Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
05/08/2026, 14:58
General
- Target 90343ace902ceacf427956a7ce2986dd0e8d3caaf7a7e5e3e0d5534f6c65043b.exe
- Size 3.4MB
- Sample260805-scc33abh64
- SHA256 90343ace902ceacf427956a7ce2986dd0e8d3caaf7a7e5e3e0d5534f6c65043b
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 14 IoCs
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- UPX packed file 18 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\90343ace902ceacf427956a7ce2986dd0e8d3caaf7a7e5e3e0d5534f6c65043b.exe"C:\Users\Admin\AppData\Local\Temp\90343ace902ceacf427956a7ce2986dd0e8d3caaf7a7e5e3e0d5534f6c65043b.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft.NET\RuntimeBroker.exe"C:\Program Files (x86)\Microsoft.NET\RuntimeBroker.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\RuntimeBroker.exe"C:\Program Files (x86)\Microsoft\Edge\Application\RuntimeBroker.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RuntimeBroker.exe
memory/1524-13-0x0000000000780000-0x00000000013D4000-memory.dmp
memory/1524-2-0x0000000000780000-0x00000000013D4000-memory.dmp
memory/1524-3-0x0000000000780000-0x00000000013D4000-memory.dmp
memory/1524-4-0x0000000000780000-0x00000000013D4000-memory.dmp
memory/1524-0-0x0000000000780000-0x00000000013D4000-memory.dmp
memory/2252-34-0x0000000006500000-0x000000000654C000-memory.dmp
memory/2252-38-0x00000000078E0000-0x0000000007916000-memory.dmp
memory/2252-53-0x0000000074240000-0x00000000749FC000-memory.dmp
memory/2252-18-0x0000000074252000-0x0000000074253000-memory.dmp
memory/2252-19-0x0000000002C30000-0x0000000002C66000-memory.dmp
memory/2252-21-0x00000000059A0000-0x0000000005FEA000-memory.dmp
memory/2252-20-0x0000000074240000-0x00000000749FC000-memory.dmp
memory/2252-22-0x0000000074240000-0x00000000749FC000-memory.dmp
memory/2252-51-0x0000000008CF0000-0x00000000092AA000-memory.dmp
memory/2252-27-0x00000000056A0000-0x00000000056C2000-memory.dmp
memory/2252-28-0x0000000005740000-0x00000000057A6000-memory.dmp
memory/2252-29-0x00000000057B0000-0x0000000005816000-memory.dmp
memory/2252-32-0x0000000005FF0000-0x000000000634B000-memory.dmp
memory/2252-33-0x00000000064C0000-0x00000000064DE000-memory.dmp
memory/2252-50-0x0000000007F80000-0x0000000007FA2000-memory.dmp
memory/2252-48-0x0000000007B80000-0x0000000007C16000-memory.dmp
memory/2252-37-0x0000000006A40000-0x0000000006A88000-memory.dmp
memory/2252-47-0x0000000007AD0000-0x0000000007ADA000-memory.dmp
memory/2252-39-0x00000000705B0000-0x00000000705FC000-memory.dmp
memory/2252-44-0x0000000007940000-0x00000000079E3000-memory.dmp
memory/2252-43-0x0000000007920000-0x0000000007940000-memory.dmp
memory/2252-40-0x00000000707B0000-0x0000000070B0B000-memory.dmp
memory/2252-45-0x00000000080B0000-0x000000000872C000-memory.dmp
memory/2252-46-0x0000000007A70000-0x0000000007A8A000-memory.dmp
memory/3888-36-0x0000000000070000-0x0000000000CC4000-memory.dmp
memory/3888-26-0x0000000000070000-0x0000000000CC4000-memory.dmp
memory/4516-14-0x0000000000140000-0x0000000000D94000-memory.dmp
memory/4516-49-0x0000000000140000-0x0000000000D94000-memory.dmp
memory/4516-12-0x0000000000140000-0x0000000000D94000-memory.dmp
memory/4516-15-0x0000000000140000-0x0000000000D94000-memory.dmp
memory/4516-54-0x0000000000140000-0x0000000000D94000-memory.dmp
memory/4516-55-0x0000000000140000-0x0000000000D94000-memory.dmp
memory/4516-56-0x0000000000140000-0x0000000000D94000-memory.dmp
memory/4516-57-0x0000000000140000-0x0000000000D94000-memory.dmp
memory/4516-59-0x0000000000140000-0x0000000000D94000-memory.dmp
memory/4516-60-0x0000000000140000-0x0000000000D94000-memory.dmp