Analysis
- max time kernel
141s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/07/2026, 04:33
General
- Target 2026-07-10_1c03e72fac5312a1c790063fb0267992_cobalt-strike_icedid_njrat_satacom_stealc.exe
- Size 43.0MB
- Sample260710-e6t2sac14p
- SHA256 f240cffc7c0cda47a87d88a698de6135e9233f7ab257a3383e6059d62c18fffa
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 10 IoCs
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 11 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 11 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 11 IoCs
- UPX dump on OEP (original entry point) 15 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Downloads MZ/PE file 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 2 IoCs
- UPX packed file 16 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_1c03e72fac5312a1c790063fb0267992_cobalt-strike_icedid_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_1c03e72fac5312a1c790063fb0267992_cobalt-strike_icedid_njrat_satacom_stealc.exe"1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\jujvshl'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\cmd.execmd /c dir 2>nul >nul2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /c echo Spazzatura 2>nul >nul2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /c ver 2>nul >nul2⤵
-
-
C:\Users\Admin\AppData\Local\jujvshl\Service_1.exe"C:\Users\Admin\AppData\Local\jujvshl\Service_1.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\build.exeC:\Users\Admin\AppData\Roaming\build.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe4⤵
-
-
C:\Program Files\Google\Chrome\Application\build.exe"C:\Program Files\Google\Chrome\Application\build.exe" -4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\build.exe"C:\Program Files (x86)\Microsoft\Edge\Application\build.exe" -4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\jujvshl\Service_2.exe"C:\Users\Admin\AppData\Local\jujvshl\Service_2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
libskiasharp.dll
wfpx.dll
__PSScriptPolicyTest_fhu5r23w.mga.ps1
Service_1.exe
Service_2.exe
memory/468-214-0x00000000004E0000-0x000000000112F000-memory.dmp
memory/468-162-0x00000000004E0000-0x000000000112F000-memory.dmp
memory/468-213-0x00000000004E0000-0x000000000112F000-memory.dmp
memory/468-215-0x00000000004E0000-0x000000000112F000-memory.dmp
memory/468-132-0x00000000004E0000-0x000000000112F000-memory.dmp
memory/468-224-0x00000000004E0000-0x000000000112F000-memory.dmp
memory/468-222-0x00000000004E0000-0x000000000112F000-memory.dmp
memory/764-270-0x0000000007120000-0x00000000071C3000-memory.dmp
memory/764-255-0x00000000060E0000-0x0000000006124000-memory.dmp
memory/764-231-0x0000000004580000-0x00000000045B6000-memory.dmp
memory/764-276-0x0000000007390000-0x00000000073AA000-memory.dmp
memory/764-275-0x0000000007290000-0x00000000072A4000-memory.dmp
memory/764-233-0x0000000004C50000-0x0000000005278000-memory.dmp
memory/764-274-0x0000000007280000-0x000000000728E000-memory.dmp
memory/764-273-0x0000000007250000-0x0000000007261000-memory.dmp
memory/764-272-0x00000000072F0000-0x0000000007386000-memory.dmp
memory/764-234-0x0000000004B60000-0x0000000004B82000-memory.dmp
memory/764-271-0x0000000007220000-0x000000000722A000-memory.dmp
memory/764-236-0x00000000052F0000-0x0000000005356000-memory.dmp
memory/764-259-0x00000000070C0000-0x00000000070F2000-memory.dmp
memory/764-269-0x0000000007100000-0x000000000711E000-memory.dmp
memory/764-260-0x00000000704D0000-0x000000007051C000-memory.dmp
memory/764-261-0x0000000070D00000-0x0000000071054000-memory.dmp
memory/764-257-0x0000000007550000-0x0000000007BCA000-memory.dmp
memory/764-258-0x0000000006EF0000-0x0000000006F0A000-memory.dmp
memory/764-256-0x0000000006E50000-0x0000000006EC6000-memory.dmp
memory/764-277-0x00000000072C0000-0x00000000072C8000-memory.dmp
memory/764-235-0x0000000005280000-0x00000000052E6000-memory.dmp
memory/764-242-0x00000000054E0000-0x0000000005834000-memory.dmp
memory/764-247-0x0000000005B90000-0x0000000005BDC000-memory.dmp
memory/764-246-0x0000000005B60000-0x0000000005B7E000-memory.dmp
memory/860-252-0x0000000000910000-0x000000000155F000-memory.dmp
memory/860-254-0x0000000000910000-0x000000000155F000-memory.dmp
memory/1216-70-0x0000012BD43B0000-0x0000012BD43C0000-memory.dmp
memory/1216-79-0x0000012BD4A20000-0x0000012BD4A42000-memory.dmp
memory/1216-71-0x0000012BD43B0000-0x0000012BD43C0000-memory.dmp
memory/1216-80-0x0000012BD43B0000-0x0000012BD43C0000-memory.dmp
memory/2188-94-0x0000018BB3080000-0x0000018BB3090000-memory.dmp
memory/2188-84-0x0000018BB3080000-0x0000018BB3090000-memory.dmp
memory/2188-93-0x0000018BB3080000-0x0000018BB3090000-memory.dmp
memory/2880-280-0x0000000000ED0000-0x0000000001B1F000-memory.dmp
memory/2880-223-0x0000000000ED0000-0x0000000001B1F000-memory.dmp
memory/2880-226-0x0000000000ED0000-0x0000000001B1F000-memory.dmp
memory/2880-225-0x0000000000ED0000-0x0000000001B1F000-memory.dmp
memory/3204-158-0x0000023BB02E0000-0x0000023BB02E8000-memory.dmp
memory/3204-163-0x0000023BCD2D0000-0x0000023BCD30E000-memory.dmp
memory/3204-147-0x0000023BABEB0000-0x0000023BAE480000-memory.dmp
memory/3204-194-0x0000023BCE260000-0x0000023BCE26E000-memory.dmp
memory/3204-186-0x0000023BCE1F0000-0x0000023BCE1F8000-memory.dmp
memory/3204-178-0x0000023BCEEB0000-0x0000023BCF428000-memory.dmp
memory/3204-180-0x0000023BCE1A0000-0x0000023BCE1BA000-memory.dmp
memory/3204-165-0x0000023BCDC40000-0x0000023BCDC48000-memory.dmp
memory/3204-148-0x0000023BCA110000-0x0000023BCA7BC000-memory.dmp
memory/3204-177-0x0000023BCE070000-0x0000023BCE180000-memory.dmp
memory/3204-166-0x0000023BCDC90000-0x0000023BCDC98000-memory.dmp
memory/3204-169-0x0000023BCDCC0000-0x0000023BCDCD4000-memory.dmp
memory/3204-170-0x0000023BCDD00000-0x0000023BCDD26000-memory.dmp
memory/3204-171-0x0000023BCD370000-0x0000023BCD384000-memory.dmp
memory/3204-172-0x0000023BCDE20000-0x0000023BCDE48000-memory.dmp
memory/3204-173-0x0000023BCDCB0000-0x0000023BCDCB8000-memory.dmp
memory/3204-175-0x0000023BCE050000-0x0000023BCE056000-memory.dmp
memory/3204-176-0x0000023BCE060000-0x0000023BCE06A000-memory.dmp
memory/3204-174-0x0000023BCDCF0000-0x0000023BCDCFA000-memory.dmp
memory/3204-167-0x0000023BCDCA0000-0x0000023BCDCA8000-memory.dmp
memory/3204-168-0x0000023BCDCD0000-0x0000023BCDCEC000-memory.dmp
memory/3204-164-0x0000023BCD980000-0x0000023BCDA38000-memory.dmp
memory/3204-193-0x0000023BCE310000-0x0000023BCE348000-memory.dmp
memory/3204-160-0x0000023BB0300000-0x0000023BB0320000-memory.dmp
memory/3204-161-0x0000023BCD140000-0x0000023BCD16E000-memory.dmp
memory/3204-159-0x0000023BB02F0000-0x0000023BB0300000-memory.dmp
memory/3204-157-0x0000023BCA930000-0x0000023BCD04C000-memory.dmp
memory/3204-150-0x0000023BAE820000-0x0000023BAE828000-memory.dmp
memory/3852-245-0x0000000000D70000-0x00000000019BF000-memory.dmp
memory/3852-232-0x0000000000D70000-0x00000000019BF000-memory.dmp