Analysis
- user interaction
yes - max time kernel
44s - max time network
84s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
06/08/2026, 14:30
General
- Target BrawhallaInj.exe
- Size 10.0MB
- Sample260806-rt99fsad28
- SHA256 b32c80d7fc2f50b327554620912bd7c68b7aeda5e05d1f4706bd96aa79bea3dd
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 49 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BrawhallaInj.exe"C:\Users\Admin\AppData\Local\Temp\BrawhallaInj.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Windows Sidebar\svchost.exe"C:\Program Files (x86)\Windows Sidebar\svchost.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Adobe\WUDFHost.exeC:\Users\Admin\AppData\Local\Adobe\WUDFHost.exe1⤵
-
C:\Users\Admin\AppData\Local\Mozilla\StartMenuExperienceHost.exeC:\Users\Admin\AppData\Local\Mozilla\StartMenuExperienceHost.exe1⤵
-
C:\Users\Admin\AppData\Local\PeerDistRepub\WmiPrvSE.exeC:\Users\Admin\AppData\Local\PeerDistRepub\WmiPrvSE.exe1⤵
-
C:\Program Files (x86)\WindowsPowerShell\fontdrvhost.exe"C:\Program Files (x86)\WindowsPowerShell\fontdrvhost.exe"1⤵
-
C:\Program Files (x86)\Reference Assemblies\SecurityHealthService.exe"C:\Program Files (x86)\Reference Assemblies\SecurityHealthService.exe"1⤵
-
C:\Program Files (x86)\Mozilla Maintenance Service\wininit.exe"C:\Program Files (x86)\Mozilla Maintenance Service\wininit.exe"1⤵
-
C:\Program Files (x86)\Windows Sidebar\svchost.exe"C:\Program Files (x86)\Windows Sidebar\svchost.exe"1⤵
-
C:\Program Files (x86)\Windows Defender\explorer.exe"C:\Program Files (x86)\Windows Defender\explorer.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
wininit.exe
SecurityHealthService.exe
SecurityHealthService.exe
explorer.exe
explorer.exe
svchost.exe
svchost.exe
svchost.exe
WUDFHost.exe
memory/936-9-0x0000000003390000-0x0000000003F21000-memory.dmp
memory/936-6-0x0000000003390000-0x0000000003F21000-memory.dmp
memory/936-13-0x0000000003390000-0x0000000003F21000-memory.dmp
memory/936-3-0x0000000003390000-0x0000000003F21000-memory.dmp
memory/936-10-0x0000000003390000-0x0000000003F21000-memory.dmp
memory/936-7-0x0000000003390000-0x0000000003F21000-memory.dmp
memory/936-5-0x0000000003390000-0x0000000003F21000-memory.dmp
memory/936-128-0x0000000003390000-0x0000000003F21000-memory.dmp
memory/936-12-0x0000000003390000-0x0000000003F21000-memory.dmp
memory/936-8-0x0000000003390000-0x0000000003F21000-memory.dmp
memory/936-4-0x0000000003390000-0x0000000003F21000-memory.dmp
memory/936-0-0x0000000003390000-0x0000000003F21000-memory.dmp
memory/936-11-0x0000000003390000-0x0000000003F21000-memory.dmp
memory/2144-80-0x0000000003390000-0x0000000003F21000-memory.dmp
memory/2144-63-0x0000000003390000-0x0000000003F21000-memory.dmp
memory/2144-65-0x0000000003390000-0x0000000003F21000-memory.dmp
memory/2144-64-0x0000000003390000-0x0000000003F21000-memory.dmp
memory/2396-134-0x0000000003690000-0x0000000004221000-memory.dmp
memory/2396-133-0x0000000003690000-0x0000000004221000-memory.dmp
memory/2396-139-0x0000000003690000-0x0000000004221000-memory.dmp
