Analysis
- max time kernel
149s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
31/05/2026, 04:58
General
- Target file.exe
- Size 3.9MB
- Sample260531-fl2fssbw9l
- SHA256 bf40a0f7d4d10448e5cae29b32c9e55e232bf80c04500c5e8f4f82bd427a8a29
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 35 IoCs
- Executes dropped EXE 3 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- UPX packed file 41 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Publishers\wininit.exeC:\Users\Admin\AppData\Local\Publishers\wininit.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\wininit.exe"C:\Program Files (x86)\Microsoft\Edge\Application\wininit.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Google\Chrome\Application\wininit.exe"C:\Program Files\Google\Chrome\Application\wininit.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
svc_b16dc557.log
svc_b16dc557.log
svc_b16dc557.log
svc_b16dc557.log
svc_b16dc557.log
svc_b16dc557.log
svc_b16dc557.log
svc_b16dc557.log
wininit.exe
__PSScriptPolicyTest_bz3gpgps.20n.ps1
memory/3536-236-0x0000000003E00000-0x0000000004A5D000-memory.dmp
memory/3536-235-0x0000000003E00000-0x0000000004A5D000-memory.dmp
memory/3536-233-0x0000000003E00000-0x0000000004A5D000-memory.dmp
memory/3536-232-0x0000000003E00000-0x0000000004A5D000-memory.dmp
memory/3536-234-0x0000000003E00000-0x0000000004A5D000-memory.dmp
memory/3536-237-0x0000000003E00000-0x0000000004A5D000-memory.dmp
memory/3536-210-0x0000000003E00000-0x0000000004A5D000-memory.dmp
memory/3536-240-0x0000000000760000-0x0000000000B55000-memory.dmp
memory/5040-36-0x00000000031D0000-0x0000000003E2D000-memory.dmp
memory/5040-65-0x0000000000D40000-0x0000000001135000-memory.dmp
memory/5040-57-0x00000000031D0000-0x0000000003E2D000-memory.dmp
memory/5040-50-0x00000000031D0000-0x0000000003E2D000-memory.dmp
memory/5040-49-0x00000000031D0000-0x0000000003E2D000-memory.dmp
memory/5040-42-0x00000000031D0000-0x0000000003E2D000-memory.dmp
memory/5040-41-0x0000000000D40000-0x0000000001135000-memory.dmp
memory/5040-40-0x00000000031D0000-0x0000000003E2D000-memory.dmp
memory/5040-38-0x00000000031D0000-0x0000000003E2D000-memory.dmp
memory/5040-37-0x00000000031D0000-0x0000000003E2D000-memory.dmp
memory/5040-34-0x00000000031D0000-0x0000000003E2D000-memory.dmp
memory/5040-39-0x00000000031D0000-0x0000000003E2D000-memory.dmp
memory/5040-35-0x00000000031D0000-0x0000000003E2D000-memory.dmp
memory/5040-33-0x00000000031D0000-0x0000000003E2D000-memory.dmp
memory/5040-14-0x00000000031D0000-0x0000000003E2D000-memory.dmp
memory/5340-155-0x0000000005150000-0x0000000005172000-memory.dmp
memory/5340-180-0x00000000708E0000-0x0000000070C37000-memory.dmp
memory/5340-244-0x00000000076C0000-0x00000000076C8000-memory.dmp
memory/5340-134-0x0000000004B60000-0x0000000004B96000-memory.dmp
memory/5340-243-0x00000000076E0000-0x00000000076FA000-memory.dmp
memory/5340-143-0x0000000005310000-0x000000000593A000-memory.dmp
memory/5340-242-0x0000000007660000-0x0000000007675000-memory.dmp
memory/5340-241-0x0000000007650000-0x000000000765E000-memory.dmp
memory/5340-157-0x0000000005AB0000-0x0000000005B16000-memory.dmp
memory/5340-158-0x0000000005B20000-0x0000000005E77000-memory.dmp
memory/5340-156-0x0000000005A40000-0x0000000005AA6000-memory.dmp
memory/5340-231-0x0000000007610000-0x0000000007621000-memory.dmp
memory/5340-165-0x0000000006020000-0x000000000603E000-memory.dmp
memory/5340-166-0x0000000006070000-0x00000000060BC000-memory.dmp
memory/5340-178-0x0000000007420000-0x0000000007454000-memory.dmp
memory/5340-195-0x0000000007BF0000-0x000000000826A000-memory.dmp
memory/5340-229-0x0000000007760000-0x00000000077F6000-memory.dmp
memory/5340-196-0x00000000075B0000-0x00000000075CA000-memory.dmp
memory/5340-225-0x0000000007600000-0x000000000760A000-memory.dmp
memory/5340-179-0x00000000706C0000-0x000000007070C000-memory.dmp
memory/5340-188-0x0000000007480000-0x0000000007524000-memory.dmp
memory/5340-187-0x0000000007460000-0x000000000747E000-memory.dmp
memory/5340-177-0x00000000065B0000-0x00000000065F6000-memory.dmp
memory/5340-136-0x0000000004CD0000-0x0000000004CE0000-memory.dmp
memory/5476-99-0x0000000003800000-0x000000000445D000-memory.dmp
memory/5476-103-0x0000000003800000-0x000000000445D000-memory.dmp
memory/5476-112-0x0000000003800000-0x000000000445D000-memory.dmp
memory/5476-106-0x0000000003800000-0x000000000445D000-memory.dmp
memory/5476-105-0x0000000000EB0000-0x00000000012A5000-memory.dmp
memory/5476-111-0x0000000003800000-0x000000000445D000-memory.dmp
memory/5476-98-0x0000000003800000-0x000000000445D000-memory.dmp
memory/5476-104-0x0000000003800000-0x000000000445D000-memory.dmp
memory/5476-117-0x0000000003800000-0x000000000445D000-memory.dmp
memory/5476-100-0x0000000003800000-0x000000000445D000-memory.dmp
memory/5476-102-0x0000000003800000-0x000000000445D000-memory.dmp
memory/5476-108-0x0000000003800000-0x000000000445D000-memory.dmp
memory/5476-79-0x0000000003800000-0x000000000445D000-memory.dmp
memory/5476-101-0x0000000003800000-0x000000000445D000-memory.dmp
memory/5584-173-0x0000000004200000-0x0000000004E5D000-memory.dmp
memory/5584-169-0x0000000004200000-0x0000000004E5D000-memory.dmp
memory/5584-167-0x0000000004200000-0x0000000004E5D000-memory.dmp
memory/5584-171-0x0000000004200000-0x0000000004E5D000-memory.dmp
memory/5584-170-0x0000000004200000-0x0000000004E5D000-memory.dmp
memory/5584-168-0x0000000004200000-0x0000000004E5D000-memory.dmp
memory/5584-176-0x0000000000D60000-0x0000000001155000-memory.dmp
memory/5584-133-0x0000000004200000-0x0000000004E5D000-memory.dmp
memory/5584-172-0x0000000004200000-0x0000000004E5D000-memory.dmp