Analysis
- max time kernel
142s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
19/04/2026, 15:24
General
- Target 2026-04-19_b58b2a820278378a7c0d30bb73dfa326_akira_elex_glassworm.exe
- Size 15.8MB
- Sample260419-ss3cwsa13w
- SHA256 4897eb8a6cc0fa09d37d7b60f7eb52290b98179425708b5720b7a9e2568eeb5d
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 27 IoCs
- Custom signatureDetect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 27 IoCs
- Custom signatureDetects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 27 IoCs
- Custom signatureDetects executables containing SQL queries to confidential data stores. Observed in infostealers 27 IoCs
- Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Custom signatureUPX dump on OEP (original entry point) 34 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Looks for VMWare services registry key. 1 TTPs 2 IoCs
- Drops startup file 2 IoCs
- Executes dropped EXE 7 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
- UPX packed file 34 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 30 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-19_b58b2a820278378a7c0d30bb73dfa326_akira_elex_glassworm.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-19_b58b2a820278378a7c0d30bb73dfa326_akira_elex_glassworm.exe"1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\steam_0ede29.exe"C:\Users\Admin\AppData\Local\Temp\steam_0ede29.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\agent-windows-amd64 (1)_2c6bc6.exe"C:\Users\Admin\AppData\Local\Temp\agent-windows-amd64 (1)_2c6bc6.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Temp\GpuService_c0d33f.exe"C:\Users\Admin\AppData\Local\Temp\GpuService_c0d33f.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Defender\fontdrvhost.exe"C:\Program Files (x86)\Windows Defender\fontdrvhost.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Google\Chrome\Application\fontdrvhost.exe"C:\Program Files\Google\Chrome\Application\fontdrvhost.exe" -4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\fontdrvhost.exe"C:\Program Files (x86)\Microsoft\Edge\Application\fontdrvhost.exe" -4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_9882fe6072b4.exe"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_9882fe6072b4.exe"1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
svc_c7afdbcc.log
svc_c7afdbcc.log
GpuService_c0d33f.exe
__PSScriptPolicyTest_we41yrtg.sz3.ps1
agent-windows-amd64 (1)_2c6bc6.exe
steam_0ede29.exe
memory/556-106-0x0000000000410000-0x0000000001064000-memory.dmp
memory/556-93-0x0000000000410000-0x0000000001064000-memory.dmp
memory/556-68-0x0000000000410000-0x0000000001064000-memory.dmp
memory/556-69-0x0000000000410000-0x0000000001064000-memory.dmp
memory/556-17-0x0000000000410000-0x0000000001064000-memory.dmp
memory/556-145-0x0000000000410000-0x0000000001064000-memory.dmp
memory/556-72-0x0000000000410000-0x0000000001064000-memory.dmp
memory/556-118-0x0000000000410000-0x0000000001064000-memory.dmp
memory/556-75-0x0000000024210000-0x00000000242A6000-memory.dmp
memory/556-74-0x0000000000410000-0x0000000001064000-memory.dmp
memory/556-114-0x0000000000410000-0x0000000001064000-memory.dmp
memory/556-77-0x0000000000410000-0x0000000001064000-memory.dmp
memory/556-112-0x0000000000410000-0x0000000001064000-memory.dmp
memory/556-103-0x0000000000410000-0x0000000001064000-memory.dmp
