Overview

overview

10

Static

static

3

2026-05-23...rm.exe

windows10-2004-x64

10

2026-05-23...rm.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    137s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    23/05/2026, 22:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-23_cb77e58bff38645513664ec1ec4e255a_akira_amadey_elex_glassworm.exe
  • Size 9.9MB
  • Sample260523-11tpqaew3w
  • SHA256 1a305f9d796d3fb1557c8b6ae12118b83b08422c3d94fd3f8cb7aac01b2c759e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdiscoverysalatstealerspywarestealerupx

Malware Config

Signatures

  • Family: salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer
  • Detect SalatStealer payload 47 IoCs
  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 47 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 47 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 47 IoCs
  • UPX dump on OEP (original entry point) 58 IoCs
  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • UPX packed file 59 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-23_cb77e58bff38645513664ec1ec4e255a_akira_amadey_elex_glassworm.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-23_cb77e58bff38645513664ec1ec4e255a_akira_amadey_elex_glassworm.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2344
    • C:\Users\Admin\AppData\Local\Temp\GpuService_043d93.exe
      "C:\Users\Admin\AppData\Local\Temp\GpuService_043d93.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3188
      • C:\Users\Admin\AppData\Local\Google\fontdrvhost.exe
        C:\Users\Admin\AppData\Local\Google\fontdrvhost.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2200
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe
          4⤵
          • Badlisted process makes network request
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4952
        • C:\Program Files (x86)\Microsoft\Edge\Application\fontdrvhost.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\fontdrvhost.exe" -
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4968
        • C:\Program Files\Google\Chrome\Application\fontdrvhost.exe
          "C:\Program Files\Google\Chrome\Application\fontdrvhost.exe" -
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1048
    • C:\Users\Admin\AppData\Local\PeerDistRepub\dllhost.exe
      C:\Users\Admin\AppData\Local\PeerDistRepub\dllhost.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1944
      • C:\Users\Admin\AppData\Local\Temp\GpuService_043d93.exe
        "C:\Users\Admin\AppData\Local\Temp\GpuService_043d93.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4648
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe
        3⤵
          PID:2304
          • C:\Windows\SysWOW64\ReAgentc.exe
            "C:\Windows\system32\ReAgentc.exe" /disable
            4⤵
              PID:2704
          • C:\Program Files\Google\Chrome\Application\dllhost.exe
            "C:\Program Files\Google\Chrome\Application\dllhost.exe" -
            3⤵
              PID:4744
              • C:\Users\Admin\AppData\Local\Temp\GpuService_043d93.exe
                "C:\Users\Admin\AppData\Local\Temp\GpuService_043d93.exe"
                4⤵
                  PID:3732
              • C:\Program Files (x86)\Microsoft\Edge\Application\dllhost.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\dllhost.exe" -
                3⤵
                  PID:4212
                  • C:\Users\Admin\AppData\Local\Temp\GpuService_043d93.exe
                    "C:\Users\Admin\AppData\Local\Temp\GpuService_043d93.exe"
                    4⤵
                      PID:4080
              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                1⤵
                  PID:4728
                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                  1⤵
                    PID:372
                  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                    1⤵
                      PID:4240
                    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                      1⤵
                        PID:2624
                      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                        1⤵
                          PID:2120

                        Network

                              MITRE ATT&CK Enterprise v16

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              svc_38ef42b7.log
                              • Path C:\ProgramData\svc_38ef42b7.log
                              • Size 2KB
                              • SHA256 562b8d12e676ac83823898a6884fa2b5d4e46da1b15d1413b4b181c3a39750dd
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              svc_38ef42b7.log
                              • Path C:\ProgramData\svc_38ef42b7.log
                              • Size 2KB
                              • SHA256 b630579ad36db6640e99d8361421c2d16d43d5360f4cf9750903727c109bd87a
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              svc_38ef42b7.log
                              • Path C:\ProgramData\svc_38ef42b7.log
                              • Size 609B
                              • SHA256 bdc72f6f260db0682fec1946dd01b2501feda696bb6c27cdbba323e63953de65
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              svc_38ef42b7.log
                              • Path C:\ProgramData\svc_38ef42b7.log
                              • Size 3KB
                              • SHA256 c1c48c194a2a5fb8406bacfc23c0a8d55e988b4e4212dbe849ad3cfb81310d08
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              svc_38ef42b7.log
                              • Path C:\ProgramData\svc_38ef42b7.log
                              • Size 3KB
                              • SHA256 c9d30d339d572c5d56686dbf464b12a4057e5eb1d32633978a29d3b31045dd49
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              svc_38ef42b7.log
                              • Path C:\ProgramData\svc_38ef42b7.log
                              • Size 927B
                              • SHA256 fc4feca92e2d41ae874f38a9181e54647c73ddf6481bef0d224a2aeb5e57517c
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              svc_38ef42b7.log
                              • Path C:\ProgramData\svc_38ef42b7.log
                              • Size 4KB
                              • SHA256 62c7c27ebfcfa937808d341c714b00f356c4bb1b58145b6a60f6502dde3a74bb
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              svc_38ef42b7.log
                              • Path C:\ProgramData\svc_38ef42b7.log
                              • Size 4KB
                              • SHA256 be15b722866b0782f37edd15713437ad902e6af0ffc009a0d8b9783ef015cb44
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              svc_38ef42b7.log
                              • Path C:\ProgramData\svc_38ef42b7.log
                              • Size 1KB
                              • SHA256 c383a2a8c896e67347941365b41cd09b754b735f169268904b88adb50cd0e81a
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              ModuleAnalysisCache
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                              • Size 53KB
                              • SHA256 a3d00d0ffedb7c7444e56f53931127873a2eda686cf36128128fc9d5da0b81b2
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              dllhost.exe
                              • Path C:\Users\Admin\AppData\Local\PeerDistRepub\dllhost.exe
                              • Size 9.9MB
                              • SHA256 1a305f9d796d3fb1557c8b6ae12118b83b08422c3d94fd3f8cb7aac01b2c759e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              852252244
                              • Path C:\Users\Admin\AppData\Local\Temp\852252244
                              • Size 224KB
                              • SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              GpuService_043d93.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\GpuService_043d93.exe
                              • Size 3.4MB
                              • SHA256 145e75c7e55b58a5167488fa514544a66a7f864474fa8f8b016de0aa29457ca3
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              __PSScriptPolicyTest_ej3vafzm.tkr.ps1
                              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ej3vafzm.tkr.ps1
                              • Size 60B
                              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              memory/1048-163-0x00000000000E0000-0x0000000000D36000-memory.dmp
                              Download

