNtdekFqvZqYKRvaoC+jLXf4FlOg22i79rCgGwrNx:k2ikxBQ+hwZNUttqoYKRSaQ3TnQ
TLSH
T10564DFA3B18919AFF92F49BB4210502278FDE4E8D20B725951F071865E73D4DEF1A3E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3180-8-0x000001DAC66B0000-0x000001DAC6920000-memory.dmp

Download

memory/3180-18-0x000001DAC43E0000-0x000001DAC43E1000-memory.dmp

Download

memory/3180-20-0x000001DAC66B0000-0x000001DAC6920000-memory.dmp

Download

memory/3180-19-0x000001DAC5E00000-0x000001DAC66B0000-memory.dmp

Download