Resubmissions
05/06/2026, 06:11
260605-gxwv5acy7r1005/06/2026, 05:33
260605-f8zkqabt4s1004/06/2026, 13:43
260604-q1m7tsgw7m1004/06/2026, 13:25
260604-qn6hmsgt8l1004/06/2026, 12:14
260604-pef1yse16l1004/06/2026, 11:02
260604-m5keysdy9k10Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 11:02
General
- Target Xeno (1) (1).exe
- Size 3.4MB
- Sample260604-m5keysdy9k
- SHA256 f82770b9cd10347042ea4fb500972d2951ce13f5dc767396bc514c014d05870b
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 20 IoCs
- Executes dropped EXE 5 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- UPX packed file 27 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Xeno (1) (1).exe"C:\Users\Admin\AppData\Local\Temp\Xeno (1) (1).exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe"C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\winlogon.exe"C:\Program Files (x86)\Microsoft\Edge\Application\winlogon.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Google\Chrome\Application\winlogon.exe"C:\Program Files\Google\Chrome\Application\winlogon.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe"C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\MSBuild\dllhost.exe"C:\Program Files (x86)\MSBuild\dllhost.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
winlogon.exe
__PSScriptPolicyTest_muz30cpn.xpg.ps1
memory/800-17-0x0000000000570000-0x00000000011C7000-memory.dmp
memory/800-34-0x0000000000570000-0x00000000011C7000-memory.dmp
memory/808-0-0x0000000000E50000-0x0000000001AA7000-memory.dmp
memory/808-1-0x0000000000E50000-0x0000000001AA7000-memory.dmp
memory/808-2-0x0000000000E50000-0x0000000001AA7000-memory.dmp
memory/808-7-0x0000000000E50000-0x0000000001AA7000-memory.dmp
memory/1716-54-0x0000000007F20000-0x000000000859A000-memory.dmp
memory/1716-21-0x0000000005350000-0x0000000005372000-memory.dmp
memory/1716-23-0x0000000005DA0000-0x0000000005E06000-memory.dmp
memory/1716-22-0x0000000005D30000-0x0000000005D96000-memory.dmp
memory/1716-20-0x00000000055D0000-0x0000000005BFA000-memory.dmp
memory/1716-30-0x0000000005E10000-0x0000000006167000-memory.dmp
memory/1716-31-0x0000000006350000-0x000000000636E000-memory.dmp
memory/1716-32-0x0000000006380000-0x00000000063CC000-memory.dmp
memory/1716-19-0x0000000004E80000-0x0000000004EB6000-memory.dmp
memory/1716-35-0x00000000068C0000-0x0000000006906000-memory.dmp
memory/1716-62-0x0000000007A00000-0x0000000007A08000-memory.dmp
memory/1716-61-0x0000000007A20000-0x0000000007A3A000-memory.dmp
memory/1716-45-0x0000000070EB0000-0x0000000071207000-memory.dmp
memory/1716-52-0x0000000007790000-0x00000000077AE000-memory.dmp
memory/1716-44-0x0000000070C60000-0x0000000070CAC000-memory.dmp
memory/1716-53-0x00000000077B0000-0x0000000007854000-memory.dmp
memory/1716-43-0x0000000007750000-0x0000000007784000-memory.dmp
memory/1716-55-0x00000000078F0000-0x000000000790A000-memory.dmp
memory/1716-18-0x0000000004F90000-0x0000000004FA0000-memory.dmp
memory/1716-56-0x0000000007940000-0x000000000794A000-memory.dmp
memory/1716-57-0x0000000007AA0000-0x0000000007B36000-memory.dmp
memory/1716-58-0x0000000007950000-0x0000000007961000-memory.dmp
memory/1716-59-0x0000000007990000-0x000000000799E000-memory.dmp
memory/1716-60-0x00000000079A0000-0x00000000079B5000-memory.dmp
memory/1908-42-0x0000000000DF0000-0x0000000001A47000-memory.dmp
memory/1908-40-0x0000000000DF0000-0x0000000001A47000-memory.dmp
memory/3632-66-0x0000000000E00000-0x0000000001A57000-memory.dmp
memory/3632-83-0x0000000000E00000-0x0000000001A57000-memory.dmp
memory/3632-11-0x0000000000E00000-0x0000000001A57000-memory.dmp
memory/3632-12-0x0000000000E00000-0x0000000001A57000-memory.dmp
memory/3632-65-0x0000000000E00000-0x0000000001A57000-memory.dmp
memory/3632-80-0x0000000000E00000-0x0000000001A57000-memory.dmp
memory/3632-67-0x0000000000E00000-0x0000000001A57000-memory.dmp
memory/3632-10-0x0000000000E00000-0x0000000001A57000-memory.dmp
memory/3632-69-0x0000000000E00000-0x0000000001A57000-memory.dmp
memory/3632-82-0x0000000000E00000-0x0000000001A57000-memory.dmp
memory/3632-81-0x0000000000E00000-0x0000000001A57000-memory.dmp
memory/3632-9-0x0000000000E00000-0x0000000001A57000-memory.dmp
memory/3632-78-0x0000000000E00000-0x0000000001A57000-memory.dmp
memory/3632-79-0x0000000000E00000-0x0000000001A57000-memory.dmp
memory/4288-77-0x0000000000650000-0x00000000012A7000-memory.dmp
memory/4288-73-0x0000000000650000-0x00000000012A7000-memory.dmp
memory/5096-75-0x0000000000E00000-0x0000000001A57000-memory.dmp
memory/5096-70-0x0000000000E00000-0x0000000001A57000-memory.dmp