Analysis
- max time kernel
150s - max time network
157s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
06/07/2026, 21:34
General
- Target x365e6a2883f0c68c890872d8b0aaa82e088d23956d3f63e81a4950528b8d0b13.exe
- Size 9.1MB
- Sample260706-1eq2psby2s
- SHA256 365e6a2883f0c68c890872d8b0aaa82e088d23956d3f63e81a4950528b8d0b13
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 15 IoCs
- Executes dropped EXE 3 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- UPX packed file 19 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\x365e6a2883f0c68c890872d8b0aaa82e088d23956d3f63e81a4950528b8d0b13.exe"C:\Users\Admin\AppData\Local\Temp\x365e6a2883f0c68c890872d8b0aaa82e088d23956d3f63e81a4950528b8d0b13.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lsass_helper.exeC:\Users\Admin\AppData\Local\Temp\lsass_helper.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Mozilla\ctfmon.exeC:\Users\Admin\AppData\Local\Mozilla\ctfmon.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\ctfmon.exe"C:\Program Files (x86)\Microsoft\Edge\Application\ctfmon.exe" -4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
lsass_helper.exe
memory/3460-59-0x0000000000630000-0x0000000001287000-memory.dmp
memory/3460-60-0x0000000000630000-0x0000000001287000-memory.dmp
memory/3460-42-0x0000000000630000-0x0000000001287000-memory.dmp
memory/3460-57-0x0000000000630000-0x0000000001287000-memory.dmp
memory/3460-18-0x0000000000630000-0x0000000001287000-memory.dmp
memory/3460-58-0x0000000000630000-0x0000000001287000-memory.dmp
memory/3460-20-0x0000000000630000-0x0000000001287000-memory.dmp
memory/3460-21-0x0000000000630000-0x0000000001287000-memory.dmp
memory/3460-22-0x0000000000630000-0x0000000001287000-memory.dmp
memory/3460-63-0x0000000000630000-0x0000000001287000-memory.dmp
memory/3460-61-0x0000000000630000-0x0000000001287000-memory.dmp
memory/3460-62-0x0000000000630000-0x0000000001287000-memory.dmp
memory/3968-41-0x0000000000BE0000-0x0000000001837000-memory.dmp
memory/3968-38-0x0000000000BE0000-0x0000000001837000-memory.dmp
memory/4688-8-0x00000000003A0000-0x0000000000FF7000-memory.dmp
memory/4688-5-0x00000000003A0000-0x0000000000FF7000-memory.dmp
memory/4688-17-0x00000000003A0000-0x0000000000FF7000-memory.dmp
memory/4688-7-0x00000000003A0000-0x0000000000FF7000-memory.dmp
memory/5268-0-0x00007FFA2F8C0000-0x00007FFA2FB23000-memory.dmp
memory/6096-24-0x0000000002570000-0x00000000025A6000-memory.dmp
memory/6096-43-0x00000000071D0000-0x0000000007206000-memory.dmp
memory/6096-44-0x0000000070930000-0x000000007097C000-memory.dmp
memory/6096-40-0x0000000006360000-0x00000000063A8000-memory.dmp
memory/6096-45-0x0000000070B60000-0x0000000070EBB000-memory.dmp
memory/6096-48-0x0000000007210000-0x0000000007230000-memory.dmp
memory/6096-49-0x0000000007230000-0x00000000072D3000-memory.dmp
memory/6096-50-0x00000000079B0000-0x000000000802C000-memory.dmp
memory/6096-51-0x0000000007370000-0x000000000738A000-memory.dmp
memory/6096-52-0x00000000073D0000-0x00000000073DA000-memory.dmp
memory/6096-53-0x0000000007480000-0x0000000007516000-memory.dmp
memory/6096-54-0x0000000007860000-0x0000000007882000-memory.dmp
memory/6096-55-0x00000000085F0000-0x0000000008BAA000-memory.dmp
memory/6096-39-0x0000000006100000-0x000000000614C000-memory.dmp
memory/6096-37-0x0000000005DC0000-0x0000000005DDE000-memory.dmp
memory/6096-31-0x0000000005960000-0x0000000005CBB000-memory.dmp
memory/6096-28-0x0000000005770000-0x00000000057D6000-memory.dmp
memory/6096-27-0x0000000005070000-0x00000000050D6000-memory.dmp
memory/6096-26-0x0000000004FD0000-0x0000000004FF2000-memory.dmp
memory/6096-25-0x0000000005120000-0x000000000576A000-memory.dmp