Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 18:08
Behavioral task
behavioral1
Sample
2026-08-08_24e4be2066c9fc74e3df1d8d01084993_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_24e4be2066c9fc74e3df1d8d01084993_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target 2026-08-08_24e4be2066c9fc74e3df1d8d01084993_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe
- Size 11.1MB
- Sample260808-wrd6fswwcs
- SHA256 dbf15cad8bf694de11e213deb66fe667df845c7a72107cccbce21bc8d99fb9f0
- MD5 24e4be2066c9fc74e3df1d8d01084993
- SHA1 8634122a2acec30bbb5fdd241b46a1ea2dc770be
- SHA512 22b6d92bad7d2c71403c5b8afa69633d6cb390391411dcdb2f26df6cb76b2d67821b4789f7ed99f09e10ec812e0eadf712818bdd8ad18f8589a39c4e09e9cfea
- SSDEEP 49152:MnQc2BYEFJc2ZiCnqJA0tUHF8U4uCvwMT2gCw7Ly2NSaD6WiT+rPa+VYkbJ2oxvI:OH2BYoZ5Gj7LmaDbvVR1DFTQ9I
- TLSH T157C65A01FA8B98F5E9031835416BB23F63315D049B28DBEBFB547F6AFC7B6811926205
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c51f-4.dat family_salatstealer - Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c51f-4.dat INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c51f-4.dat INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c51f-4.dat INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 27 2200 powershell.exe 28 2200 powershell.exe 28 2200 powershell.exe 30 2200 powershell.exe 31 2200 powershell.exe - Executes dropped EXE 3 IoCs
pid Process 5364 fontdrvhost.exe 2700 fontdrvhost.exe 1104 fontdrvhost.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Recovery ReAgentc.exe File opened for modification C:\Windows\SysWOW64\Recovery\ReAgent.xml ReAgentc.exe - Drops file in Program Files directory 20 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\fontdrvhost.exe fontdrvhost.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\90762cd6-3d5b-d290-7237-a94d6f89d63d 2026-08-08_24e4be2066c9fc74e3df1d8d01084993_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\OfficeClickToRun.exe 2026-08-08_24e4be2066c9fc74e3df1d8d01084993_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File created C:\Program Files (x86)\Windows Photo Viewer\90762cd6-3d5b-d290-7237-a94d6f89d63d 2026-08-08_24e4be2066c9fc74e3df1d8d01084993_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft.NET\services.exe 2026-08-08_24e4be2066c9fc74e3df1d8d01084993_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\90762cd6-3d5b-d290-7237-a94d6f89d63d 2026-08-08_24e4be2066c9fc74e3df1d8d01084993_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\spoolsv.exe 2026-08-08_24e4be2066c9fc74e3df1d8d01084993_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File created C:\Program Files (x86)\Reference Assemblies\90762cd6-3d5b-d290-7237-a94d6f89d63d 2026-08-08_24e4be2066c9fc74e3df1d8d01084993_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File created C:\Program Files (x86)\Windows Mail\csrss.exe 2026-08-08_24e4be2066c9fc74e3df1d8d01084993_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File created C:\Program Files (x86)\Windows NT\90762cd6-3d5b-d290-7237-a94d6f89d63d 2026-08-08_24e4be2066c9fc74e3df1d8d01084993_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File created C:\Program Files (x86)\WindowsPowerShell\90762cd6-3d5b-d290-7237-a94d6f89d63d 2026-08-08_24e4be2066c9fc74e3df1d8d01084993_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File created C:\Program Files (x86)\Internet Explorer\90762cd6-3d5b-d290-7237-a94d6f89d63d 2026-08-08_24e4be2066c9fc74e3df1d8d01084993_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File created C:\Program Files (x86)\Internet Explorer\fontdrvhost.exe 2026-08-08_24e4be2066c9fc74e3df1d8d01084993_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\fontdrvhost.exe fontdrvhost.exe File created C:\Program Files (x86)\Windows Photo Viewer\explorer.exe 2026-08-08_24e4be2066c9fc74e3df1d8d01084993_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File created