salatstealer | 061cd646216645725d04743c10619c6e19e588a70e7b5c3cba0d7f49a8144599

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x061cd646216645725d04743c10619c6e19e588a70e7b5c3cba0d7f49a8144599.exe
Size 11.9MB
Sample260703-rvmvjsaz6x
SHA256 061cd646216645725d04743c10619c6e19e588a70e7b5c3cba0d7f49a8144599
MD5 2acb73d31196081a442312edd6fabdae
SHA1 329cc5e09d6c732cabff728a92308ad437864912
SHA512 21f44f55fe3afad90d8dd04a645dec23f0e8f88b3300821986a2ae882cccf60d0265bb2a03b885877d6b3e034d81cd836c33b65af8bf3e4cf38d5be3deeb55f0
SSDEEP 98304:SiGcPIVPkBvy8N0JeGjnp6kEg4BSMUkE3Qbz6G:DI2N2zpT14bs3Qbz6
TLSH
T17DC65B01FA8B64F1E8075831816BB23F23315C048B24DBE7EB587F6AF8776A11976749
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery salatstealer stealer

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c534-4.dat	family_salatstealer

Executes dropped EXE 1 IoCs

pid	Process
5980	WUDFHost.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows NT\f38875f5-f6ba-a3da-341c-b9df6f22f5f6	x061cd646216645725d04743c10619c6e19e588a70e7b5c3cba0d7f49a8144599.exe
File opened for modification	C:\Program Files (x86)\Windows NT\services.exe	x061cd646216645725d04743c10619c6e19e588a70e7b5c3cba0d7f49a8144599.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x061cd646216645725d04743c10619c6e19e588a70e7b5c3cba0d7f49a8144599.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WUDFHost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
6096	x061cd646216645725d04743c10619c6e19e588a70e7b5c3cba0d7f49a8144599.exe
6096	x061cd646216645725d04743c10619c6e19e588a70e7b5c3cba0d7f49a8144599.exe
6096	x061cd646216645725d04743c10619c6e19e588a70e7b5c3cba0d7f49a8144599.exe
6096	x061cd646216645725d04743c10619c6e19e588a70e7b5c3cba0d7f49a8144599.exe
5980	WUDFHost.exe
5980	WUDFHost.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6096 wrote to memory of 5980	6096	x061cd646216645725d04743c10619c6e19e588a70e7b5c3cba0d7f49a8144599.exe	90

C:\Users\Admin\AppData\Local\Temp\x061cd646216645725d04743c10619c6e19e588a70e7b5c3cba0d7f49a8144599.exe
"C:\Users\Admin\AppData\Local\Temp\x061cd646216645725d04743c10619c6e19e588a70e7b5c3cba0d7f49a8144599.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6096
- C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\WUDFHost.exe
  C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\WUDFHost.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WUDFHost.exe

Path C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\WUDFHost.exe
Size 11.9MB
SHA256 061cd646216645725d04743c10619c6e19e588a70e7b5c3cba0d7f49a8144599
MD5 2acb73d31196081a442312edd6fabdae
SHA1 329cc5e09d6c732cabff728a92308ad437864912
SHA512 21f44f55fe3afad90d8dd04a645dec23f0e8f88b3300821986a2ae882cccf60d0265bb2a03b885877d6b3e034d81cd836c33b65af8bf3e4cf38d5be3deeb55f0
SSDEEP 98304:SiGcPIVPkBvy8N0JeGjnp6kEg4BSMUkE3Qbz6G:DI2N2zpT14bs3Qbz6
TLSH
T17DC65B01FA8B64F1E8075831816BB23F23315C048B24DBE7EB587F6AF8776A11976749
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download