Analysis
- user interaction
yes - max time kernel
48s - max time network
46s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 16:48
Behavioral task
behavioral1
Sample
modbroker.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
300 seconds
General
- Target modbroker.exe
- Size 3.4MB
- Sample260809-vbf5favwex
- SHA256 51280b264540b8db04302bed59df878d88fb397ccc6ad4b6d7b6a837e23d9d23
- MD5 c781d5575b6a15b884a6672383e86c05
- SHA1 1b70b326a4171acf0f8a563e7279e07ac1d7963b
- SHA512 43cc2377b38aac9a85410ede04d9aa7e8cc2a7ffdd06314cadbb9e70b1b93a9bb4c956dc6b58357fe49e899f3a7eef9d0f049ec0c529159178e89e034b2c236c
- SSDEEP 98304:rV8Wa9DmGZF2xYR/dHgfuF1qPh9MTspZZcvItXgY+:hWDpP2ChxUPh9MoPQ5
- TLSH T191F5330B463416E1F5F4BC77CAF24681C80763627BA96F835E5FD6EA46042229FEE04D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 4 IoCs
resource yara_rule behavioral1/memory/4072-2-0x0000000000270000-0x0000000000EC4000-memory.dmp family_salatstealer behavioral1/memory/4072-28-0x0000000000270000-0x0000000000EC4000-memory.dmp family_salatstealer behavioral1/memory/4072-29-0x0000000000270000-0x0000000000EC4000-memory.dmp family_salatstealer behavioral1/memory/4072-30-0x0000000000270000-0x0000000000EC4000-memory.dmp family_salatstealer -
resource yara_rule behavioral1/memory/4072-0-0x0000000000270000-0x0000000000EC4000-memory.dmp upx behavioral1/memory/4072-2-0x0000000000270000-0x0000000000EC4000-memory.dmp upx behavioral1/memory/4072-28-0x0000000000270000-0x0000000000EC4000-memory.dmp upx behavioral1/memory/4072-29-0x0000000000270000-0x0000000000EC4000-memory.dmp upx behavioral1/memory/4072-30-0x0000000000270000-0x0000000000EC4000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language modbroker.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2276 taskmgr.exe Token: SeSystemProfilePrivilege 2276 taskmgr.exe Token: SeCreateGlobalPrivilege 2276 taskmgr.exe - Suspicious use of FindShellTrayWindow 48 IoCs
pid Process 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe - Suspicious use of SendNotifyMessage 48 IoCs
pid Process 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2276 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\modbroker.exe"C:\Users\Admin\AppData\Local\Temp\modbroker.exe"1⤵
- System Location Discovery: System Language Discovery
PID:4072
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2276