Analysis
- user interaction
yes - max time kernel
105s - max time network
109s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
29/05/2026, 01:23
General
- Target Setup.7z
- Size 3.5MB
- Sample260529-br35csfx6k
- SHA256 f99b6b19890f16060f10d0dbd66626b2daf810d4ac1cbba93ac91854aec8c43a
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 8 IoCs
- Executes dropped EXE 2 IoCs
- UPX packed file 15 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Setup.7z"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\Setup\Setup.exe"C:\Users\Admin\Desktop\Setup\Setup.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Defender\sihost.exe"C:\Program Files (x86)\Windows Defender\sihost.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
-
-
C:\Program Files\Google\Chrome\Application\sihost.exe"C:\Program Files\Google\Chrome\Application\sihost.exe" -3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\sihost.exe"C:\Program Files (x86)\Microsoft\Edge\Application\sihost.exe" -3⤵
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_bqtsl5pb.n5b.ps1
Setup.exe
memory/1320-60-0x00000000008F0000-0x0000000001546000-memory.dmp
memory/1320-57-0x00000000008F0000-0x0000000001546000-memory.dmp
memory/1756-32-0x0000000000C90000-0x00000000018E6000-memory.dmp
memory/1756-28-0x0000000000C90000-0x00000000018E6000-memory.dmp
memory/1756-30-0x0000000000C90000-0x00000000018E6000-memory.dmp
memory/1756-31-0x0000000000C90000-0x00000000018E6000-memory.dmp
memory/1916-43-0x0000000000BA0000-0x00000000017F6000-memory.dmp
memory/1916-37-0x0000000000BA0000-0x00000000017F6000-memory.dmp
memory/4016-38-0x0000000004A90000-0x0000000004AC6000-memory.dmp
memory/4016-51-0x0000000005F20000-0x0000000005F3E000-memory.dmp
memory/4016-58-0x00000000064E0000-0x0000000006526000-memory.dmp
memory/4016-39-0x0000000005100000-0x000000000572A000-memory.dmp
memory/4016-40-0x0000000005060000-0x0000000005082000-memory.dmp
memory/4016-42-0x00000000059D0000-0x0000000005A36000-memory.dmp
memory/4016-41-0x0000000005960000-0x00000000059C6000-memory.dmp
memory/4016-52-0x0000000005FE0000-0x000000000602C000-memory.dmp
memory/4016-50-0x0000000005A40000-0x0000000005D97000-memory.dmp
memory/4512-12-0x0000000000AB0000-0x0000000001706000-memory.dmp
memory/4512-29-0x0000000000AB0000-0x0000000001706000-memory.dmp
memory/4512-13-0x0000000000AB0000-0x0000000001706000-memory.dmp
memory/4512-11-0x0000000000AB0000-0x0000000001706000-memory.dmp
memory/4512-14-0x0000000000AB0000-0x0000000001706000-memory.dmp
memory/4512-10-0x0000000000AB0000-0x0000000001706000-memory.dmp