                              memory/1048-165-0x00000000000E0000-0x0000000000D36000-memory.dmp
                              Download

                              memory/1944-127-0x0000000003C50000-0x00000000048B1000-memory.dmp
                              Download

                              memory/1944-135-0x0000000003C50000-0x00000000048B1000-memory.dmp
                              Download

                              memory/1944-131-0x0000000003C50000-0x00000000048B1000-memory.dmp
                              Download

                              memory/1944-129-0x0000000003C50000-0x00000000048B1000-memory.dmp
                              Download

                              memory/1944-128-0x0000000003C50000-0x00000000048B1000-memory.dmp
                              Download

                              memory/1944-195-0x0000000003C50000-0x00000000048B1000-memory.dmp
                              Download

                              memory/1944-130-0x0000000003C50000-0x00000000048B1000-memory.dmp
                              Download

                              memory/1944-198-0x0000000003C50000-0x00000000048B1000-memory.dmp
                              Download

                              memory/1944-197-0x0000000003C50000-0x00000000048B1000-memory.dmp
                              Download

                              memory/1944-199-0x0000000003C50000-0x00000000048B1000-memory.dmp
                              Download

                              memory/1944-113-0x0000000003C50000-0x00000000048B1000-memory.dmp
                              Download

                              memory/2200-196-0x0000000000EC0000-0x0000000001B16000-memory.dmp
                              Download

                              memory/2200-262-0x0000000000EC0000-0x0000000001B16000-memory.dmp
                              Download

                              memory/2200-167-0x0000000000EC0000-0x0000000001B16000-memory.dmp
                              Download

                              memory/2200-134-0x0000000000EC0000-0x0000000001B16000-memory.dmp
                              Download

                              memory/2200-126-0x0000000000EC0000-0x0000000001B16000-memory.dmp
                              Download

                              memory/2200-133-0x0000000000EC0000-0x0000000001B16000-memory.dmp
                              Download

                              memory/2200-194-0x0000000000EC0000-0x0000000001B16000-memory.dmp
                              Download

                              memory/2200-191-0x0000000000EC0000-0x0000000001B16000-memory.dmp
                              Download

                              memory/2200-193-0x0000000000EC0000-0x0000000001B16000-memory.dmp
                              Download

                              memory/2200-62-0x0000000000EC0000-0x0000000001B16000-memory.dmp
                              Download

                              memory/2200-132-0x0000000000EC0000-0x0000000001B16000-memory.dmp
                              Download

                              memory/2344-47-0x0000000003320000-0x0000000003F81000-memory.dmp
                              Download

                              memory/2344-46-0x0000000003320000-0x0000000003F81000-memory.dmp
                              Download

                              memory/2344-74-0x0000000003320000-0x0000000003F81000-memory.dmp
                              Download

                              memory/2344-51-0x0000000003320000-0x0000000003F81000-memory.dmp
                              Download

                              memory/2344-41-0x0000000003320000-0x0000000003F81000-memory.dmp
                              Download

                              memory/2344-45-0x0000000003320000-0x0000000003F81000-memory.dmp
                              Download

                              memory/2344-43-0x0000000003320000-0x0000000003F81000-memory.dmp
                              Download

                              memory/2344-64-0x0000000003320000-0x0000000003F81000-memory.dmp
                              Download

                              memory/2344-50-0x0000000003320000-0x0000000003F81000-memory.dmp
                              Download

                              memory/2344-32-0x0000000003320000-0x0000000003F81000-memory.dmp
                              Download

                              memory/2344-44-0x0000000003320000-0x0000000003F81000-memory.dmp
                              Download

