Analysis
- max time kernel
148s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
08/05/2026, 18:45
General
- Target _300466d2b1311e767edc13ee6ffed1e50023d0319efde61bb5b7da2cd70f1c48.exe
- Size 5.4MB
- Sample260508-xecmjacv8t
- SHA256 300466d2b1311e767edc13ee6ffed1e50023d0319efde61bb5b7da2cd70f1c48
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 37 IoCs
- Executes dropped EXE 3 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- UPX packed file 43 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\_300466d2b1311e767edc13ee6ffed1e50023d0319efde61bb5b7da2cd70f1c48.exe"C:\Users\Admin\AppData\Local\Temp\_300466d2b1311e767edc13ee6ffed1e50023d0319efde61bb5b7da2cd70f1c48.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Google\SIHClient.exeC:\Users\Admin\AppData\Local\Google\SIHClient.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\SIHClient.exe"C:\Program Files (x86)\Microsoft\Edge\Application\SIHClient.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Google\Chrome\Application\SIHClient.exe"C:\Program Files\Google\Chrome\Application\SIHClient.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
svc_8e4ef5a8.log
svc_8e4ef5a8.log
svc_8e4ef5a8.log
svc_8e4ef5a8.log
svc_8e4ef5a8.log
svc_8e4ef5a8.log
svc_8e4ef5a8.log
svc_8e4ef5a8.log
svc_8e4ef5a8.log
svc_8e4ef5a8.log
svc_8e4ef5a8.log
svc_8e4ef5a8.log
SIHClient.exe
__PSScriptPolicyTest_hcys0tf0.yu0.ps1
memory/2368-167-0x0000000003980000-0x00000000045DD000-memory.dmp
memory/2368-165-0x0000000003980000-0x00000000045DD000-memory.dmp
memory/2368-168-0x0000000003980000-0x00000000045DD000-memory.dmp
memory/2368-163-0x0000000003980000-0x00000000045DD000-memory.dmp
memory/2368-172-0x0000000000F00000-0x0000000001478000-memory.dmp
memory/2368-169-0x0000000003980000-0x00000000045DD000-memory.dmp
memory/2368-130-0x0000000003980000-0x00000000045DD000-memory.dmp
memory/2368-164-0x0000000003980000-0x00000000045DD000-memory.dmp
memory/2368-166-0x0000000003980000-0x00000000045DD000-memory.dmp
memory/2496-216-0x0000000003420000-0x000000000407D000-memory.dmp
memory/2496-213-0x0000000003420000-0x000000000407D000-memory.dmp
memory/2496-215-0x0000000003420000-0x000000000407D000-memory.dmp
memory/2496-214-0x0000000003420000-0x000000000407D000-memory.dmp
memory/2496-212-0x0000000003420000-0x000000000407D000-memory.dmp
memory/2496-192-0x0000000003420000-0x000000000407D000-memory.dmp
memory/2496-218-0x0000000003420000-0x000000000407D000-memory.dmp
memory/2496-223-0x0000000000990000-0x0000000000F08000-memory.dmp
memory/3884-133-0x0000000004E20000-0x0000000005448000-memory.dmp
memory/3884-235-0x0000000007230000-0x00000000072D3000-memory.dmp
memory/3884-245-0x0000000004AD0000-0x0000000004AE2000-memory.dmp
memory/3884-246-0x0000000004C40000-0x0000000004C4B000-memory.dmp
memory/3884-242-0x00000000073D0000-0x00000000073D8000-memory.dmp
memory/3884-241-0x00000000074A0000-0x00000000074BA000-memory.dmp
memory/3884-240-0x00000000073A0000-0x00000000073B4000-memory.dmp
memory/3884-116-0x00000000047E0000-0x00000000047F0000-memory.dmp
memory/3884-117-0x0000000002300000-0x0000000002336000-memory.dmp
memory/3884-239-0x0000000007390000-0x000000000739E000-memory.dmp