C:\Program Files (x86)\Windows NT\SecurityHealthService.exe 2026-08-08_24e4be2066c9fc74e3df1d8d01084993_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File created C:\Program Files (x86)\Windows Mail\90762cd6-3d5b-d290-7237-a94d6f89d63d 2026-08-08_24e4be2066c9fc74e3df1d8d01084993_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File created C:\Program Files (x86)\WindowsPowerShell\winlogon.exe 2026-08-08_24e4be2066c9fc74e3df1d8d01084993_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft.NET\90762cd6-3d5b-d290-7237-a94d6f89d63d 2026-08-08_24e4be2066c9fc74e3df1d8d01084993_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File created C:\Program Files (x86)\Reference Assemblies\WmiPrvSE.exe 2026-08-08_24e4be2066c9fc74e3df1d8d01084993_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Panther\UnattendGC\setuperr.log ReAgentc.exe File opened for modification C:\Windows\Panther\UnattendGC\diagerr.xml ReAgentc.exe File opened for modification C:\Windows\Panther\UnattendGC\diagwrn.xml ReAgentc.exe File opened for modification C:\Windows\Logs\ReAgent\ReAgent.log ReAgentc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_24e4be2066c9fc74e3df1d8d01084993_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fontdrvhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fontdrvhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fontdrvhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ReAgentc.exe - Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 5272 2026-08-08_24e4be2066c9fc74e3df1d8d01084993_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe 5272 2026-08-08_24e4be2066c9fc74e3df1d8d01084993_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe 5272 2026-08-08_24e4be2066c9fc74e3df1d8d01084993_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe 5272 2026-08-08_24e4be2066c9fc74e3df1d8d01084993_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe 5364 fontdrvhost.exe 5364 fontdrvhost.exe 5364 fontdrvhost.exe 5364 fontdrvhost.exe 2200 powershell.exe 2200 powershell.exe 5364 fontdrvhost.exe 5364 fontdrvhost.exe 5364 fontdrvhost.exe 5364 fontdrvhost.exe 5364 fontdrvhost.exe 5364 fontdrvhost.exe 5364 fontdrvhost.exe 5364 fontdrvhost.exe 5364 fontdrvhost.exe 5364 fontdrvhost.exe 5364 fontdrvhost.exe 5364 fontdrvhost.exe 5364 fontdrvhost.exe 5364 fontdrvhost.exe 5364 fontdrvhost.exe 5364 fontdrvhost.exe 5364 fontdrvhost.exe 5364 fontdrvhost.exe 5364 fontdrvhost.exe 5364 fontdrvhost.exe 5364 fontdrvhost.exe 5364 fontdrvhost.exe 5364 fontdrvhost.exe 5364 fontdrvhost.exe 5364 fontdrvhost.exe 5364 fontdrvhost.exe 5364 fontdrvhost.exe 5364 fontdrvhost.exe 5364 fontdrvhost.exe 5364 fontdrvhost.exe 5364 fontdrvhost.exe 5364 fontdrvhost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2200 powershell.exe Token: SeIncreaseQuotaPrivilege 2200 powershell.exe Token: SeSecurityPrivilege 2200 powershell.exe Token: SeTakeOwnershipPrivilege 2200 powershell.exe Token: SeLoadDriverPrivilege 2200 powershell.exe Token: SeSystemProfilePrivilege 2200 powershell.exe Token: SeSystemtimePrivilege 2200 powershell.exe Token: SeProfSingleProcessPrivilege 2200 powershell.exe Token: SeIncBasePriorityPrivilege 2200 powershell.exe Token: SeCreatePagefilePrivilege 2200 powershell.exe Token: SeBackupPrivilege 2200 powershell.exe Token: SeRestorePrivilege 2200 powershell.exe Token: SeShutdownPrivilege 2200 powershell.exe Token: SeDebugPrivilege 2200 powershell.exe Token: SeSystemEnvironmentPrivilege 2200 powershell.exe Token: SeRemoteShutdownPrivilege 2200 powershell.exe Token: SeUndockPrivilege 2200 powershell.exe Token: SeManageVolumePrivilege 2200 powershell.exe Token: 33 2200 powershell.exe Token: 34 2200 powershell.exe Token: 35 2200 powershell.exe Token: 36 2200 powershell.exe Token: SeIncreaseQuotaPrivilege 2200 powershell.exe Token: SeSecurityPrivilege 2200 powershell.exe Token: SeTakeOwnershipPrivilege 2200 powershell.exe Token: