Analysis
- max time kernel
148s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
08/05/2026, 18:45
General
- Target _300466d2b1311e767edc13ee6ffed1e50023d0319efde61bb5b7da2cd70f1c48.exe
- Size 5.4MB
- Sample260508-xecmjacv8t
- SHA256 300466d2b1311e767edc13ee6ffed1e50023d0319efde61bb5b7da2cd70f1c48
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 33 IoCs
- Executes dropped EXE 3 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- UPX packed file 38 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\_300466d2b1311e767edc13ee6ffed1e50023d0319efde61bb5b7da2cd70f1c48.exe"C:\Users\Admin\AppData\Local\Temp\_300466d2b1311e767edc13ee6ffed1e50023d0319efde61bb5b7da2cd70f1c48.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Mozilla\services.exeC:\Users\Admin\AppData\Local\Mozilla\services.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\services.exe"C:\Program Files (x86)\Microsoft\Edge\Application\services.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Google\Chrome\Application\services.exe"C:\Program Files\Google\Chrome\Application\services.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
svc_8e4ef5a8.log
svc_8e4ef5a8.log
svc_8e4ef5a8.log
svc_8e4ef5a8.log
svc_8e4ef5a8.log
svc_8e4ef5a8.log
svc_8e4ef5a8.log
svc_8e4ef5a8.log
svc_8e4ef5a8.log
svc_8e4ef5a8.log
services.exe
__PSScriptPolicyTest_z0dsmhnb.5od.ps1
memory/1712-241-0x00000000002A0000-0x0000000000818000-memory.dmp
memory/1712-242-0x0000000001A40000-0x0000000001B52000-memory.dmp
memory/1712-232-0x0000000004000000-0x0000000004C5D000-memory.dmp
memory/1712-233-0x0000000004000000-0x0000000004C5D000-memory.dmp
memory/1712-238-0x0000000004000000-0x0000000004C5D000-memory.dmp
memory/1712-231-0x0000000004000000-0x0000000004C5D000-memory.dmp
memory/2336-170-0x0000000004000000-0x0000000004C5D000-memory.dmp
memory/2336-166-0x0000000004000000-0x0000000004C5D000-memory.dmp
memory/2336-168-0x0000000004000000-0x0000000004C5D000-memory.dmp
memory/2336-167-0x0000000004000000-0x0000000004C5D000-memory.dmp
memory/2336-165-0x0000000004000000-0x0000000004C5D000-memory.dmp
memory/2336-164-0x0000000004000000-0x0000000004C5D000-memory.dmp
memory/2336-174-0x0000000001A00000-0x0000000001B12000-memory.dmp
memory/2336-173-0x0000000000AC0000-0x0000000001038000-memory.dmp
memory/2336-131-0x0000000004000000-0x0000000004C5D000-memory.dmp
memory/3344-46-0x0000000003900000-0x000000000455D000-memory.dmp
memory/3344-60-0x0000000001150000-0x0000000001262000-memory.dmp
memory/3344-14-0x0000000003900000-0x000000000455D000-memory.dmp
memory/3344-33-0x0000000003900000-0x000000000455D000-memory.dmp
memory/3344-35-0x0000000003900000-0x000000000455D000-memory.dmp
memory/3344-36-0x0000000003900000-0x000000000455D000-memory.dmp
memory/3344-38-0x0000000003900000-0x000000000455D000-memory.dmp
memory/3344-39-0x0000000003900000-0x000000000455D000-memory.dmp
memory/3344-37-0x0000000003900000-0x000000000455D000-memory.dmp
memory/3344-34-0x0000000003900000-0x000000000455D000-memory.dmp
memory/3344-40-0x00000000009D0000-0x0000000000F48000-memory.dmp
memory/3344-42-0x0000000003900000-0x000000000455D000-memory.dmp
memory/3344-41-0x0000000001150000-0x0000000001262000-memory.dmp