memory/3884-238-0x0000000007360000-0x0000000007371000-memory.dmp
memory/3884-224-0x00000000071D0000-0x0000000007202000-memory.dmp
memory/3884-225-0x0000000070170000-0x00000000701BC000-memory.dmp
memory/3884-237-0x0000000007400000-0x0000000007496000-memory.dmp
memory/3884-150-0x0000000004C70000-0x0000000004C92000-memory.dmp
memory/3884-152-0x00000000055C0000-0x0000000005626000-memory.dmp
memory/3884-151-0x0000000005550000-0x00000000055B6000-memory.dmp
memory/3884-236-0x0000000007330000-0x000000000733A000-memory.dmp
memory/3884-160-0x0000000005630000-0x0000000005984000-memory.dmp
memory/3884-162-0x0000000005CB0000-0x0000000005CFC000-memory.dmp
memory/3884-161-0x0000000005C70000-0x0000000005C8E000-memory.dmp
memory/3884-226-0x0000000070530000-0x0000000070884000-memory.dmp
memory/3884-234-0x0000000007210000-0x000000000722E000-memory.dmp
memory/3884-222-0x0000000007010000-0x000000000702A000-memory.dmp
memory/3884-219-0x0000000007690000-0x0000000007D0A000-memory.dmp
memory/3884-217-0x0000000006D90000-0x0000000006E06000-memory.dmp
memory/3884-211-0x00000000061D0000-0x0000000006214000-memory.dmp
memory/4740-33-0x0000000003230000-0x0000000003E8D000-memory.dmp
memory/4740-42-0x0000000003230000-0x0000000003E8D000-memory.dmp
memory/4740-41-0x0000000003230000-0x0000000003E8D000-memory.dmp
memory/4740-40-0x00000000000A0000-0x0000000000618000-memory.dmp
memory/4740-14-0x0000000003230000-0x0000000003E8D000-memory.dmp
memory/4740-38-0x0000000003230000-0x0000000003E8D000-memory.dmp
memory/4740-47-0x0000000003230000-0x0000000003E8D000-memory.dmp
memory/4740-39-0x0000000003230000-0x0000000003E8D000-memory.dmp
memory/4740-37-0x0000000003230000-0x0000000003E8D000-memory.dmp
memory/4740-36-0x0000000003230000-0x0000000003E8D000-memory.dmp
memory/4740-34-0x0000000003230000-0x0000000003E8D000-memory.dmp
memory/4740-35-0x0000000003230000-0x0000000003E8D000-memory.dmp
memory/4740-54-0x0000000003230000-0x0000000003E8D000-memory.dmp
memory/4740-61-0x00000000000A0000-0x0000000000618000-memory.dmp
memory/4740-46-0x0000000003230000-0x0000000003E8D000-memory.dmp
memory/5312-75-0x0000000003A70000-0x00000000046CD000-memory.dmp
memory/5312-98-0x0000000003A70000-0x00000000046CD000-memory.dmp
memory/5312-103-0x0000000003A70000-0x00000000046CD000-memory.dmp
memory/5312-95-0x0000000003A70000-0x00000000046CD000-memory.dmp
memory/5312-97-0x0000000003A70000-0x00000000046CD000-memory.dmp
memory/5312-96-0x0000000003A70000-0x00000000046CD000-memory.dmp
memory/5312-100-0x0000000003A70000-0x00000000046CD000-memory.dmp
memory/5312-94-0x0000000003A70000-0x00000000046CD000-memory.dmp
memory/5312-199-0x0000000003A70000-0x00000000046CD000-memory.dmp
memory/5312-99-0x0000000003A70000-0x00000000046CD000-memory.dmp
memory/5312-101-0x0000000000E90000-0x0000000001408000-memory.dmp
memory/5312-102-0x0000000003A70000-0x00000000046CD000-memory.dmp
memory/5312-112-0x0000000003A70000-0x00000000046CD000-memory.dmp
memory/5312-107-0x0000000003A70000-0x00000000046CD000-memory.dmp
memory/5312-106-0x0000000003A70000-0x00000000046CD000-memory.dmp
memory/5312-105-0x0000000003A70000-0x00000000046CD000-memory.dmp