Analysis
- max time kernel
899s - max time network
908s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
16/07/2026, 02:14
General
- Target EXITLAG_PATCHER_V1.4.4/FirstStart.exe
- Size 43.1MB
- Sample260716-cn9y6sbs8j
- SHA256 b03e9657b6d14754a89b519aa07388ac95e61258c217edad4adf68a5ba2488e1
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 64 IoCs
- Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Looks for VMWare services registry key. 1 TTPs 2 IoCs
- Executes dropped EXE 7 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 4 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\EXITLAG_PATCHER_V1.4.4\FirstStart.exe"C:\Users\Admin\AppData\Local\Temp\EXITLAG_PATCHER_V1.4.4\FirstStart.exe"1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows NT\csrss.exe"C:\Program Files (x86)\Windows NT\csrss.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Microsoft\dwm.exe"C:\Program Files (x86)\Microsoft\dwm.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Windows NT\csrss.exe"C:\Program Files (x86)\Windows NT\csrss.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Program Files (x86)\Windows NT\csrss.exe"C:\Program Files (x86)\Windows NT\csrss.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Windows NT\csrss.exe"C:\Program Files (x86)\Windows NT\csrss.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Program Files (x86)\Windows NT\csrss.exe"C:\Program Files (x86)\Windows NT\csrss.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
GpuService_9e1e7c.exe
memory/1052-47-0x0000000000900000-0x0000000001556000-memory.dmp
memory/1052-18-0x0000000000900000-0x0000000001556000-memory.dmp
memory/1052-54-0x0000000000900000-0x0000000001556000-memory.dmp
memory/1052-51-0x0000000000900000-0x0000000001556000-memory.dmp
memory/1052-58-0x0000000000900000-0x0000000001556000-memory.dmp
memory/1052-69-0x0000000000900000-0x0000000001556000-memory.dmp
memory/1052-46-0x0000000000900000-0x0000000001556000-memory.dmp
memory/2820-98-0x0000000000D60000-0x00000000019B6000-memory.dmp
memory/3512-213-0x0000000000D60000-0x00000000019B6000-memory.dmp
memory/4672-175-0x0000000000D60000-0x00000000019B6000-memory.dmp
memory/4760-70-0x0000000000D60000-0x00000000019B6000-memory.dmp
memory/4760-72-0x0000000000D60000-0x00000000019B6000-memory.dmp
memory/5032-137-0x0000000000D60000-0x00000000019B6000-memory.dmp
memory/5128-40-0x0000000004210000-0x0000000004E6F000-memory.dmp
memory/5128-52-0x0000000004210000-0x0000000004E6F000-memory.dmp
memory/5128-49-0x0000000004210000-0x0000000004E6F000-memory.dmp
memory/5128-48-0x0000000004210000-0x0000000004E6F000-memory.dmp
memory/5128-45-0x0000000000FB0000-0x00000000017D2000-memory.dmp
memory/5128-44-0x0000000004210000-0x0000000004E6F000-memory.dmp
memory/5128-42-0x0000000004210000-0x0000000004E6F000-memory.dmp
memory/5128-43-0x0000000004210000-0x0000000004E6F000-memory.dmp
memory/5128-39-0x0000000004210000-0x0000000004E6F000-memory.dmp
memory/5128-38-0x0000000004210000-0x0000000004E6F000-memory.dmp
memory/5128-31-0x0000000004210000-0x0000000004E6F000-memory.dmp
memory/5220-129-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-100-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-112-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-114-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-116-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-118-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-120-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-122-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-124-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-127-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-104-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-133-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-102-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-139-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-141-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-147-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-151-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-153-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-155-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-157-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-159-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-163-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-167-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-169-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-173-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-108-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-177-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-183-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-185-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-187-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-189-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-191-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-193-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-195-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-197-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-199-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-201-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-203-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-205-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-209-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-211-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-94-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-215-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-217-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-219-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-221-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-223-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-227-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-233-0x0000000000590000-0x00000000011E6000-memory.dmp
memory/5220-235-0x0000000000590000-0x00000000011E6000-memory.dmp