Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
01/07/2026, 03:44
General
- Target x5f23dbac31fe83842f8356fb79645e5a5f0f92a0fc5e668d2dfc18ae2ffe0ea8.exe
- Size 12.0MB
- Sample260701-eayebsfw6z
- SHA256 5f23dbac31fe83842f8356fb79645e5a5f0f92a0fc5e668d2dfc18ae2ffe0ea8
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 1 IoCs
- Executes dropped EXE 3 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Drops file in Program Files directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\x5f23dbac31fe83842f8356fb79645e5a5f0f92a0fc5e668d2dfc18ae2ffe0ea8.exe"C:\Users\Admin\AppData\Local\Temp\x5f23dbac31fe83842f8356fb79645e5a5f0f92a0fc5e668d2dfc18ae2ffe0ea8.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Google\taskhostw.exe"C:\Program Files (x86)\Google\taskhostw.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Google\Chrome\Application\taskhostw.exe"C:\Program Files\Google\Chrome\Application\taskhostw.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\taskhostw.exe"C:\Program Files (x86)\Microsoft\Edge\Application\taskhostw.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
taskhostw.exe
__PSScriptPolicyTest_agi1nhqv.sww.ps1
memory/2016-32-0x00000000079F0000-0x000000000806A000-memory.dmp
memory/2016-49-0x0000000007920000-0x000000000792E000-memory.dmp
memory/2016-12-0x00000000054C0000-0x0000000005AE8000-memory.dmp
memory/2016-13-0x0000000005310000-0x0000000005332000-memory.dmp
memory/2016-14-0x0000000005430000-0x0000000005496000-memory.dmp
memory/2016-15-0x0000000005BA0000-0x0000000005C06000-memory.dmp
memory/2016-10-0x00000000028A0000-0x00000000028D6000-memory.dmp
memory/2016-23-0x0000000005C10000-0x0000000005F64000-memory.dmp
memory/2016-24-0x00000000061E0000-0x00000000061FE000-memory.dmp
memory/2016-25-0x00000000062A0000-0x00000000062EC000-memory.dmp
memory/2016-30-0x0000000006760000-0x00000000067A4000-memory.dmp
memory/2016-31-0x00000000072F0000-0x0000000007366000-memory.dmp
memory/2016-11-0x0000000004E80000-0x0000000004E90000-memory.dmp
memory/2016-9-0x0000000004E80000-0x0000000004E90000-memory.dmp
memory/2016-45-0x00000000077C0000-0x0000000007863000-memory.dmp
memory/2016-35-0x0000000070430000-0x000000007047C000-memory.dmp
memory/2016-36-0x0000000070660000-0x00000000709B4000-memory.dmp
memory/2016-44-0x00000000077A0000-0x00000000077BE000-memory.dmp
memory/2016-34-0x0000000007760000-0x0000000007792000-memory.dmp
memory/2016-46-0x00000000078C0000-0x00000000078CA000-memory.dmp
memory/2016-47-0x0000000008070000-0x0000000008106000-memory.dmp
memory/2016-48-0x00000000078F0000-0x0000000007901000-memory.dmp
memory/2016-33-0x0000000007390000-0x00000000073AA000-memory.dmp
memory/2016-50-0x0000000007930000-0x0000000007944000-memory.dmp
memory/2016-51-0x0000000007990000-0x00000000079AA000-memory.dmp
memory/2016-52-0x0000000007960000-0x0000000007968000-memory.dmp