Analysis
- user interaction
yes - max time kernel
50s - max time network
51s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
04/07/2026, 15:00
Behavioral task
behavioral1
Sample
Nursultan client.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
11 signatures
150 seconds
General
- Target Nursultan client.exe
- Size 3.4MB
- Sample260704-sdj8rsgy21
- SHA256 af10aa8041e0d632f0b5b4d2c2ab2815ec6294cc276d86a78708a6190826b28a
- MD5 136497ddc82bd162235f93c66286f6f8
- SHA1 49c2aece91f20d8471341a96a175d273a2859269
- SHA512 ecd265ecbdc41c140c333707d774d5a31eb544be9820c8c67d9e81487cb4086c3db191e0e3f4410ef9d42eeff70af5835fb78715cab8f590c00b299664c0bc48
- SSDEEP 98304:0vi6cdfXyPXP2eeIh2xBZJZozsx2i0d0FllVnT:0vivPyPXukADZozh0FlLT
- TLSH T183F53383C066E6B7C89234B3CD426BB518BBC1B33055923E4F5964FA2B53926DE47363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 3 IoCs
resource yara_rule behavioral1/memory/4672-1-0x00000000008E0000-0x0000000001537000-memory.dmp family_salatstealer behavioral1/memory/4672-15-0x00000000008E0000-0x0000000001537000-memory.dmp family_salatstealer behavioral1/memory/4672-16-0x00000000008E0000-0x0000000001537000-memory.dmp family_salatstealer -
resource yara_rule behavioral1/memory/4672-0-0x00000000008E0000-0x0000000001537000-memory.dmp upx behavioral1/memory/4672-1-0x00000000008E0000-0x0000000001537000-memory.dmp upx behavioral1/memory/4672-15-0x00000000008E0000-0x0000000001537000-memory.dmp upx behavioral1/memory/4672-16-0x00000000008E0000-0x0000000001537000-memory.dmp upx behavioral1/memory/4672-18-0x00000000008E0000-0x0000000001537000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nursultan client.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4672 Nursultan client.exe 4672 Nursultan client.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4960 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4960 taskmgr.exe Token: SeSystemProfilePrivilege 4960 taskmgr.exe Token: SeCreateGlobalPrivilege 4960 taskmgr.exe - Suspicious use of FindShellTrayWindow 50 IoCs
pid Process 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe - Suspicious use of SendNotifyMessage 50 IoCs
pid Process 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe 4960 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nursultan client.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan client.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4672
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4960
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5708