SeLoadDriverPrivilege 2200 powershell.exe Token: SeSystemProfilePrivilege 2200 powershell.exe Token: SeSystemtimePrivilege 2200 powershell.exe Token: SeProfSingleProcessPrivilege 2200 powershell.exe Token: SeIncBasePriorityPrivilege 2200 powershell.exe Token: SeCreatePagefilePrivilege 2200 powershell.exe Token: SeBackupPrivilege 2200 powershell.exe Token: SeRestorePrivilege 2200 powershell.exe Token: SeShutdownPrivilege 2200 powershell.exe Token: SeDebugPrivilege 2200 powershell.exe Token: SeSystemEnvironmentPrivilege 2200 powershell.exe Token: SeRemoteShutdownPrivilege 2200 powershell.exe Token: SeUndockPrivilege 2200 powershell.exe Token: SeManageVolumePrivilege 2200 powershell.exe Token: 33 2200 powershell.exe Token: 34 2200 powershell.exe Token: 35 2200 powershell.exe Token: 36 2200 powershell.exe Token: SeIncreaseQuotaPrivilege 2200 powershell.exe Token: SeSecurityPrivilege 2200 powershell.exe Token: SeTakeOwnershipPrivilege 2200 powershell.exe Token: SeLoadDriverPrivilege 2200 powershell.exe Token: SeSystemProfilePrivilege 2200 powershell.exe Token: SeSystemtimePrivilege 2200 powershell.exe Token: SeProfSingleProcessPrivilege 2200 powershell.exe Token: SeIncBasePriorityPrivilege 2200 powershell.exe Token: SeCreatePagefilePrivilege 2200 powershell.exe Token: SeBackupPrivilege 2200 powershell.exe Token: SeRestorePrivilege 2200 powershell.exe Token: SeShutdownPrivilege 2200 powershell.exe Token: SeDebugPrivilege 2200 powershell.exe Token: SeSystemEnvironmentPrivilege 2200 powershell.exe Token: SeRemoteShutdownPrivilege 2200 powershell.exe Token: SeUndockPrivilege 2200 powershell.exe Token: SeManageVolumePrivilege 2200 powershell.exe Token: 33 2200 powershell.exe Token: 34 2200 powershell.exe Token: 35 2200 powershell.exe Token: 36 2200 powershell.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 5272 wrote to memory of 5364 5272 2026-08-08_24e4be2066c9fc74e3df1d8d01084993_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe 91 PID 5364 wrote to memory of 2200 5364 fontdrvhost.exe 92 PID 5364 wrote to memory of 2700 5364 fontdrvhost.exe 94 PID 5364 wrote to memory of 1104 5364 fontdrvhost.exe 96 PID 2200 wrote to memory of 1568 2200 powershell.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_24e4be2066c9fc74e3df1d8d01084993_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_24e4be2066c9fc74e3df1d8d01084993_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\Program Files (x86)\Internet Explorer\fontdrvhost.exe"C:\Program Files (x86)\Internet Explorer\fontdrvhost.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\ReAgentc.exe"C:\Windows\system32\ReAgentc.exe" /disable4⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1568
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\fontdrvhost.exe"C:\Program Files (x86)\Microsoft\Edge\Application\fontdrvhost.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2700
-
-
C:\Program Files\Google\Chrome\Application\fontdrvhost.exe"C:\Program Files\Google\Chrome\Application\fontdrvhost.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1104
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:1716
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:5948
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4192
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC1⤵PID:2352
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\spoolsv.exe
- Size 11.1MB
- SHA256 dbf15cad8bf694de11e213deb66fe667df845c7a72107cccbce21bc8d99fb9f0
- MD5 24e4be2066c9fc74e3df1d8d01084993
- SHA1 8634122a2acec30bbb5fdd241b46a1ea2dc770be
- SHA512 22b6d92bad7d2c71403c5b8afa69633d6cb390391411dcdb2f26df6cb76b2d67821b4789f7ed99f09e10ec812e0eadf712818bdd8ad18f8589a39c4e09e9cfea
- SSDEEP 49152:MnQc2BYEFJc2ZiCnqJA0tUHF8U4uCvwMT2gCw7Ly2NSaD6WiT+rPa+VYkbJ2oxvI:OH2BYoZ5Gj7LmaDbvVR1DFTQ9I
- TLSH T157C65A01FA8B98F5E9031835416BB23F63315D049B28DBEBFB547F6AFC7B6811926205
- MD5 SHA1 SHA512 SSDEEP TLSH