Analysis
- user interaction
yes - max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
24/05/2026, 22:29
General
- Target START 1.exe
- Size 3.4MB
- Sample260524-2epdjsby7v
- SHA256 4f0c08a4cef4f90b4b880d4f998a0ea633234361802f18f5976717d8ff229dce
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 18 IoCs
- Executes dropped EXE 3 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 43 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\START 1.exe"C:\Users\Admin\AppData\Local\Temp\START 1.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Multimedia Platform\WUDFHost.exe"C:\Program Files (x86)\Windows Multimedia Platform\WUDFHost.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\WUDFHost.exe"C:\Program Files (x86)\Microsoft\Edge\Application\WUDFHost.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Google\Chrome\Application\WUDFHost.exe"C:\Program Files\Google\Chrome\Application\WUDFHost.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
WUDFHost.exe
__PSScriptPolicyTest_xrfa0fec.ulf.ps1
memory/896-42-0x0000000000DD0000-0x0000000001A27000-memory.dmp
memory/896-44-0x0000000000DD0000-0x0000000001A27000-memory.dmp
memory/4108-24-0x00000000009B0000-0x0000000001607000-memory.dmp
memory/4108-19-0x00000000009B0000-0x0000000001607000-memory.dmp
memory/4256-75-0x0000000000CF0000-0x0000000001947000-memory.dmp
memory/4256-73-0x0000000000CF0000-0x0000000001947000-memory.dmp
memory/4256-13-0x0000000000CF0000-0x0000000001947000-memory.dmp
memory/4256-76-0x0000000000CF0000-0x0000000001947000-memory.dmp
memory/4256-11-0x0000000000CF0000-0x0000000001947000-memory.dmp
memory/4256-74-0x0000000000CF0000-0x0000000001947000-memory.dmp
memory/4256-9-0x0000000000CF0000-0x0000000001947000-memory.dmp
memory/4256-12-0x0000000000CF0000-0x0000000001947000-memory.dmp
memory/4256-77-0x0000000000CF0000-0x0000000001947000-memory.dmp
memory/4256-72-0x0000000000CF0000-0x0000000001947000-memory.dmp
memory/4256-71-0x0000000000CF0000-0x0000000001947000-memory.dmp
memory/4256-70-0x0000000000CF0000-0x0000000001947000-memory.dmp
memory/4256-78-0x0000000000CF0000-0x0000000001947000-memory.dmp
memory/4256-79-0x0000000000CF0000-0x0000000001947000-memory.dmp
memory/4488-45-0x0000000006340000-0x0000000006384000-memory.dmp
memory/4488-63-0x00000000074B0000-0x00000000074C1000-memory.dmp
memory/4488-40-0x0000000005DC0000-0x0000000005DDE000-memory.dmp
memory/4488-35-0x00000000057D0000-0x0000000005B24000-memory.dmp
memory/4488-18-0x00000000047F0000-0x0000000004826000-memory.dmp
memory/4488-46-0x00000000070E0000-0x0000000007156000-memory.dmp
memory/4488-47-0x00000000077E0000-0x0000000007E5A000-memory.dmp
memory/4488-48-0x0000000007160000-0x000000000717A000-memory.dmp
memory/4488-49-0x0000000007320000-0x0000000007352000-memory.dmp
memory/4488-50-0x000000006FD70000-0x000000006FDBC000-memory.dmp
memory/4488-51-0x000000006FFE0000-0x0000000070334000-memory.dmp
memory/4488-59-0x0000000007360000-0x000000000737E000-memory.dmp
memory/4488-60-0x0000000007380000-0x0000000007423000-memory.dmp
memory/4488-61-0x0000000007480000-0x000000000748A000-memory.dmp
memory/4488-62-0x0000000007550000-0x00000000075E6000-memory.dmp
memory/4488-41-0x0000000005DF0000-0x0000000005E3C000-memory.dmp
memory/4488-64-0x00000000074E0000-0x00000000074EE000-memory.dmp
memory/4488-65-0x00000000074F0000-0x0000000007504000-memory.dmp
memory/4488-66-0x00000000075F0000-0x000000000760A000-memory.dmp
memory/4488-67-0x0000000007520000-0x0000000007528000-memory.dmp
memory/4488-27-0x0000000005760000-0x00000000057C6000-memory.dmp
memory/4488-26-0x0000000005680000-0x00000000056E6000-memory.dmp
memory/4488-25-0x0000000004CB0000-0x0000000004CD2000-memory.dmp
memory/4488-22-0x0000000004EE0000-0x0000000005508000-memory.dmp
memory/4488-20-0x00000000048A0000-0x00000000048B0000-memory.dmp
memory/4488-21-0x00000000048A0000-0x00000000048B0000-memory.dmp
memory/4628-0-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/4628-10-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/4628-2-0x0000000000DC0000-0x0000000001A17000-memory.dmp
memory/4628-1-0x0000000000DC0000-0x0000000001A17000-memory.dmp