Analysis
- max time kernel
111s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
04/05/2026, 12:22
General
- Target 2026-05-04_d7d7138e57873ed50afd8aa45174aa2d_elex_hive.exe
- Size 3.1MB
- Sample260504-pkeebaa19s
- SHA256 c8608c3448b2e65cb0740a85b04b354832163cc936c27643f32219b3f5d0ff42
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 13 IoCs
- Custom signatureDetect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 13 IoCs
- Custom signatureDetects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 13 IoCs
- Custom signatureDetects executables containing SQL queries to confidential data stores. Observed in infostealers 13 IoCs
- Custom signatureUPX dump on OEP (original entry point) 18 IoCs
- Executes dropped EXE 1 IoCs
- UPX packed file 19 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_d7d7138e57873ed50afd8aa45174aa2d_elex_hive.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-04_d7d7138e57873ed50afd8aa45174aa2d_elex_hive.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\PeerDistRepub\sihost.exeC:\Users\Admin\AppData\Local\PeerDistRepub\sihost.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\sihost.exe"C:\Program Files (x86)\Microsoft\Edge\Application\sihost.exe" -3⤵
-
-
C:\Program Files\Google\Chrome\Application\sihost.exe"C:\Program Files\Google\Chrome\Application\sihost.exe" -3⤵
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
sihost.exe
__PSScriptPolicyTest_ho2unhfk.zyc.ps1
memory/2496-79-0x00000000079C0000-0x0000000007A56000-memory.dmp
memory/2496-66-0x0000000007780000-0x00000000077B2000-memory.dmp
memory/2496-90-0x0000000005830000-0x000000000592A000-memory.dmp
memory/2496-91-0x00000000050F0000-0x00000000050FE000-memory.dmp
memory/2496-89-0x0000000004F80000-0x0000000004F92000-memory.dmp
memory/2496-86-0x00000000089D0000-0x0000000008F74000-memory.dmp
memory/2496-85-0x00000000083F0000-0x0000000008412000-memory.dmp
memory/2496-57-0x0000000006770000-0x00000000067B4000-memory.dmp
memory/2496-83-0x00000000079A0000-0x00000000079BA000-memory.dmp
memory/2496-82-0x0000000007960000-0x0000000007974000-memory.dmp
memory/2496-81-0x0000000007950000-0x000000000795E000-memory.dmp
memory/2496-80-0x0000000007920000-0x0000000007931000-memory.dmp
memory/2496-67-0x0000000070C60000-0x0000000070CAC000-memory.dmp
memory/2496-29-0x0000000004BC0000-0x0000000004BD0000-memory.dmp
memory/2496-36-0x0000000005200000-0x0000000005828000-memory.dmp
memory/2496-78-0x00000000078E0000-0x00000000078EA000-memory.dmp
memory/2496-30-0x0000000004B20000-0x0000000004B56000-memory.dmp
memory/2496-37-0x0000000005120000-0x0000000005142000-memory.dmp
memory/2496-38-0x00000000059A0000-0x0000000005A06000-memory.dmp
memory/2496-39-0x0000000005AC0000-0x0000000005B26000-memory.dmp
memory/2496-68-0x00000000713E0000-0x0000000071734000-memory.dmp
memory/2496-47-0x0000000005C30000-0x0000000005F84000-memory.dmp
memory/2496-76-0x00000000077C0000-0x00000000077DE000-memory.dmp
memory/2496-77-0x00000000077E0000-0x0000000007883000-memory.dmp
memory/2496-51-0x0000000006230000-0x000000000627C000-memory.dmp
memory/2496-50-0x0000000006200000-0x000000000621E000-memory.dmp
memory/2496-62-0x0000000007C40000-0x00000000082BA000-memory.dmp
memory/2496-84-0x0000000007990000-0x0000000007998000-memory.dmp
memory/2496-63-0x00000000075C0000-0x00000000075DA000-memory.dmp
memory/2496-61-0x0000000007340000-0x00000000073B6000-memory.dmp
memory/3012-48-0x0000000000450000-0x0000000000FD9000-memory.dmp
memory/3012-35-0x0000000000450000-0x0000000000FD9000-memory.dmp
memory/3012-49-0x0000000023810000-0x000000002388A000-memory.dmp
memory/4084-60-0x0000000000A60000-0x00000000015E9000-memory.dmp
memory/4084-56-0x0000000000A60000-0x00000000015E9000-memory.dmp
memory/4084-59-0x0000000023E20000-0x0000000023E9A000-memory.dmp
memory/4920-5-0x0000000000F70000-0x0000000001AF9000-memory.dmp
memory/4920-14-0x0000000000F70000-0x0000000001AF9000-memory.dmp
memory/4920-1-0x0000000000F70000-0x0000000001AF9000-memory.dmp
memory/4920-15-0x0000000024330000-0x00000000243AA000-memory.dmp
memory/4920-0-0x0000000000F70000-0x0000000001AF9000-memory.dmp
memory/4920-2-0x0000000024330000-0x00000000243AA000-memory.dmp
memory/4920-3-0x0000000000F70000-0x0000000001AF9000-memory.dmp
memory/5972-65-0x0000000023AE0000-0x0000000023B5A000-memory.dmp
memory/5972-20-0x0000000023AE0000-0x0000000023B5A000-memory.dmp
memory/5972-18-0x0000000023AE0000-0x0000000023B5A000-memory.dmp
memory/5972-17-0x0000000000C40000-0x00000000017C9000-memory.dmp
memory/5972-19-0x0000000000C40000-0x00000000017C9000-memory.dmp
memory/5972-16-0x0000000000C40000-0x00000000017C9000-memory.dmp
memory/5972-25-0x0000000000C40000-0x00000000017C9000-memory.dmp
memory/5972-64-0x0000000000C40000-0x00000000017C9000-memory.dmp
memory/5972-21-0x0000000000C40000-0x00000000017C9000-memory.dmp
memory/5972-92-0x0000000000C40000-0x00000000017C9000-memory.dmp
memory/5972-94-0x0000000000C40000-0x00000000017C9000-memory.dmp
memory/5972-96-0x0000000000C40000-0x00000000017C9000-memory.dmp