Analysis
- user interaction
yes - max time kernel
24s - max time network
27s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/07/2026, 12:19
Behavioral task
behavioral1
Sample
DirectX9.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
DirectX9.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target DirectX9.exe
- Size 3.4MB
- Sample260728-phlevawdjd
- SHA256 5a33bc95772df3bde58e86d47b140ca012983d8c50e1f908682a66020db3b740
- MD5 296ab1a80c6b18eb0bd3642741e7ba99
- SHA1 00ae186240d3598b7718daec21beebcb3ef8b03d
- SHA512 ba08ff3faef2ee9839476c242bafe92c85a41aba617b9c702937b44a11ede31d8257e6e8663ebfaafbbd4bf72f49503f99a22a0a74e53e8e42f9c498009b8aa0
- SSDEEP 98304:Tm55zPGezi5fxrIhacs3wqIWQwT83DZN:Tm5tPGccshacs3plQwIT
- TLSH T131F5338510A5E24FE63C01BEA7F4E0643CDBD992C763AF17539313610BE826A525AFDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 2 IoCs
resource yara_rule behavioral1/memory/4812-1-0x0000000000480000-0x00000000010D4000-memory.dmp family_salatstealer behavioral1/memory/4812-15-0x0000000000480000-0x00000000010D4000-memory.dmp family_salatstealer -
resource yara_rule behavioral1/memory/4812-0-0x0000000000480000-0x00000000010D4000-memory.dmp upx behavioral1/memory/4812-1-0x0000000000480000-0x00000000010D4000-memory.dmp upx behavioral1/memory/4812-15-0x0000000000480000-0x00000000010D4000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DirectX9.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 4812 DirectX9.exe 4812 DirectX9.exe 5032 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 5032 taskmgr.exe Token: SeSystemProfilePrivilege 5032 taskmgr.exe Token: SeCreateGlobalPrivilege 5032 taskmgr.exe Token: 33 5032 taskmgr.exe Token: SeIncBasePriorityPrivilege 5032 taskmgr.exe - Suspicious use of FindShellTrayWindow 40 IoCs
pid Process 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DirectX9.exe"C:\Users\Admin\AppData\Local\Temp\DirectX9.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4812
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5032