Analysis
- max time kernel
142s - max time network
147s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
- submitted
14/05/2025, 03:44
General
- Target 562c49e27f7a7477a95dd6395b5c40c92bdd2d5db251a59e06ccdee1da5b56ffc59c77d8a220e991.exe
- Size 3.1MB
- Sample250514-eahc4svtbv
- SHA256 816bfd1772b6eac091826e530a2d155d8f15e28a2bf2a4b6bcae37f0a2b7346e
Malware Config
Signatures
- Detect SalatStealer payload 20 IoCs
- Salatstealer family
- salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Executes dropped EXE 5 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Drops file in System32 directory 2 IoCs
- UPX packed file 26 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 8 IoCs
- Drops file in Windows directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 52 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\562c49e27f7a7477a95dd6395b5c40c92bdd2d5db251a59e06ccdee1da5b56ffc59c77d8a220e991.exe"C:\Users\Admin\AppData\Local\Temp\562c49e27f7a7477a95dd6395b5c40c92bdd2d5db251a59e06ccdee1da5b56ffc59c77d8a220e991.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\WindowsPowerShell\SearchHost.exe"C:\Program Files (x86)\WindowsPowerShell\SearchHost.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ReAgentc.exe"C:\Windows\system32\ReAgentc.exe" /disable4⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Google\Chrome\Application\SearchHost.exe"C:\Program Files\Google\Chrome\Application\SearchHost.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\SearchHost.exe"C:\Program Files (x86)\Microsoft\Edge\Application\SearchHost.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Program Files (x86)\WindowsPowerShell\SearchHost.exe"C:\Program Files (x86)\WindowsPowerShell\SearchHost.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Adobe\dllhost.exe"C:\Program Files (x86)\Adobe\dllhost.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
SearchHost.exe
__PSScriptPolicyTest_41iin0cj.jro.ps1
memory/1580-94-0x00000000005E0000-0x0000000001176000-memory.dmp
memory/1580-92-0x00000000005E0000-0x0000000001176000-memory.dmp
memory/2216-93-0x0000000000680000-0x0000000001216000-memory.dmp
memory/2260-26-0x0000000000D60000-0x00000000018F6000-memory.dmp
memory/2260-15-0x0000000000D60000-0x00000000018F6000-memory.dmp
memory/4208-10-0x0000000000060000-0x0000000000BF6000-memory.dmp
memory/4208-0-0x0000000000060000-0x0000000000BF6000-memory.dmp
memory/4316-81-0x0000000000680000-0x0000000001216000-memory.dmp
memory/4316-87-0x0000000000680000-0x0000000001216000-memory.dmp
memory/4316-99-0x0000000000680000-0x0000000001216000-memory.dmp
memory/4316-98-0x0000000000680000-0x0000000001216000-memory.dmp
memory/4316-97-0x0000000000680000-0x0000000001216000-memory.dmp
memory/4316-96-0x0000000000680000-0x0000000001216000-memory.dmp
memory/4316-95-0x0000000000680000-0x0000000001216000-memory.dmp
memory/4316-8-0x0000000000680000-0x0000000001216000-memory.dmp
memory/4316-88-0x0000000000680000-0x0000000001216000-memory.dmp
memory/4316-71-0x0000000000680000-0x0000000001216000-memory.dmp
memory/4316-75-0x0000000000680000-0x0000000001216000-memory.dmp
memory/4316-86-0x0000000000680000-0x0000000001216000-memory.dmp
memory/4316-85-0x0000000000680000-0x0000000001216000-memory.dmp
memory/4316-84-0x0000000000680000-0x0000000001216000-memory.dmp
memory/4316-83-0x0000000000680000-0x0000000001216000-memory.dmp
memory/4316-80-0x0000000000680000-0x0000000001216000-memory.dmp
memory/4984-42-0x0000000000450000-0x0000000000FE6000-memory.dmp
memory/4984-59-0x0000000000450000-0x0000000000FE6000-memory.dmp
memory/5852-54-0x0000000007020000-0x000000000703E000-memory.dmp
memory/5852-44-0x00000000705C0000-0x000000007060C000-memory.dmp
memory/5852-61-0x00000000072C0000-0x0000000007356000-memory.dmp
memory/5852-62-0x00000000071E0000-0x00000000071F1000-memory.dmp
memory/5852-63-0x0000000007230000-0x000000000723E000-memory.dmp
memory/5852-64-0x0000000007240000-0x0000000007255000-memory.dmp
memory/5852-65-0x0000000007290000-0x00000000072AA000-memory.dmp
memory/5852-66-0x0000000007280000-0x0000000007288000-memory.dmp
memory/5852-57-0x00000000077A0000-0x0000000007E1A000-memory.dmp
memory/5852-73-0x00000000076F0000-0x0000000007712000-memory.dmp
memory/5852-74-0x00000000083D0000-0x0000000008976000-memory.dmp
memory/5852-77-0x00000000743E0000-0x0000000074B91000-memory.dmp
memory/5852-76-0x00000000743EE000-0x00000000743EF000-memory.dmp
memory/5852-58-0x0000000007170000-0x000000000718A000-memory.dmp
memory/5852-78-0x00000000743E0000-0x0000000074B91000-memory.dmp
memory/5852-60-0x00000000071C0000-0x00000000071CA000-memory.dmp
memory/5852-18-0x00000000743E0000-0x0000000074B91000-memory.dmp
memory/5852-55-0x0000000007040000-0x00000000070E4000-memory.dmp
memory/5852-21-0x0000000004CF0000-0x0000000004D12000-memory.dmp
memory/5852-45-0x00000000708B0000-0x0000000070C07000-memory.dmp
memory/5852-43-0x0000000006DE0000-0x0000000006E14000-memory.dmp
memory/5852-37-0x0000000005FD0000-0x0000000006016000-memory.dmp
memory/5852-36-0x00000000060A0000-0x00000000060EC000-memory.dmp
memory/5852-17-0x00000000023D0000-0x0000000002406000-memory.dmp
memory/5852-16-0x00000000743EE000-0x00000000743EF000-memory.dmp
memory/5852-35-0x0000000005BC0000-0x0000000005BDE000-memory.dmp
memory/5852-25-0x0000000005680000-0x00000000059D7000-memory.dmp
memory/5852-20-0x00000000743E0000-0x0000000074B91000-memory.dmp
memory/5852-19-0x0000000004E90000-0x00000000054BA000-memory.dmp
memory/5852-24-0x00000000054C0000-0x0000000005526000-memory.dmp
memory/5852-22-0x0000000004DA0000-0x0000000004E06000-memory.dmp