Resubmissions
23/04/2026, 12:55
260423-p5zkzscy6m1020/04/2026, 17:04
260420-vlm1qsaz7k1020/04/2026, 17:04
260420-vll4faaz7j1020/04/2026, 17:02
260420-vkhpmaaz6k1020/04/2026, 17:02
260420-vkggkaaz5r1020/04/2026, 17:01
260420-vjqzlscx811020/04/2026, 17:00
260420-vh84sscx8v1020/04/2026, 16:59
260420-vhq8zscx7s1020/04/2026, 16:58
260420-vg7vcacx6v1020/04/2026, 16:57
260420-vggyxscx5z10Analysis
- geolocation tags
- max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
20/04/2026, 17:04
General
- Target keshka.exe
- Size 3.4MB
- Sample260420-vll4faaz7j
- SHA256 897b5101cafb0a9104381e8cd260c932df8cc2162bd2d4f26ba968f4b70c63e8
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 21 IoCs
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 5 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- UPX packed file 28 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\keshka.exe"C:\Users\Admin\AppData\Local\Temp\keshka.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows NT\dwm.exe"C:\Program Files (x86)\Windows NT\dwm.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\dwm.exe"C:\Program Files (x86)\Microsoft\Edge\Application\dwm.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Google\Chrome\Application\dwm.exe"C:\Program Files\Google\Chrome\Application\dwm.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft.NET\lsass.exe"C:\Program Files (x86)\Microsoft.NET\lsass.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Windows NT\dwm.exe"C:\Program Files (x86)\Windows NT\dwm.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
dwm.exe
__PSScriptPolicyTest_iv2b0rrk.gzb.ps1
memory/780-51-0x000002047EBD0000-0x000002047EC7F000-memory.dmp
memory/980-62-0x000001B451FB0000-0x000001B45205F000-memory.dmp
memory/1352-50-0x0000000000860000-0x00000000014B7000-memory.dmp
memory/1352-64-0x0000000022700000-0x00000000227DF000-memory.dmp
memory/1352-66-0x0000000000860000-0x00000000014B7000-memory.dmp
memory/2492-93-0x0000000000C00000-0x0000000001857000-memory.dmp
memory/2492-96-0x0000000000C00000-0x0000000001857000-memory.dmp
memory/2492-98-0x0000000022500000-0x00000000225DF000-memory.dmp
memory/2500-112-0x0000000000C00000-0x0000000001857000-memory.dmp
memory/2500-110-0x0000000000C00000-0x0000000001857000-memory.dmp
memory/2500-16-0x0000000000C00000-0x0000000001857000-memory.dmp
memory/2500-69-0x0000000000C00000-0x0000000001857000-memory.dmp
memory/2500-116-0x0000000000C00000-0x0000000001857000-memory.dmp
memory/2500-114-0x0000000000C00000-0x0000000001857000-memory.dmp
memory/2500-19-0x0000000000C00000-0x0000000001857000-memory.dmp
memory/2500-90-0x0000000000C00000-0x0000000001857000-memory.dmp
memory/2500-108-0x0000000000C00000-0x0000000001857000-memory.dmp
memory/2500-106-0x0000000000C00000-0x0000000001857000-memory.dmp
memory/2500-104-0x0000000000C00000-0x0000000001857000-memory.dmp
memory/2500-18-0x0000000000C00000-0x0000000001857000-memory.dmp
memory/2500-102-0x0000000000C00000-0x0000000001857000-memory.dmp
memory/2500-17-0x00000000227C0000-0x000000002289F000-memory.dmp
memory/2500-15-0x0000000000C00000-0x0000000001857000-memory.dmp
