Resubmissions
23/04/2026, 12:55
260423-p5zkzscy6m1020/04/2026, 17:04
260420-vlm1qsaz7k1020/04/2026, 17:04
260420-vll4faaz7j1020/04/2026, 17:02
260420-vkhpmaaz6k1020/04/2026, 17:02
260420-vkggkaaz5r1020/04/2026, 17:01
260420-vjqzlscx811020/04/2026, 17:00
260420-vh84sscx8v1020/04/2026, 16:59
260420-vhq8zscx7s1020/04/2026, 16:58
260420-vg7vcacx6v1020/04/2026, 16:57
260420-vggyxscx5z10Analysis
- max time kernel
600s - max time network
609s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
20/04/2026, 15:22
General
- Target keshka.exe
- Size 3.4MB
- Sample260420-srycjsd17l
- SHA256 897b5101cafb0a9104381e8cd260c932df8cc2162bd2d4f26ba968f4b70c63e8
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 58 IoCs
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 7 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\keshka.exe"C:\Users\Admin\AppData\Local\Temp\keshka.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Adobe\lsass.exeC:\Users\Admin\AppData\Local\Adobe\lsass.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\lsass.exe"C:\Program Files (x86)\Microsoft\Edge\Application\lsass.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Google\Chrome\Application\lsass.exe"C:\Program Files\Google\Chrome\Application\lsass.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "start C:\Users\Admin\AppData\Local\Temp/f.exe"3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Google\WmiPrvSE.exe"C:\Program Files (x86)\Google\WmiPrvSE.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Adobe\lsass.exeC:\Users\Admin\AppData\Local\Adobe\lsass.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Google\WmiPrvSE.exe"C:\Program Files (x86)\Google\WmiPrvSE.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Adobe\lsass.exeC:\Users\Admin\AppData\Local\Adobe\lsass.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
lsass.exe
__PSScriptPolicyTest_kgkqwsce.omf.ps1
memory/1060-85-0x0000000004BD0000-0x0000000004BE0000-memory.dmp
memory/1060-64-0x0000000007500000-0x0000000007532000-memory.dmp
memory/1060-93-0x0000000004EB0000-0x0000000004F37000-memory.dmp
memory/1060-92-0x0000000004D10000-0x0000000004D22000-memory.dmp
memory/1060-89-0x0000000004BD0000-0x0000000004BE0000-memory.dmp
memory/1060-87-0x0000000004EB0000-0x0000000004F37000-memory.dmp
memory/1060-66-0x0000000071470000-0x00000000717C4000-memory.dmp
memory/1060-84-0x00000000085F0000-0x0000000008B94000-memory.dmp
memory/1060-83-0x00000000077D0000-0x00000000077F2000-memory.dmp
memory/1060-88-0x0000000004E70000-0x0000000004E7E000-memory.dmp
memory/1060-82-0x0000000007700000-0x0000000007708000-memory.dmp
memory/1060-81-0x00000000077D0000-0x00000000077EA000-memory.dmp
memory/1060-80-0x00000000076D0000-0x00000000076E4000-memory.dmp
memory/1060-79-0x00000000076C0000-0x00000000076CE000-memory.dmp
memory/1060-78-0x0000000007690000-0x00000000076A1000-memory.dmp
memory/1060-77-0x0000000007730000-0x00000000077C6000-memory.dmp
memory/1060-34-0x0000000004BD0000-0x0000000004BE0000-memory.dmp
memory/1060-35-0x0000000002510000-0x0000000002546000-memory.dmp
memory/1060-36-0x0000000004BD0000-0x0000000004BE0000-memory.dmp
memory/1060-37-0x0000000005210000-0x0000000005838000-memory.dmp
memory/1060-38-0x0000000004E80000-0x0000000004EA2000-memory.dmp
memory/1060-39-0x0000000004FC0000-0x0000000005026000-memory.dmp
memory/1060-40-0x00000000050A0000-0x0000000005106000-memory.dmp
memory/1060-42-0x0000000005840000-0x0000000005B94000-memory.dmp
memory/1060-86-0x0000000004D10000-0x0000000004D22000-memory.dmp
memory/1060-76-0x0000000007660000-0x000000000766A000-memory.dmp
memory/1060-51-0x0000000005E80000-0x0000000005E9E000-memory.dmp
memory/1060-55-0x00000000065B0000-0x00000000065FC000-memory.dmp
memory/1060-75-0x0000000007560000-0x0000000007603000-memory.dmp
memory/1060-74-0x0000000007540000-0x000000000755E000-memory.dmp
memory/1060-58-0x00000000064B0000-0x00000000064F4000-memory.dmp
memory/1060-59-0x00000000072C0000-0x0000000007336000-memory.dmp
memory/1060-60-0x00000000079C0000-0x000000000803A000-memory.dmp
memory/1060-61-0x0000000007340000-0x000000000735A000-memory.dmp
memory/1060-65-0x0000000070B70000-0x0000000070BBC000-memory.dmp
memory/1888-132-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-148-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-63-0x0000000025140000-0x00000000251C7000-memory.dmp
memory/1888-179-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-177-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-175-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-173-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-171-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-27-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-26-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-25-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-24-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-23-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-169-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-163-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-160-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-161-0x0000000025140000-0x00000000251C7000-memory.dmp
memory/1888-158-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-156-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-154-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-152-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-150-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-95-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-97-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-99-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-101-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-103-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-105-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-107-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-109-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-111-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-113-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-115-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-117-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-119-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-62-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-146-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-144-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-142-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-128-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-130-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-140-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-134-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-136-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/1888-138-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/2132-57-0x0000000000FB0000-0x0000000001C07000-memory.dmp
memory/2132-56-0x0000000000FB0000-0x0000000001C07000-memory.dmp
memory/3084-127-0x0000000000060000-0x0000000000CB7000-memory.dmp
memory/3084-124-0x0000000000060000-0x0000000000CB7000-memory.dmp
memory/4448-126-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/4448-125-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/4968-166-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/4968-168-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/5080-5-0x00000000000E0000-0x0000000000D37000-memory.dmp
memory/5080-8-0x00000000000E0000-0x0000000000D37000-memory.dmp
memory/5080-1-0x00000000000E0000-0x0000000000D37000-memory.dmp
memory/5080-11-0x00000000000E0000-0x0000000000D37000-memory.dmp
memory/5080-13-0x00000000000E0000-0x0000000000D37000-memory.dmp
memory/5080-9-0x00000000000E0000-0x0000000000D37000-memory.dmp
memory/5080-0-0x00000000000E0000-0x0000000000D37000-memory.dmp
memory/5080-22-0x00000000000E0000-0x0000000000D37000-memory.dmp
memory/5080-2-0x00000000000E0000-0x0000000000D37000-memory.dmp
memory/5080-3-0x00000000000E0000-0x0000000000D37000-memory.dmp
memory/5080-7-0x00000000000E0000-0x0000000000D37000-memory.dmp
memory/5632-167-0x0000000000060000-0x0000000000CB7000-memory.dmp
memory/6068-41-0x0000000000100000-0x0000000000D57000-memory.dmp
memory/6068-33-0x0000000000100000-0x0000000000D57000-memory.dmp