Analysis
- max time kernel
148s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
06/07/2026, 18:15
General
- Target helo.exe
- Size 10.4MB
- Sample260706-wv93asfs2k
- SHA256 a280599b2821b86aa245035da6ce62ddc51e7e309a51a2cee7cacf3c7d82a379
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 10 IoCs
- Enumerates VirtualBox DLL files 2 TTPs 3 IoCs
- Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VirtualBox drivers on disk 2 TTPs 2 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Looks for VMWare drivers on disk 2 TTPs 2 IoCs
- Looks for VMWare services registry key. 1 TTPs 2 IoCs
- UPX packed file 12 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Enumerates system info in registry 2 TTPs 5 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\helo.exe"C:\Users\Admin\AppData\Local\Temp\helo.exe"1⤵
- Enumerates VirtualBox DLL files
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VirtualBox drivers on disk
- Looks for VMWare Tools registry key
- Looks for VMWare drivers on disk
- Looks for VMWare services registry key.
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
svc_fa7b2666.log
svc_fa7b2666.log
svc_fa7b2666.log
memory/1968-38-0x0000000003E10000-0x0000000004A6C000-memory.dmp
memory/1968-33-0x0000000003E10000-0x0000000004A6C000-memory.dmp
memory/1968-34-0x0000000003E10000-0x0000000004A6C000-memory.dmp
memory/1968-35-0x0000000003E10000-0x0000000004A6C000-memory.dmp
memory/1968-39-0x0000000003E10000-0x0000000004A6C000-memory.dmp
memory/1968-14-0x0000000003E10000-0x0000000004A6C000-memory.dmp
memory/1968-37-0x0000000003E10000-0x0000000004A6C000-memory.dmp
memory/1968-36-0x0000000003E10000-0x0000000004A6C000-memory.dmp
memory/1968-40-0x0000000003E10000-0x0000000004A6C000-memory.dmp
memory/1968-41-0x0000000000820000-0x0000000000D92000-memory.dmp
memory/1968-42-0x0000000003E10000-0x0000000004A6C000-memory.dmp
memory/1968-43-0x0000000003E10000-0x0000000004A6C000-memory.dmp
memory/1968-45-0x0000000003E10000-0x0000000004A6C000-memory.dmp