Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
26/03/2025, 20:29
General
-
Target
tx_1743020207149.exe
-
Size
3.1MB
-
MD5
f01179a4c7dd4d8f7d2cccce3025267c
-
SHA1
6f23d8676801aa1e3c192318163ffdf5087d503a
-
SHA256
b7597e2e5b19ce1d48f5e615d996523e32bc3ac069e2472305d52d667f7291f1
-
SHA512
56faf1cdbaf861c85963f32e0adfcd6e66d4fc000abb1622f1f0f6065955a7b28efc30081ee3b7c7cdf9c91fba78795f60ae997688bcd5bb25d1f51a527f035d
-
SSDEEP
49152:pP28sD83LJOqGB5YUpIoIPiPoCWW+OUH1+GHe8S3ldXRtkFonsUV/0O+ad2VRRvk:puv0chLXG5d+nRgMb1kjS
Malware Config
Signatures
-
Detect SalatStealer payload 24 IoCs
-
Salatstealer family
-
salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
-
Executes dropped EXE 9 IoCs
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
UPX packed file 33 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 11 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tx_1743020207149.exe"C:\Users\Admin\AppData\Local\Temp\tx_1743020207149.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Reference Assemblies\WmiPrvSE.exe"C:\Program Files (x86)\Reference Assemblies\WmiPrvSE.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\WmiPrvSE.exe"C:\Program Files\Google\Chrome\Application\WmiPrvSE.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\WmiPrvSE.exe"C:\Program Files (x86)\Microsoft\Edge\Application\WmiPrvSE.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\fontdrvhost.exe"C:\Program Files (x86)\Microsoft\fontdrvhost.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Packages\SppExtComObj.ExeC:\Users\Admin\AppData\Local\Packages\SppExtComObj.Exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Windows Portable Devices\smss.exe"C:\Program Files (x86)\Windows Portable Devices\smss.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\PeerDistRepub\spoolsv.exeC:\Users\Admin\AppData\Local\PeerDistRepub\spoolsv.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\StartMenuExperienceHost.exeC:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\StartMenuExperienceHost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Reference Assemblies\WmiPrvSE.exe"C:\Program Files (x86)\Reference Assemblies\WmiPrvSE.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5f01179a4c7dd4d8f7d2cccce3025267c
SHA16f23d8676801aa1e3c192318163ffdf5087d503a
SHA256b7597e2e5b19ce1d48f5e615d996523e32bc3ac069e2472305d52d667f7291f1
SHA51256faf1cdbaf861c85963f32e0adfcd6e66d4fc000abb1622f1f0f6065955a7b28efc30081ee3b7c7cdf9c91fba78795f60ae997688bcd5bb25d1f51a527f035d
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB