Analysis
- max time kernel
150s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
03/06/2026, 04:32
General
- Target zapret.bin.exe
- Size 3.4MB
- Sample260603-e56n7aht6v
- SHA256 3eaa33b359d6123bff87e5227e2f4d9f24c17e5a251c4c15aaedee7df1737777
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 17 IoCs
- Executes dropped EXE 3 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\zapret.bin.exe"C:\Users\Admin\AppData\Local\Temp\zapret.bin.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\D3DSCache\spoolsv.exeC:\Users\Admin\AppData\Local\D3DSCache\spoolsv.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Google\Chrome\Application\spoolsv.exe"C:\Program Files\Google\Chrome\Application\spoolsv.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\spoolsv.exe"C:\Program Files (x86)\Microsoft\Edge\Application\spoolsv.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
spoolsv.exe
__PSScriptPolicyTest_pjew3oeg.ift.ps1
memory/1036-45-0x0000000000610000-0x0000000001267000-memory.dmp
memory/1036-47-0x0000000000610000-0x0000000001267000-memory.dmp
memory/1504-12-0x0000000000DF0000-0x0000000001A47000-memory.dmp
memory/1504-73-0x0000000000DF0000-0x0000000001A47000-memory.dmp
memory/1504-10-0x0000000000DF0000-0x0000000001A47000-memory.dmp
memory/1504-11-0x0000000000DF0000-0x0000000001A47000-memory.dmp
memory/1504-8-0x0000000000DF0000-0x0000000001A47000-memory.dmp
memory/1504-13-0x0000000000DF0000-0x0000000001A47000-memory.dmp
memory/1504-15-0x0000000000DF0000-0x0000000001A47000-memory.dmp
memory/1504-72-0x0000000000DF0000-0x0000000001A47000-memory.dmp
memory/1504-71-0x0000000000DF0000-0x0000000001A47000-memory.dmp
memory/1504-70-0x0000000000DF0000-0x0000000001A47000-memory.dmp
memory/1504-74-0x0000000000DF0000-0x0000000001A47000-memory.dmp
memory/1504-75-0x0000000000DF0000-0x0000000001A47000-memory.dmp
memory/1504-38-0x0000000000DF0000-0x0000000001A47000-memory.dmp
memory/1812-62-0x0000000007DD0000-0x0000000007E66000-memory.dmp
memory/1812-48-0x0000000007AF0000-0x0000000007B24000-memory.dmp
memory/1812-27-0x0000000006180000-0x00000000061E6000-memory.dmp
memory/1812-34-0x00000000062A0000-0x00000000065F7000-memory.dmp
memory/1812-35-0x0000000006700000-0x000000000671E000-memory.dmp
memory/1812-37-0x0000000006740000-0x000000000678C000-memory.dmp
memory/1812-25-0x0000000005810000-0x0000000005832000-memory.dmp
memory/1812-22-0x0000000002EF0000-0x0000000002F26000-memory.dmp
memory/1812-40-0x0000000006C60000-0x0000000006CA6000-memory.dmp
memory/1812-24-0x00000000058B0000-0x0000000005EDA000-memory.dmp
memory/1812-23-0x0000000002EC0000-0x0000000002ED0000-memory.dmp
memory/1812-49-0x0000000070620000-0x000000007066C000-memory.dmp
memory/1812-58-0x0000000007B50000-0x0000000007BF4000-memory.dmp
memory/1812-57-0x0000000007B30000-0x0000000007B4E000-memory.dmp
memory/1812-50-0x0000000070790000-0x0000000070AE7000-memory.dmp
memory/1812-26-0x0000000006110000-0x0000000006176000-memory.dmp
memory/1812-60-0x0000000007C80000-0x0000000007C9A000-memory.dmp
memory/1812-59-0x00000000082B0000-0x000000000892A000-memory.dmp
memory/1812-61-0x0000000007CD0000-0x0000000007CDA000-memory.dmp
memory/1812-21-0x0000000002EC0000-0x0000000002ED0000-memory.dmp
memory/1812-63-0x0000000007CF0000-0x0000000007D01000-memory.dmp
memory/1812-64-0x0000000007D40000-0x0000000007D4E000-memory.dmp
memory/1812-65-0x0000000007D50000-0x0000000007D65000-memory.dmp
memory/1812-66-0x0000000007DA0000-0x0000000007DBA000-memory.dmp
memory/1812-67-0x0000000007D90000-0x0000000007D98000-memory.dmp
memory/4044-0-0x0000000000F50000-0x0000000001BA7000-memory.dmp
memory/4044-9-0x0000000000F50000-0x0000000001BA7000-memory.dmp
memory/4044-2-0x0000000000F50000-0x0000000001BA7000-memory.dmp
memory/4044-1-0x0000000000F50000-0x0000000001BA7000-memory.dmp
memory/4560-39-0x0000000000110000-0x0000000000D67000-memory.dmp
memory/4560-20-0x0000000000110000-0x0000000000D67000-memory.dmp