                              memory/2344-65-0x0000000003320000-0x0000000003F81000-memory.dmp
                              Download

                              memory/2344-67-0x0000000003320000-0x0000000003F81000-memory.dmp
                              Download

                              memory/2344-42-0x0000000003320000-0x0000000003F81000-memory.dmp
                              Download

                              memory/3188-53-0x0000000000060000-0x0000000000CB6000-memory.dmp
                              Download

                              memory/3188-52-0x0000000000060000-0x0000000000CB6000-memory.dmp
                              Download

                              memory/3188-48-0x0000000000060000-0x0000000000CB6000-memory.dmp
                              Download

                              memory/3188-63-0x0000000000060000-0x0000000000CB6000-memory.dmp
                              Download

                              memory/3188-49-0x0000000000060000-0x0000000000CB6000-memory.dmp
                              Download

                              memory/3188-17-0x0000000000060000-0x0000000000CB6000-memory.dmp
                              Download

                              memory/3732-231-0x00000000005C0000-0x0000000001216000-memory.dmp
                              Download

                              memory/3732-222-0x00000000005C0000-0x0000000001216000-memory.dmp
                              Download

                              memory/4080-297-0x0000000000B70000-0x00000000017C6000-memory.dmp
                              Download

                              memory/4648-125-0x0000000000330000-0x0000000000F86000-memory.dmp
                              Download

                              memory/4648-99-0x0000000000330000-0x0000000000F86000-memory.dmp
                              Download

                              memory/4744-245-0x00000000030E0000-0x0000000003D41000-memory.dmp
                              Download

                              memory/4744-259-0x00000000030E0000-0x0000000003D41000-memory.dmp
                              Download

                              memory/4744-258-0x00000000030E0000-0x0000000003D41000-memory.dmp
                              Download

                              memory/4744-257-0x00000000030E0000-0x0000000003D41000-memory.dmp
                              Download

                              memory/4744-256-0x00000000030E0000-0x0000000003D41000-memory.dmp
                              Download

                              memory/4744-260-0x00000000030E0000-0x0000000003D41000-memory.dmp
                              Download

                              memory/4744-265-0x00000000030E0000-0x0000000003D41000-memory.dmp
                              Download

                              memory/4952-146-0x0000000005D90000-0x0000000005DF6000-memory.dmp
                              Download

                              memory/4952-172-0x0000000071160000-0x00000000714B4000-memory.dmp
                              Download

                              memory/4952-190-0x0000000008AA0000-0x0000000009044000-memory.dmp
                              Download

                              memory/4952-188-0x0000000007D10000-0x0000000007D18000-memory.dmp
                              Download

                              memory/4952-187-0x0000000007D40000-0x0000000007D5A000-memory.dmp
                              Download

                              memory/4952-186-0x0000000007CE0000-0x0000000007CF4000-memory.dmp
                              Download

                              memory/4952-185-0x0000000007CD0000-0x0000000007CDE000-memory.dmp
                              Download

                              memory/4952-184-0x0000000007CA0000-0x0000000007CB1000-memory.dmp
                              Download

                              memory/4952-183-0x0000000008450000-0x00000000084E6000-memory.dmp
                              Download

                              memory/4952-182-0x0000000007C70000-0x0000000007C7A000-memory.dmp
                              Download

                              memory/4952-181-0x0000000007B70000-0x0000000007C13000-memory.dmp
                              Download

                              memory/4952-171-0x0000000070BB0000-0x0000000070BFC000-memory.dmp
                              Download

                              memory/4952-180-0x0000000007B50000-0x0000000007B6E000-memory.dmp
                              Download

                              memory/4952-189-0x0000000007D40000-0x0000000007D62000-memory.dmp
                              Download

                              memory/4952-170-0x0000000007B10000-0x0000000007B42000-memory.dmp
                              Download

                              memory/4952-169-0x0000000007750000-0x000000000776A000-memory.dmp
                              Download

                              memory/4952-168-0x0000000007DD0000-0x000000000844A000-memory.dmp
                              Download

                              memory/4952-166-0x00000000076D0000-0x0000000007746000-memory.dmp
                              Download

                              memory/4952-164-0x0000000006B10000-0x0000000006B54000-memory.dmp
                              Download

                              memory/4952-158-0x00000000065F0000-0x000000000663C000-memory.dmp
                              Download

                              memory/4952-157-0x00000000065B0000-0x00000000065CE000-memory.dmp
                              Download

                              memory/4952-156-0x0000000005F70000-0x00000000062C4000-memory.dmp
                              Download

                              memory/4952-147-0x0000000005E00000-0x0000000005E66000-memory.dmp
                              Download

                              memory/4952-142-0x0000000004FF0000-0x0000000005026000-memory.dmp
                              Download

                              memory/4952-145-0x00000000055B0000-0x00000000055D2000-memory.dmp
                              Download

                              memory/4952-143-0x00000000056B0000-0x0000000005CD8000-memory.dmp
                              Download

                              memory/4968-148-0x0000000000990000-0x00000000015E6000-memory.dmp
                              Download

                              memory/4968-141-0x0000000000990000-0x00000000015E6000-memory.dmp
                              Download