Analysis
- max time kernel
148s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
19/04/2026, 15:24
General
- Target 2026-04-19_b58b2a820278378a7c0d30bb73dfa326_akira_elex_glassworm.exe
- Size 15.8MB
- Sample260419-ss3cwsa13w
- SHA256 4897eb8a6cc0fa09d37d7b60f7eb52290b98179425708b5720b7a9e2568eeb5d
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 27 IoCs
- Custom signatureDetect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 27 IoCs
- Custom signatureDetects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 27 IoCs
- Custom signatureDetects executables containing SQL queries to confidential data stores. Observed in infostealers 27 IoCs
- Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Custom signatureUPX dump on OEP (original entry point) 34 IoCs
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Looks for VMWare services registry key. 1 TTPs 2 IoCs
- Drops startup file 2 IoCs
- Executes dropped EXE 7 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
- UPX packed file 34 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-19_b58b2a820278378a7c0d30bb73dfa326_akira_elex_glassworm.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-19_b58b2a820278378a7c0d30bb73dfa326_akira_elex_glassworm.exe"1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\steam_0ede29.exe"C:\Users\Admin\AppData\Local\Temp\steam_0ede29.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\agent-windows-amd64 (1)_2c6bc6.exe"C:\Users\Admin\AppData\Local\Temp\agent-windows-amd64 (1)_2c6bc6.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Temp\GpuService_c0d33f.exe"C:\Users\Admin\AppData\Local\Temp\GpuService_c0d33f.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Reference Assemblies\dllhost.exe"C:\Program Files (x86)\Reference Assemblies\dllhost.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe4⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Google\Chrome\Application\dllhost.exe"C:\Program Files\Google\Chrome\Application\dllhost.exe" -4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\dllhost.exe"C:\Program Files (x86)\Microsoft\Edge\Application\dllhost.exe" -4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_5c40d0d75332.exe"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_5c40d0d75332.exe"1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
svc_c7afdbcc.log
GpuService_c0d33f.exe
__PSScriptPolicyTest_zn11nbre.din.ps1
agent-windows-amd64 (1)_2c6bc6.exe
steam_0ede29.exe
memory/1720-67-0x0000000000320000-0x00000000012E7000-memory.dmp
memory/1972-112-0x0000000000760000-0x00000000013B6000-memory.dmp
memory/1972-96-0x0000000000760000-0x00000000013B6000-memory.dmp
memory/1976-118-0x0000000000860000-0x00000000014B6000-memory.dmp
memory/1976-120-0x0000000000860000-0x00000000014B6000-memory.dmp
memory/2420-162-0x0000000000080000-0x0000000000CD4000-memory.dmp
memory/2420-152-0x0000000000080000-0x0000000000CD4000-memory.dmp
memory/2420-17-0x0000000000080000-0x0000000000CD4000-memory.dmp
memory/2420-82-0x0000000000080000-0x0000000000CD4000-memory.dmp
memory/2420-68-0x0000000000080000-0x0000000000CD4000-memory.dmp
memory/2420-70-0x0000000000080000-0x0000000000CD4000-memory.dmp
memory/2420-87-0x0000000000080000-0x0000000000CD4000-memory.dmp
memory/2420-163-0x00000000017F0000-0x00000000017FB000-memory.dmp
memory/2420-91-0x0000000000080000-0x0000000000CD4000-memory.dmp
memory/2420-148-0x0000000000080000-0x0000000000CD4000-memory.dmp
memory/2420-164-0x0000000023E30000-0x0000000023E3A000-memory.dmp
memory/2420-156-0x0000000000080000-0x0000000000CD4000-memory.dmp
memory/2420-154-0x0000000000080000-0x0000000000CD4000-memory.dmp
memory/2420-166-0x0000000000080000-0x0000000000CD4000-memory.dmp
memory/3968-69-0x00000000002B0000-0x0000000000F06000-memory.dmp
memory/3968-71-0x00000000002B0000-0x0000000000F06000-memory.dmp
memory/3968-62-0x00000000002B0000-0x0000000000F06000-memory.dmp
memory/3968-81-0x00000000002B0000-0x0000000000F06000-memory.dmp
memory/4360-86-0x0000000000BB0000-0x0000000001806000-memory.dmp
memory/4360-140-0x0000000000BB0000-0x0000000001806000-memory.dmp
memory/4360-169-0x0000000000BB0000-0x0000000001806000-memory.dmp
memory/4360-80-0x0000000000BB0000-0x0000000001806000-memory.dmp
memory/4360-165-0x0000000000BB0000-0x0000000001806000-memory.dmp
memory/4360-84-0x0000000000BB0000-0x0000000001806000-memory.dmp
memory/4360-88-0x0000000000BB0000-0x0000000001806000-memory.dmp
memory/4360-161-0x0000000000BB0000-0x0000000001806000-memory.dmp
memory/4360-155-0x0000000000BB0000-0x0000000001806000-memory.dmp
memory/4360-153-0x0000000000BB0000-0x0000000001806000-memory.dmp
memory/4360-151-0x0000000000BB0000-0x0000000001806000-memory.dmp
memory/4360-149-0x0000000000BB0000-0x0000000001806000-memory.dmp
memory/4568-133-0x0000000007ED0000-0x0000000007EEA000-memory.dmp
memory/4568-132-0x0000000008500000-0x0000000008B7A000-memory.dmp
memory/4568-136-0x0000000007F40000-0x0000000007F51000-memory.dmp
memory/4568-137-0x0000000007F80000-0x0000000007F8E000-memory.dmp
memory/4568-138-0x0000000007F90000-0x0000000007FA5000-memory.dmp
memory/4568-139-0x0000000007FF0000-0x000000000800A000-memory.dmp
memory/4568-134-0x0000000007F20000-0x0000000007F2A000-memory.dmp
memory/4568-141-0x0000000007FE0000-0x0000000007FE8000-memory.dmp
memory/4568-142-0x0000000008000000-0x0000000008022000-memory.dmp
memory/4568-143-0x0000000009130000-0x00000000096D6000-memory.dmp
memory/4568-147-0x0000000005930000-0x0000000005945000-memory.dmp
memory/4568-146-0x0000000001700000-0x0000000001713000-memory.dmp
memory/4568-101-0x0000000006310000-0x0000000006376000-memory.dmp
memory/4568-135-0x0000000008070000-0x0000000008106000-memory.dmp
memory/4568-110-0x00000000068F0000-0x000000000693C000-memory.dmp
memory/4568-100-0x00000000062A0000-0x0000000006306000-memory.dmp
memory/4568-123-0x0000000070B10000-0x0000000070E67000-memory.dmp
memory/4568-99-0x0000000005AC0000-0x0000000005AE2000-memory.dmp
memory/4568-131-0x0000000007D90000-0x0000000007E34000-memory.dmp
memory/4568-98-0x0000000005B80000-0x00000000061AA000-memory.dmp
memory/4568-130-0x0000000007D70000-0x0000000007D8E000-memory.dmp
memory/4568-97-0x0000000002F90000-0x0000000002FC6000-memory.dmp
memory/4568-122-0x00000000709B0000-0x00000000709FC000-memory.dmp
memory/4568-121-0x0000000007D30000-0x0000000007D64000-memory.dmp
memory/4568-108-0x0000000006380000-0x00000000066D7000-memory.dmp
memory/4568-109-0x00000000068D0000-0x00000000068EE000-memory.dmp
memory/4568-113-0x0000000006E40000-0x0000000006E86000-memory.dmp