Analysis
-
max time kernel
593s -
max time network
600s -
platform
windows11-21h2_x64 -
resource
win11-20250313-en -
resource tags
-
submitted
27/03/2025, 19:48
General
-
Target
webrat.exe
-
Size
3.1MB
-
MD5
1c3b8bd025d5b9663dd0e02d3405e0df
-
SHA1
92b07502328992e7fc21a11fac39f93cceffeb22
-
SHA256
18c5e65e4b9da90324c170b3f5f20a1dc8c818b38dcde6b146c3af1f423def3f
-
SHA512
a49523270de2a235aedbd1698d01a70f6d4967e06287e8b8630b1b11758bdb56507fc066d6d404e850e60c6fd9ef2cb075fa3d7085bc24ce9b946d306ff396cb
-
SSDEEP
49152:zRlpygxOgF2Kxw/EnMr+NQdiFyBEQhJHZRPsy4jFwlBJm+/D9cEmbvvF:VlpyWOXKxw8n8/gMBEQ3sTAtRObv
Malware Config
Signatures
-
Detect SalatStealer payload 64 IoCs
-
Salatstealer family
-
salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
-
Executes dropped EXE 10 IoCs
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 5 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 16 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Modifies system certificate store 2 TTPs 3 IoCs
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\webrat.exe"C:\Users\Admin\AppData\Local\Temp\webrat.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\D3DSCache\svchost.exeC:\Users\Admin\AppData\Local\D3DSCache\svchost.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\svchost.exe"C:\Program Files\Google\Chrome\Application\svchost.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\svchost.exe"C:\Program Files (x86)\Microsoft\Edge\Application\svchost.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\D3DSCache\svchost.exeC:\Users\Admin\AppData\Local\D3DSCache\svchost.exe k3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoExit "[console]::InputEncoding = [console]::OutputEncoding = New-Object System.Text.UTF8Encoding"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE"4⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE"4⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoExit "[console]::InputEncoding = [console]::OutputEncoding = New-Object System.Text.UTF8Encoding"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\D3DSCache\svchost.exeC:\Users\Admin\AppData\Local\D3DSCache\svchost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Windows Media Player\explorer.exe"C:\Program Files (x86)\Windows Media Player\explorer.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Windows Media Player\explorer.exe"C:\Program Files (x86)\Windows Media Player\explorer.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\D3DSCache\svchost.exeC:\Users\Admin\AppData\Local\D3DSCache\svchost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Windows Media Player\explorer.exe"C:\Program Files (x86)\Windows Media Player\explorer.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\D3DSCache\svchost.exeC:\Users\Admin\AppData\Local\D3DSCache\svchost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD51c3b8bd025d5b9663dd0e02d3405e0df
SHA192b07502328992e7fc21a11fac39f93cceffeb22
SHA25618c5e65e4b9da90324c170b3f5f20a1dc8c818b38dcde6b146c3af1f423def3f
SHA512a49523270de2a235aedbd1698d01a70f6d4967e06287e8b8630b1b11758bdb56507fc066d6d404e850e60c6fd9ef2cb075fa3d7085bc24ce9b946d306ff396cb
-
Filesize
1KB
MD55b74da6778ccaa0e1ca4ae7484775943
SHA10a2f6f315a0ca1a0366b509aec7b13c606645654
SHA256172282931d7eeb60228e6b9b4b913fd78c73f2a7855620f35fb24a5c847b6c78
SHA51220b4cb7174f49b22426b249f1dfc8f6273f50d1502536e773f4dcd073bf027f2a554d2437c2dc628dbe021c5c3b968b2d89f810ff1bb19630c1560e7feee1a1a
-
Filesize
60KB
MD5b4dcb54e40007382e16e2d2bb9279d00
SHA16c79e80d02c2795dc52cc13529e1b0e1d08fc5e1
SHA256b0daa7b07479251c27c72e67118ac5b7375f0852e1e20f2db995bec79e002dd9
SHA5126b785fef858de7e426a835b9dbca06d4c7e851340ef4ec943e573dc11613212b0c9b2fc5ef9eac8e8c0eed9dee47f30df567db1fbdb84017f68b96a32e495790
-
Filesize
16KB
MD59146aa9c82be7894411797cadb1878c9
SHA1b48ec2200e59f30abfdcc6c468e20d72e2e47d7d
SHA256521769074a81bd28dfe07cecc5747df55adf466f6b4b9633b78feef25c4d5146
SHA5129a555d28674562504928fbc6cd3107b3379ea001cef29143f599219df12a35b2c902607055a9b98080a089d8e34d84de9366a05a2d4dcdf4e03022ea4c5cf8b5
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
73B
MD5f19179be0fa4eb6bb64fec63b9294338
SHA1cad719fc27a3cb1794f2f18fec7b38a3d6d0fe93
SHA2567decd34481728cae92afa1162e8b89e025bd47fdd2bb04d21540d11e1be527a4
SHA512d637ebcd5b598be71627f8766f629a67ed9897d5351d5cf43b3ce7af97405db145fdae5fd60eea9cff09513b06d77df92d5ffe69f4811a391f9379cd4f71249d
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
280KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
136KB
-
Filesize
6.2MB
-
Filesize
216KB
-
Filesize
56KB
-
Filesize
104KB
-
Filesize
6.5MB
-
Filesize
208KB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
120KB
-
Filesize
656KB
-
Filesize
40KB
-
Filesize
600KB
-
Filesize
68KB
-
Filesize
84KB
-
Filesize
104KB
-
Filesize
32KB
-
Filesize
3.3MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB