Analysis
- user interaction
yes - max time kernel
450s - max time network
450s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
15/07/2026, 06:18
General
- Target New-installer-Peepcracks.exe
- Size 3.6MB
- Sample260715-g211msgv2s
- SHA256 d7d6ce7010b9ef46f5a6063867034b8825381c194df13d01d42dd6db79292ea1
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 50 IoCs
- UAC bypass 3 TTPs 1 IoCs
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 5 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Drops file in System32 directory 2 IoCs
- UPX packed file 55 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 4 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 5 IoCs
- Suspicious behavior: EnumeratesProcesses 15 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 34 IoCs
- Suspicious use of SendNotifyMessage 32 IoCs
- Suspicious use of WriteProcessMemory 31 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\New-installer-Peepcracks.exe"C:\Users\Admin\AppData\Local\Temp\New-installer-Peepcracks.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AHnv4C6w.exe"C:\Users\Admin\AppData\Local\Temp\AHnv4C6w.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lsass.exeC:\Users\Admin\AppData\Local\Temp\lsass.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe4⤵
- UAC bypass
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ReAgentc.exe"C:\Windows\system32\ReAgentc.exe" /disable5⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff90884c728,0x7ff90884c734,0x7ff90884c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1932,i,3381145678198931544,3737771821399935809,524288 --field-trial-handle=2088,i,738136296746097906,8399507052014037872,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2208 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,16203079046673610349,4448760684772888453,262144 --field-trial-handle=2088,i,738136296746097906,8399507052014037872,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2096 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2304,i,923763770294210209,16832295722287363717,524288 --field-trial-handle=2088,i,738136296746097906,8399507052014037872,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2612 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,3369321954853713868,16692061888226392883,2097152 --field-trial-handle=2088,i,738136296746097906,8399507052014037872,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,13172730881634452191,17060286972470248582,2097152 --field-trial-handle=2088,i,738136296746097906,8399507052014037872,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4460,i,9296913124906227349,5315312183795647926,2097152 --field-trial-handle=2088,i,738136296746097906,8399507052014037872,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4508 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4724,i,15551827528621794899,5201748616096693233,2097152 --field-trial-handle=2088,i,738136296746097906,8399507052014037872,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4432 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4484,i,9458316151088888442,12818577623446708630,524288 --field-trial-handle=2088,i,738136296746097906,8399507052014037872,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4876 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4756,i,16903845121034134254,242579878517181816,524288 --field-trial-handle=2088,i,738136296746097906,8399507052014037872,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5060 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5680,i,6815884302649905321,15212636486101314456,524288 --field-trial-handle=2088,i,738136296746097906,8399507052014037872,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5684 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6044,i,2188667330539260187,13339051442790887827,2097152 --field-trial-handle=2088,i,738136296746097906,8399507052014037872,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5976 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5860,i,11530535792374701095,4052503036125164304,524288 --field-trial-handle=2088,i,738136296746097906,8399507052014037872,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3400 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5884,i,3476141914868403777,389380636950919327,524288 --field-trial-handle=2088,i,738136296746097906,8399507052014037872,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5680 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5912,i,17880364579523017408,15797280042233219202,524288 --field-trial-handle=2088,i,738136296746097906,8399507052014037872,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3376 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4528,i,15830542477832373908,4734260517741164622,262144 --field-trial-handle=2088,i,738136296746097906,8399507052014037872,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5788 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5780,i,12570882980158181126,6278599698537262066,524288 --field-trial-handle=2088,i,738136296746097906,8399507052014037872,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3132 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\taskhostw.exeC:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\taskhostw.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\lsass.exeC:\Users\Admin\AppData\Local\Temp\lsass.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\lsass.exeC:\Users\Admin\AppData\Local\Temp\lsass.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_000007
the-real-index
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe58d1d2.TMP
Local State
Local State
Local State
Local State
Local State
AHnv4C6w.exe
__PSScriptPolicyTest_2ez2kt2s.cre.ps1
memory/1340-189-0x00000000073A0000-0x00000000073A8000-memory.dmp
memory/1340-188-0x0000000007470000-0x000000000748A000-memory.dmp
memory/1340-137-0x0000000004F80000-0x00000000055A8000-memory.dmp
memory/1340-138-0x0000000004C60000-0x0000000004C82000-memory.dmp
memory/1340-139-0x0000000004D00000-0x0000000004D66000-memory.dmp
memory/1340-140-0x0000000004D70000-0x0000000004DD6000-memory.dmp
memory/1340-131-0x00000000022D0000-0x0000000002306000-memory.dmp
memory/1340-148-0x00000000056B0000-0x0000000005A04000-memory.dmp
memory/1340-149-0x0000000005C20000-0x0000000005C3E000-memory.dmp
memory/1340-150-0x0000000005C70000-0x0000000005CBC000-memory.dmp
memory/1340-151-0x0000000006DC0000-0x0000000006E04000-memory.dmp
memory/1340-152-0x0000000006F30000-0x0000000006FA6000-memory.dmp
memory/1340-153-0x0000000007630000-0x0000000007CAA000-memory.dmp
memory/1340-154-0x0000000006FD0000-0x0000000006FEA000-memory.dmp
memory/1340-157-0x00000000713D0000-0x0000000071724000-memory.dmp
memory/1340-156-0x0000000070C90000-0x0000000070CDC000-memory.dmp
memory/1340-165-0x00000000071E0000-0x00000000071FE000-memory.dmp
memory/1340-155-0x00000000071A0000-0x00000000071D2000-memory.dmp
memory/1340-166-0x0000000007200000-0x00000000072A3000-memory.dmp
memory/1340-167-0x0000000007300000-0x000000000730A000-memory.dmp
memory/1340-168-0x00000000073D0000-0x0000000007466000-memory.dmp
memory/1340-169-0x0000000007330000-0x0000000007341000-memory.dmp
memory/1340-195-0x0000000008260000-0x0000000008804000-memory.dmp
memory/1340-194-0x0000000007470000-0x0000000007492000-memory.dmp
memory/1340-186-0x0000000007360000-0x000000000736E000-memory.dmp
memory/1340-187-0x0000000007370000-0x0000000007384000-memory.dmp
memory/1708-250-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-283-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-128-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-129-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-196-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-323-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-215-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-225-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-322-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-99-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-247-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-248-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-249-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-130-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-251-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-255-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-256-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-257-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-258-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-321-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-267-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-268-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-269-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-312-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-278-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-311-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-310-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-282-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-308-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-284-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-285-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-286-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-287-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-306-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-296-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-297-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-298-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-299-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-300-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-301-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-302-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-303-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-304-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/1708-305-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/3664-111-0x0000000000140000-0x0000000000D97000-memory.dmp
memory/3664-107-0x0000000000140000-0x0000000000D97000-memory.dmp
memory/4420-5-0x00000000005E0000-0x0000000001237000-memory.dmp
memory/4420-6-0x00000000005E0000-0x0000000001237000-memory.dmp
memory/4420-4-0x00000000005E0000-0x0000000001237000-memory.dmp
memory/4420-57-0x00000000005E0000-0x0000000001237000-memory.dmp
memory/4420-100-0x00000000005E0000-0x0000000001237000-memory.dmp
memory/4852-309-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/4992-281-0x0000000000E80000-0x0000000001AD7000-memory.dmp
memory/4992-280-0x0000000000E80000-0x0000000001AD7000-memory.dmp