Analysis
- geolocation tags
- user interaction
yes - max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
28/07/2026, 06:20
General
- Target anonhax.rar
- Size 7.9MB
- Sample260728-g32csscn5w
- SHA256 7b144362c494d15657b5961adc9ea215952e98dd9637a1db1b42c39eab11aab0
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 5 IoCs
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\anonhax.rar"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zO8BE6C7D9\anonhax.exe"C:\Users\Admin\AppData\Local\Temp\7zO8BE6C7D9\anonhax.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\csxcompiler.exe"C:\Users\Admin\AppData\Local\Temp\csxcompiler.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\anonhax.exe"C:\Windows\anonhax.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHUAcgB1ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHkAcwBkACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG0AYgBjACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHAAcQBwACMAPgA="4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\miner.exe"C:\Users\Admin\AppData\Local\Temp\miner.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData,$env:windir) -ExclusionExtension @('.exe','.dll') -Force5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\anonhax_free.exe"C:\Users\Admin\AppData\Roaming\anonhax_free.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls5⤵
- Executes a command shell one-liner
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
anonhax.exe
__PSScriptPolicyTest_tfem4k0u.j0a.ps1
csxcompiler.exe
miner.exe
anonhax_free.exe
anonhax.exe
memory/1764-25-0x0000000000E20000-0x00000000019AE000-memory.dmp
memory/1764-82-0x0000000000E20000-0x00000000019AE000-memory.dmp
memory/1764-81-0x0000000000E20000-0x00000000019AE000-memory.dmp
memory/2784-69-0x0000000007220000-0x00000000072C3000-memory.dmp
memory/2784-74-0x00000000076D0000-0x00000000076E1000-memory.dmp
memory/2784-56-0x0000000005BA0000-0x0000000005EF4000-memory.dmp
memory/2784-57-0x00000000061C0000-0x00000000061DE000-memory.dmp
memory/2784-58-0x00000000061E0000-0x000000000622C000-memory.dmp
memory/2784-59-0x0000000006760000-0x0000000006792000-memory.dmp
memory/2784-60-0x0000000070740000-0x000000007078C000-memory.dmp
memory/2784-68-0x00000000067A0000-0x00000000067BE000-memory.dmp
memory/2784-48-0x0000000005B30000-0x0000000005B96000-memory.dmp
memory/2784-71-0x00000000074D0000-0x00000000074EA000-memory.dmp
memory/2784-70-0x0000000007B50000-0x00000000081CA000-memory.dmp
memory/2784-72-0x0000000007540000-0x000000000754A000-memory.dmp
memory/2784-73-0x0000000007760000-0x00000000077F6000-memory.dmp
memory/2784-47-0x0000000005AC0000-0x0000000005B26000-memory.dmp
memory/2784-75-0x0000000007710000-0x000000000771E000-memory.dmp
memory/2784-76-0x0000000007720000-0x0000000007734000-memory.dmp
memory/2784-77-0x0000000007800000-0x000000000781A000-memory.dmp
memory/2784-78-0x0000000007750000-0x0000000007758000-memory.dmp
memory/2784-46-0x00000000051F0000-0x0000000005212000-memory.dmp
memory/2784-45-0x00000000052E0000-0x0000000005908000-memory.dmp
memory/2784-44-0x0000000002BE0000-0x0000000002C16000-memory.dmp
memory/3028-83-0x0000022977260000-0x0000022977282000-memory.dmp
memory/3028-99-0x0000022977F90000-0x0000022977FAC000-memory.dmp
memory/3028-100-0x0000022977FB0000-0x0000022978065000-memory.dmp
memory/3028-101-0x0000022977F80000-0x0000022977F8A000-memory.dmp
memory/3028-102-0x0000022978090000-0x00000229780AC000-memory.dmp