memory/3032-25-0x0000000000A50000-0x00000000016A7000-memory.dmp
memory/3032-44-0x0000000022700000-0x00000000227DF000-memory.dmp
memory/3032-43-0x0000000000A50000-0x00000000016A7000-memory.dmp
memory/3076-97-0x00000000002A0000-0x0000000000EF7000-memory.dmp
memory/3076-100-0x0000000022200000-0x00000000222DF000-memory.dmp
memory/3076-101-0x00000000002A0000-0x0000000000EF7000-memory.dmp
memory/3480-12-0x0000000000CB0000-0x0000000001907000-memory.dmp
memory/3480-14-0x0000000022640000-0x000000002271F000-memory.dmp
memory/3480-4-0x0000000000CB0000-0x0000000001907000-memory.dmp
memory/3480-3-0x0000000000CB0000-0x0000000001907000-memory.dmp
memory/3480-2-0x0000000022640000-0x000000002271F000-memory.dmp
memory/3480-1-0x0000000000CB0000-0x0000000001907000-memory.dmp
memory/3480-0-0x0000000000CB0000-0x0000000001907000-memory.dmp
memory/4344-42-0x00000179AAD30000-0x00000179AADDF000-memory.dmp
memory/5000-61-0x0000000007BE0000-0x0000000007BFE000-memory.dmp
memory/5000-53-0x0000000070720000-0x000000007076C000-memory.dmp
memory/5000-52-0x0000000007BA0000-0x0000000007BD4000-memory.dmp
memory/5000-71-0x0000000007D80000-0x0000000007D8A000-memory.dmp
memory/5000-72-0x0000000007ED0000-0x0000000007F66000-memory.dmp
memory/5000-73-0x0000000007DA0000-0x0000000007DB1000-memory.dmp
memory/5000-74-0x0000000007DE0000-0x0000000007DEE000-memory.dmp
memory/5000-75-0x0000000007DF0000-0x0000000007E05000-memory.dmp
memory/5000-76-0x0000000007E50000-0x0000000007E6A000-memory.dmp
memory/5000-77-0x0000000007E40000-0x0000000007E48000-memory.dmp
memory/5000-78-0x0000000007E60000-0x0000000007E82000-memory.dmp
memory/5000-79-0x0000000008F90000-0x0000000009536000-memory.dmp
memory/5000-81-0x0000000002D90000-0x0000000002DA3000-memory.dmp
memory/5000-83-0x0000000002DC0000-0x0000000002DD0000-memory.dmp
memory/5000-82-0x0000000005790000-0x00000000057A5000-memory.dmp
memory/5000-80-0x0000000001300000-0x00000000013DF000-memory.dmp
memory/5000-84-0x0000000002DC0000-0x0000000002DD0000-memory.dmp
memory/5000-88-0x0000000002D90000-0x0000000002DA3000-memory.dmp
memory/5000-89-0x0000000005790000-0x00000000057A5000-memory.dmp
memory/5000-87-0x0000000001300000-0x00000000013DF000-memory.dmp
memory/5000-68-0x0000000007D30000-0x0000000007D4A000-memory.dmp
memory/5000-67-0x0000000008360000-0x00000000089DA000-memory.dmp
memory/5000-65-0x0000000007C00000-0x0000000007CA4000-memory.dmp
memory/5000-54-0x0000000070950000-0x0000000070CA7000-memory.dmp
memory/5000-45-0x0000000006C80000-0x0000000006CC6000-memory.dmp
memory/5000-41-0x00000000067D0000-0x000000000681C000-memory.dmp
memory/5000-40-0x0000000006710000-0x000000000672E000-memory.dmp
memory/5000-39-0x0000000006200000-0x0000000006557000-memory.dmp
memory/5000-32-0x0000000006190000-0x00000000061F6000-memory.dmp
memory/5000-31-0x0000000006120000-0x0000000006186000-memory.dmp
memory/5000-30-0x0000000005830000-0x0000000005852000-memory.dmp
memory/5000-29-0x0000000005880000-0x0000000005EAA000-memory.dmp
memory/5000-28-0x0000000002DC0000-0x0000000002DD0000-memory.dmp
memory/5000-27-0x0000000002E10000-0x0000000002E46000-memory.dmp
memory/5000-26-0x0000000002DC0000-0x0000000002DD0000-memory.dmp