memory/556-100-0x0000000000410000-0x0000000001064000-memory.dmp
memory/556-90-0x0000000000410000-0x0000000001064000-memory.dmp
memory/1916-92-0x0000000000400000-0x0000000001056000-memory.dmp
memory/1916-129-0x0000000000400000-0x0000000001056000-memory.dmp
memory/1916-99-0x0000000000400000-0x0000000001056000-memory.dmp
memory/1916-117-0x0000000000400000-0x0000000001056000-memory.dmp
memory/1916-116-0x0000000000400000-0x0000000001056000-memory.dmp
memory/1916-130-0x0000000024160000-0x00000000241F6000-memory.dmp
memory/1916-108-0x0000000000400000-0x0000000001056000-memory.dmp
memory/1916-87-0x0000000000400000-0x0000000001056000-memory.dmp
memory/3324-76-0x00000000002E0000-0x0000000000F36000-memory.dmp
memory/3324-88-0x00000000002E0000-0x0000000000F36000-memory.dmp
memory/3324-89-0x0000000023F60000-0x0000000023FF6000-memory.dmp
memory/3324-73-0x00000000002E0000-0x0000000000F36000-memory.dmp
memory/3324-60-0x00000000002E0000-0x0000000000F36000-memory.dmp
memory/3324-71-0x00000000002E0000-0x0000000000F36000-memory.dmp
memory/3324-70-0x00000000002E0000-0x0000000000F36000-memory.dmp
memory/4156-151-0x0000000000CC0000-0x0000000001916000-memory.dmp
memory/4156-155-0x0000000000CC0000-0x0000000001916000-memory.dmp
memory/4184-124-0x00000000001B0000-0x0000000000E06000-memory.dmp
memory/4184-128-0x0000000023980000-0x0000000023A16000-memory.dmp
memory/4184-131-0x00000000001B0000-0x0000000000E06000-memory.dmp
memory/4940-156-0x0000000007E00000-0x000000000847A000-memory.dmp
memory/4940-172-0x0000000005330000-0x000000000533E000-memory.dmp
memory/4940-127-0x0000000005420000-0x0000000005A48000-memory.dmp
memory/4940-142-0x0000000005D90000-0x00000000060E4000-memory.dmp
memory/4940-143-0x0000000006410000-0x000000000642E000-memory.dmp
memory/4940-144-0x0000000006440000-0x000000000648C000-memory.dmp
memory/4940-134-0x0000000005D20000-0x0000000005D86000-memory.dmp
memory/4940-125-0x0000000004DB0000-0x0000000004DE6000-memory.dmp
memory/4940-152-0x0000000006970000-0x00000000069B4000-memory.dmp
memory/4940-153-0x0000000007500000-0x0000000007576000-memory.dmp
memory/4940-180-0x0000000008A30000-0x0000000008FD4000-memory.dmp
memory/4940-157-0x00000000077A0000-0x00000000077BA000-memory.dmp
memory/4940-132-0x0000000005390000-0x00000000053B2000-memory.dmp
memory/4940-158-0x0000000007970000-0x00000000079A2000-memory.dmp
memory/4940-133-0x0000000005CB0000-0x0000000005D16000-memory.dmp
memory/4940-168-0x00000000079B0000-0x00000000079CE000-memory.dmp
memory/4940-159-0x0000000070B10000-0x0000000070B5C000-memory.dmp
memory/4940-169-0x00000000079D0000-0x0000000007A73000-memory.dmp
memory/4940-170-0x0000000007AD0000-0x0000000007ADA000-memory.dmp
memory/4940-160-0x00000000710C0000-0x0000000071414000-memory.dmp
memory/4940-171-0x0000000007BA0000-0x0000000007C36000-memory.dmp
memory/4940-173-0x0000000006200000-0x0000000006274000-memory.dmp
memory/4940-174-0x0000000007B00000-0x0000000007B11000-memory.dmp
memory/4940-175-0x0000000007B30000-0x0000000007B3E000-memory.dmp
memory/4940-176-0x0000000007B40000-0x0000000007B54000-memory.dmp
memory/4940-177-0x0000000007C40000-0x0000000007C5A000-memory.dmp
memory/4940-178-0x0000000007B70000-0x0000000007B78000-memory.dmp
memory/4940-179-0x0000000007C40000-0x0000000007C62000-memory.dmp
memory/5448-67-0x0000000000690000-0x0000000001657000-memory.dmp