memory/3344-43-0x0000000003900000-0x000000000455D000-memory.dmp
memory/3344-47-0x0000000003900000-0x000000000455D000-memory.dmp
memory/3344-53-0x0000000003900000-0x000000000455D000-memory.dmp
memory/3344-59-0x00000000009D0000-0x0000000000F48000-memory.dmp
memory/4344-109-0x0000000003E00000-0x0000000004A5D000-memory.dmp
memory/4344-101-0x0000000003E00000-0x0000000004A5D000-memory.dmp
memory/4344-237-0x0000000001800000-0x0000000001912000-memory.dmp
memory/4344-95-0x0000000003E00000-0x0000000004A5D000-memory.dmp
memory/4344-99-0x0000000003E00000-0x0000000004A5D000-memory.dmp
memory/4344-98-0x0000000003E00000-0x0000000004A5D000-memory.dmp
memory/4344-114-0x0000000003E00000-0x0000000004A5D000-memory.dmp
memory/4344-96-0x0000000003E00000-0x0000000004A5D000-memory.dmp
memory/4344-110-0x0000000003E00000-0x0000000004A5D000-memory.dmp
memory/4344-76-0x0000000003E00000-0x0000000004A5D000-memory.dmp
memory/4344-108-0x0000000003E00000-0x0000000004A5D000-memory.dmp
memory/4344-105-0x0000000003E00000-0x0000000004A5D000-memory.dmp
memory/4344-104-0x0000000003E00000-0x0000000004A5D000-memory.dmp
memory/4344-102-0x00000000009B0000-0x0000000000F28000-memory.dmp
memory/4344-103-0x0000000001800000-0x0000000001912000-memory.dmp
memory/4344-97-0x0000000003E00000-0x0000000004A5D000-memory.dmp
memory/4344-100-0x0000000003E00000-0x0000000004A5D000-memory.dmp
memory/5168-146-0x0000000005350000-0x0000000005372000-memory.dmp
memory/5168-184-0x0000000007D10000-0x0000000007D2E000-memory.dmp
memory/5168-176-0x0000000070580000-0x00000000705CC000-memory.dmp
memory/5168-175-0x0000000007CD0000-0x0000000007D04000-memory.dmp
memory/5168-187-0x0000000007E70000-0x0000000007E8A000-memory.dmp
memory/5168-186-0x00000000084A0000-0x0000000008B1A000-memory.dmp
memory/5168-185-0x0000000007D30000-0x0000000007DD4000-memory.dmp
memory/5168-209-0x0000000007EC0000-0x0000000007ECA000-memory.dmp
memory/5168-210-0x0000000008020000-0x00000000080B6000-memory.dmp
memory/5168-177-0x00000000706F0000-0x0000000070A47000-memory.dmp
memory/5168-211-0x0000000007ED0000-0x0000000007EE1000-memory.dmp
memory/5168-169-0x0000000006E10000-0x0000000006E56000-memory.dmp
memory/5168-230-0x0000000007F10000-0x0000000007F1E000-memory.dmp
memory/5168-163-0x00000000068A0000-0x00000000068EC000-memory.dmp
memory/5168-162-0x0000000006860000-0x000000000687E000-memory.dmp
memory/5168-161-0x0000000006340000-0x0000000006697000-memory.dmp
memory/5168-234-0x0000000007F20000-0x0000000007F35000-memory.dmp
memory/5168-236-0x0000000007FA0000-0x0000000007FBA000-memory.dmp
memory/5168-147-0x0000000006260000-0x00000000062C6000-memory.dmp
memory/5168-148-0x00000000062D0000-0x0000000006336000-memory.dmp
memory/5168-140-0x0000000005470000-0x0000000005A9A000-memory.dmp
memory/5168-139-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/5168-243-0x0000000007F80000-0x0000000007F88000-memory.dmp
memory/5168-247-0x00000000028C0000-0x00000000028D3000-memory.dmp
memory/5168-246-0x0000000000DE0000-0x0000000000DFA000-memory.dmp
memory/5168-249-0x00000000051D0000-0x00000000051E5000-memory.dmp
memory/5168-248-0x0000000005AA0000-0x00000000060A2000-memory.dmp