memory/2396-140-0x0000000003690000-0x0000000004221000-memory.dmp
memory/2396-141-0x0000000003690000-0x0000000004221000-memory.dmp
memory/2396-124-0x0000000003690000-0x0000000004221000-memory.dmp
memory/2396-138-0x0000000003690000-0x0000000004221000-memory.dmp
memory/2652-144-0x0000000004740000-0x00000000052D1000-memory.dmp
memory/2652-135-0x0000000004740000-0x00000000052D1000-memory.dmp
memory/3688-70-0x00000000035A0000-0x0000000004131000-memory.dmp
memory/3688-84-0x00000000035A0000-0x0000000004131000-memory.dmp
memory/3688-66-0x00000000035A0000-0x0000000004131000-memory.dmp
memory/3688-69-0x00000000035A0000-0x0000000004131000-memory.dmp
memory/3688-67-0x00000000035A0000-0x0000000004131000-memory.dmp
memory/3688-68-0x00000000035A0000-0x0000000004131000-memory.dmp
memory/3688-47-0x00000000035A0000-0x0000000004131000-memory.dmp
memory/3976-101-0x0000000004CD0000-0x0000000005861000-memory.dmp
memory/3976-90-0x0000000004CD0000-0x0000000005861000-memory.dmp
memory/3976-108-0x0000000004CD0000-0x0000000005861000-memory.dmp
memory/3976-96-0x0000000004CD0000-0x0000000005861000-memory.dmp
memory/3976-100-0x0000000004CD0000-0x0000000005861000-memory.dmp
memory/3976-102-0x0000000004CD0000-0x0000000005861000-memory.dmp
memory/3976-95-0x0000000004CD0000-0x0000000005861000-memory.dmp
memory/4256-42-0x0000000003E00000-0x0000000004991000-memory.dmp
memory/4256-52-0x0000000003E00000-0x0000000004991000-memory.dmp
memory/4256-53-0x0000000003E00000-0x0000000004991000-memory.dmp
memory/4256-54-0x0000000003E00000-0x0000000004991000-memory.dmp
memory/4256-56-0x0000000003E00000-0x0000000004991000-memory.dmp
memory/4256-55-0x0000000003E00000-0x0000000004991000-memory.dmp
memory/4256-74-0x0000000003E00000-0x0000000004991000-memory.dmp
memory/4940-78-0x0000000003850000-0x00000000043E1000-memory.dmp
memory/4940-60-0x0000000003850000-0x00000000043E1000-memory.dmp
memory/4940-58-0x0000000003850000-0x00000000043E1000-memory.dmp
memory/4940-57-0x0000000003850000-0x00000000043E1000-memory.dmp
memory/4940-38-0x0000000003850000-0x00000000043E1000-memory.dmp
memory/4940-59-0x0000000003850000-0x00000000043E1000-memory.dmp
memory/4940-61-0x0000000003850000-0x00000000043E1000-memory.dmp
memory/4964-87-0x0000000004140000-0x0000000004CD1000-memory.dmp
memory/4964-98-0x0000000004140000-0x0000000004CD1000-memory.dmp
memory/4964-93-0x0000000004140000-0x0000000004CD1000-memory.dmp
memory/4964-99-0x0000000004140000-0x0000000004CD1000-memory.dmp
memory/4964-94-0x0000000004140000-0x0000000004CD1000-memory.dmp
memory/4964-105-0x0000000004140000-0x0000000004CD1000-memory.dmp
memory/4964-97-0x0000000004140000-0x0000000004CD1000-memory.dmp
memory/5560-118-0x0000000004510000-0x00000000050A1000-memory.dmp
memory/5560-117-0x0000000004510000-0x00000000050A1000-memory.dmp
memory/5560-119-0x0000000004510000-0x00000000050A1000-memory.dmp
memory/5560-111-0x0000000004510000-0x00000000050A1000-memory.dmp
memory/5560-116-0x0000000004510000-0x00000000050A1000-memory.dmp
memory/5560-115-0x0000000004510000-0x00000000050A1000-memory.dmp
memory/5560-114-0x0000000004510000-0x00000000050A1000-memory.dmp