Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
05/08/2026, 00:53
General
- Target b0c565e3bc30a3fc4ce104c9d0e56ed8eeaf5d7d0d63320e6f35da9cd7802d2c.exe
- Size 3.4MB
- Sample260805-a8s52ssvbz
- SHA256 b0c565e3bc30a3fc4ce104c9d0e56ed8eeaf5d7d0d63320e6f35da9cd7802d2c
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 13 IoCs
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0c565e3bc30a3fc4ce104c9d0e56ed8eeaf5d7d0d63320e6f35da9cd7802d2c.exe"C:\Users\Admin\AppData\Local\Temp\b0c565e3bc30a3fc4ce104c9d0e56ed8eeaf5d7d0d63320e6f35da9cd7802d2c.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\java.exeC:\Users\Admin\AppData\Roaming/java.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\java.exe"C:\Program Files (x86)\Microsoft\Edge\Application\java.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
java.exe
memory/2108-15-0x0000000000370000-0x0000000000FBF000-memory.dmp
memory/2108-58-0x0000000000370000-0x0000000000FBF000-memory.dmp
memory/2108-57-0x0000000000370000-0x0000000000FBF000-memory.dmp
memory/2108-56-0x0000000000370000-0x0000000000FBF000-memory.dmp
memory/2108-51-0x0000000000370000-0x0000000000FBF000-memory.dmp
memory/2108-13-0x0000000000370000-0x0000000000FBF000-memory.dmp
memory/2108-16-0x0000000000370000-0x0000000000FBF000-memory.dmp
memory/2108-14-0x0000000000370000-0x0000000000FBF000-memory.dmp
memory/2580-48-0x0000000007900000-0x000000000791A000-memory.dmp
memory/2580-39-0x00000000068F0000-0x0000000006938000-memory.dmp
memory/2580-18-0x0000000074A82000-0x0000000074A83000-memory.dmp
memory/2580-19-0x0000000004E40000-0x0000000004E76000-memory.dmp
memory/2580-20-0x0000000074A70000-0x000000007522C000-memory.dmp
memory/2580-22-0x0000000074A70000-0x000000007522C000-memory.dmp
memory/2580-21-0x00000000054D0000-0x0000000005B1A000-memory.dmp
memory/2580-23-0x0000000005460000-0x0000000005482000-memory.dmp
memory/2580-24-0x0000000005D50000-0x0000000005DB6000-memory.dmp
memory/2580-25-0x0000000005DC0000-0x0000000005E26000-memory.dmp
memory/2580-27-0x0000000005E30000-0x000000000618B000-memory.dmp
memory/2580-55-0x0000000074A70000-0x000000007522C000-memory.dmp
memory/2580-35-0x0000000006330000-0x000000000634E000-memory.dmp
memory/2580-36-0x00000000063E0000-0x000000000642C000-memory.dmp
memory/2580-53-0x0000000008B80000-0x000000000913A000-memory.dmp
memory/2580-52-0x0000000007E20000-0x0000000007E42000-memory.dmp
memory/2580-40-0x0000000007750000-0x0000000007786000-memory.dmp
memory/2580-41-0x0000000070C30000-0x0000000070C7C000-memory.dmp
memory/2580-42-0x0000000070F00000-0x000000007125B000-memory.dmp
memory/2580-45-0x0000000007790000-0x00000000077B0000-memory.dmp
memory/2580-46-0x00000000077B0000-0x0000000007853000-memory.dmp
memory/2580-50-0x0000000007A10000-0x0000000007AA6000-memory.dmp
memory/2580-47-0x0000000007F40000-0x00000000085BC000-memory.dmp
memory/2580-49-0x0000000007960000-0x000000000796A000-memory.dmp
memory/2692-0-0x00000000001F0000-0x0000000000E3F000-memory.dmp
memory/2692-5-0x00000000001F0000-0x0000000000E3F000-memory.dmp
memory/2692-12-0x00000000001F0000-0x0000000000E3F000-memory.dmp
memory/2692-3-0x00000000001F0000-0x0000000000E3F000-memory.dmp
memory/2692-2-0x00000000001F0000-0x0000000000E3F000-memory.dmp
memory/2692-1-0x00000000001F0000-0x0000000000E3F000-memory.dmp
memory/3728-38-0x00000000000F0000-0x0000000000D3F000-memory.dmp
memory/3728-34-0x00000000000F0000-0x0000000000D3F000-memory.dmp