Analysis
- user interaction
yes - max time kernel
53s - max time network
54s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/07/2026, 22:22
Behavioral task
behavioral1
Sample
DiscordFix.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
DiscordFix.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target DiscordFix.exe
- Size 3.4MB
- Sample260717-2ablwsbv8v
- SHA256 0c8d889bba69756ab0b1d8daedecda4eee20f8dff4d0f69eeecae459f555435a
- MD5 fdb373f598c5540138418fc9de0e3608
- SHA1 94a093864479f37bb609e7d28d73cc4903dd59ef
- SHA512 fe92cdfa3b4bf9a5aa4d1fa673313970c221b36aae323228afad7963be1bfc3d63fdb9162c7ef5707561506c8490a5c6e3b66b888ad5fbb00445cf49fc14a5f0
- SSDEEP 98304:DtJpQJujpJXVrFcWPZQWM83h9m2D38MyKe3od:DLqujpJ7PZQWMo3m2D38jV
- TLSH T106F53356F8E16BE7C336651963AC8A09710EEB0C62ACC0D45389D34DC775E59EBCC0EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 4 IoCs
resource yara_rule behavioral2/memory/5856-1-0x0000000000C90000-0x00000000018E7000-memory.dmp family_salatstealer behavioral2/memory/5856-2-0x0000000000C90000-0x00000000018E7000-memory.dmp family_salatstealer behavioral2/memory/5856-28-0x0000000000C90000-0x00000000018E7000-memory.dmp family_salatstealer behavioral2/memory/5856-30-0x0000000000C90000-0x00000000018E7000-memory.dmp family_salatstealer -
resource yara_rule behavioral2/memory/5856-0-0x0000000000C90000-0x00000000018E7000-memory.dmp upx behavioral2/memory/5856-1-0x0000000000C90000-0x00000000018E7000-memory.dmp upx behavioral2/memory/5856-2-0x0000000000C90000-0x00000000018E7000-memory.dmp upx behavioral2/memory/5856-28-0x0000000000C90000-0x00000000018E7000-memory.dmp upx behavioral2/memory/5856-30-0x0000000000C90000-0x00000000018E7000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DiscordFix.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4000 taskmgr.exe Token: SeSystemProfilePrivilege 4000 taskmgr.exe Token: SeCreateGlobalPrivilege 4000 taskmgr.exe - Suspicious use of FindShellTrayWindow 40 IoCs
pid Process 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe 4000 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4000 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DiscordFix.exe"C:\Users\Admin\AppData\Local\Temp\DiscordFix.exe"1⤵
- System Location Discovery: System Language Discovery
PID:5856
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4000
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5144