Resubmissions
23/04/2026, 12:55
260423-p5zkzscy6m1020/04/2026, 17:04
260420-vlm1qsaz7k1020/04/2026, 17:04
260420-vll4faaz7j1020/04/2026, 17:02
260420-vkhpmaaz6k1020/04/2026, 17:02
260420-vkggkaaz5r1020/04/2026, 17:01
260420-vjqzlscx811020/04/2026, 17:00
260420-vh84sscx8v1020/04/2026, 16:59
260420-vhq8zscx7s1020/04/2026, 16:58
260420-vg7vcacx6v1020/04/2026, 16:57
260420-vggyxscx5z10Analysis
- max time kernel
599s - max time network
607s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
20/04/2026, 15:22
General
- Target keshka.exe
- Size 3.4MB
- Sample260420-srycjsd17l
- SHA256 897b5101cafb0a9104381e8cd260c932df8cc2162bd2d4f26ba968f4b70c63e8
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 60 IoCs
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 7 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\keshka.exe"C:\Users\Admin\AppData\Local\Temp\keshka.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\wininit.exe"C:\Program Files (x86)\Internet Explorer\wininit.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\wininit.exe"C:\Program Files (x86)\Microsoft\Edge\Application\wininit.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Google\Chrome\Application\wininit.exe"C:\Program Files\Google\Chrome\Application\wininit.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Comms\sppsvc.exeC:\Users\Admin\AppData\Local\Comms\sppsvc.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Internet Explorer\wininit.exe"C:\Program Files (x86)\Internet Explorer\wininit.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Comms\sppsvc.exeC:\Users\Admin\AppData\Local\Comms\sppsvc.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Internet Explorer\wininit.exe"C:\Program Files (x86)\Internet Explorer\wininit.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
wininit.exe
__PSScriptPolicyTest_eq2fqj4m.jd1.ps1
memory/244-151-0x0000000000AF0000-0x0000000001747000-memory.dmp
memory/464-50-0x0000020DE4480000-0x0000020DE44DD000-memory.dmp
memory/952-154-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/952-153-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/2084-29-0x0000000000620000-0x0000000001277000-memory.dmp
memory/2084-41-0x0000000000620000-0x0000000001277000-memory.dmp
memory/2472-51-0x000001F032F10000-0x000001F032F6D000-memory.dmp
memory/3168-130-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-138-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-181-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-179-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-177-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-175-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-19-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-173-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-171-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-169-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-18-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-167-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-165-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-15-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-163-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-161-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-159-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-157-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-155-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-149-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-146-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-144-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-142-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-94-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-140-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-92-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-136-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-134-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-132-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-128-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-126-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-124-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-122-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-96-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-118-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-116-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-114-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-108-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-104-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-81-0x0000000024F40000-0x0000000024F8A000-memory.dmp
memory/3168-80-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-82-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-84-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-86-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-88-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-90-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-20-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-102-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-120-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-98-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3168-100-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/3440-0-0x0000000000F30000-0x0000000001B87000-memory.dmp
memory/3440-16-0x0000000000F30000-0x0000000001B87000-memory.dmp
memory/3440-5-0x0000000000F30000-0x0000000001B87000-memory.dmp
memory/3440-1-0x0000000000F30000-0x0000000001B87000-memory.dmp
memory/3440-2-0x0000000000F30000-0x0000000001B87000-memory.dmp
memory/3440-3-0x0000000000F30000-0x0000000001B87000-memory.dmp
memory/3652-107-0x0000000000AF0000-0x0000000001747000-memory.dmp
memory/3652-110-0x0000000000AF0000-0x0000000001747000-memory.dmp
memory/5232-48-0x0000000000570000-0x00000000011C7000-memory.dmp
memory/5232-52-0x0000000000570000-0x00000000011C7000-memory.dmp
memory/5472-63-0x00000000078C0000-0x0000000007964000-memory.dmp
memory/5472-74-0x0000000008C60000-0x0000000009206000-memory.dmp
memory/5472-70-0x0000000007AC0000-0x0000000007AD5000-memory.dmp
memory/5472-69-0x0000000007AB0000-0x0000000007ABE000-memory.dmp
memory/5472-68-0x0000000007A70000-0x0000000007A81000-memory.dmp
memory/5472-72-0x0000000007B10000-0x0000000007B18000-memory.dmp
memory/5472-55-0x0000000070220000-0x0000000070577000-memory.dmp
memory/5472-66-0x0000000007A50000-0x0000000007A5A000-memory.dmp
memory/5472-64-0x0000000008030000-0x00000000086AA000-memory.dmp
memory/5472-62-0x00000000078A0000-0x00000000078BE000-memory.dmp
memory/5472-65-0x0000000007A00000-0x0000000007A1A000-memory.dmp
memory/5472-67-0x0000000007BA0000-0x0000000007C36000-memory.dmp
memory/5472-54-0x0000000070050000-0x000000007009C000-memory.dmp
memory/5472-53-0x0000000007860000-0x0000000007894000-memory.dmp
memory/5472-73-0x0000000007B30000-0x0000000007B52000-memory.dmp
memory/5472-71-0x0000000007B20000-0x0000000007B3A000-memory.dmp
memory/5472-78-0x0000000005370000-0x0000000005385000-memory.dmp
memory/5472-22-0x0000000004FC0000-0x0000000004FD0000-memory.dmp
memory/5472-24-0x0000000004E10000-0x0000000004E46000-memory.dmp
memory/5472-79-0x00000000061F0000-0x0000000006254000-memory.dmp
memory/5472-49-0x00000000069F0000-0x0000000006A36000-memory.dmp
memory/5472-77-0x0000000004DD0000-0x0000000004DE3000-memory.dmp
memory/5472-42-0x0000000006420000-0x000000000643E000-memory.dmp
memory/5472-43-0x0000000006470000-0x00000000064BC000-memory.dmp
memory/5472-40-0x0000000005E90000-0x00000000061E7000-memory.dmp
memory/5472-33-0x0000000005D50000-0x0000000005DB6000-memory.dmp
memory/5472-32-0x0000000005CE0000-0x0000000005D46000-memory.dmp
memory/5472-31-0x0000000005C30000-0x0000000005C52000-memory.dmp
memory/5472-30-0x0000000004FC0000-0x0000000004FD0000-memory.dmp
memory/5472-28-0x0000000005600000-0x0000000005C2A000-memory.dmp
memory/5476-112-0x00000000006C0000-0x0000000001317000-memory.dmp
memory/5476-113-0x00000000006C0000-0x0000000001317000-memory.dmp