Overview

overview

10

Static

static

10

2026-08-13...ve.exe

windows10-2004-x64

10

2026-08-13...ve.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/08/2026, 09:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-13_702026ef649b82030e219bb9092d9f04_elex_hive.exe
  • Size 3.1MB
  • Sample260813-k8ww2sem3s
  • SHA256 fca36c606273b69e2afb80cf7b8c3340c46b9c37fa6a6fe6e58d4e91b6719ee1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasiondiscoverysalatstealerpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Family: salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer
  • Detect SalatStealer payload 26 IoCs
  • UAC bypass 3 TTPs 1 IoCs
    defense_evasiontrojan
  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 26 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 26 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 26 IoCs
  • UPX dump on OEP (original entry point) 35 IoCs
  • Badlisted process makes network request 5 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE 11 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 10 IoCs
    persistence
  • UPX packed file 35 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 22 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_702026ef649b82030e219bb9092d9f04_elex_hive.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_702026ef649b82030e219bb9092d9f04_elex_hive.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5340
    • C:\Users\Admin\AppData\Local\Temp\svchost.exe
      C:\Users\Admin\AppData\Local\Temp\svchost.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1992
  • C:\Program Files (x86)\Reference Assemblies\fontdrvhost.exe
    "C:\Program Files (x86)\Reference Assemblies\fontdrvhost.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:2480
  • C:\Users\Admin\AppData\Local\D3DSCache\StartMenuExperienceHost.exe
    C:\Users\Admin\AppData\Local\D3DSCache\StartMenuExperienceHost.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:2620
  • C:\Users\Admin\AppData\Local\Google\ShellHost.exe
    C:\Users\Admin\AppData\Local\Google\ShellHost.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:4240
  • C:\Program Files (x86)\Adobe\winlogon.exe
    "C:\Program Files (x86)\Adobe\winlogon.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4696
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe
      2⤵
      • UAC bypass
      • Badlisted process makes network request
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1048
    • C:\Program Files (x86)\Microsoft\Edge\Application\winlogon.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\winlogon.exe" -
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:5224
  • C:\Program Files (x86)\Microsoft\WUDFHost.exe
    "C:\Program Files (x86)\Microsoft\WUDFHost.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:1364
  • C:\Program Files (x86)\Internet Explorer\sppsvc.exe
    "C:\Program Files (x86)\Internet Explorer\sppsvc.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:5880
  • C:\Program Files (x86)\MSBuild\OfficeClickToRun.exe
    "C:\Program Files (x86)\MSBuild\OfficeClickToRun.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:2352
  • C:\Program Files (x86)\Windows Media Player\csrss.exe
    "C:\Program Files (x86)\Windows Media Player\csrss.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:2028
  • C:\Program Files (x86)\Microsoft.NET\ctfmon.exe
    "C:\Program Files (x86)\Microsoft.NET\ctfmon.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:1592
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
      PID:4576

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Privilege Escalation

          Abuse Elevation Control Mechanism

          1
          T1548

          Bypass User Account Control

          1
          T1548.002

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Defense Evasion

          Abuse Elevation Control Mechanism

          1
          T1548

          Bypass User Account Control

          1
          T1548.002

          Impair Defenses

          1
          T1562

          Disable or Modify Tools

          1
          T1562.001

          Modify Registry

          3
          T1112

          Subvert Trust Controls

          1
          T1553

          Install Root Certificate

          1
          T1553.004

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          4
          T1552

          Credentials In Files

          4
          T1552.001

          Discovery

          System Information Discovery

          1
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Data from Local System

          3
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          ShellHost.exe
          • Path C:\Users\Admin\AppData\Local\Google\ShellHost.exe
          • Size 3.1MB
          • SHA256 fca36c606273b69e2afb80cf7b8c3340c46b9c37fa6a6fe6e58d4e91b6719ee1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          __PSScriptPolicyTest_xixn4h0a.lpy.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xixn4h0a.lpy.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/1048-101-0x00000000077A0000-0x0000000007836000-memory.dmp
          Download

          memory/1048-79-0x0000000004C60000-0x0000000004C96000-memory.dmp
          Download

          memory/1048-112-0x0000000008440000-0x0000000008448000-memory.dmp
          Download

          memory/1048-110-0x0000000008450000-0x000000000846C000-memory.dmp
          Download

          memory/1048-109-0x0000000008410000-0x0000000008425000-memory.dmp
          Download

          memory/1048-108-0x0000000006750000-0x0000000006760000-memory.dmp
          Download

          memory/1048-107-0x00000000083F0000-0x0000000008401000-memory.dmp
          Download

          memory/1048-104-0x00000000707E0000-0x0000000070B3B000-memory.dmp
          Download

          memory/1048-103-0x0000000008800000-0x0000000008DBA000-memory.dmp
          Download

          memory/1048-102-0x0000000007B90000-0x0000000007BB2000-memory.dmp
          Download

          memory/1048-86-0x0000000005CA0000-0x0000000005FFB000-memory.dmp
          Download

          memory/1048-100-0x0000000007580000-0x000000000758A000-memory.dmp
          Download

          memory/1048-99-0x0000000007540000-0x000000000755A000-memory.dmp
          Download

          memory/1048-81-0x0000000005350000-0x0000000005372000-memory.dmp
          Download

          memory/1048-97-0x0000000007290000-0x0000000007333000-memory.dmp
          Download

          memory/1048-91-0x0000000007170000-0x00000000071A6000-memory.dmp
          Download

          memory/1048-82-0x0000000005A50000-0x0000000005AB6000-memory.dmp
          Download

          memory/1048-96-0x00000000071B0000-0x00000000071D0000-memory.dmp
          Download

          memory/1048-93-0x00000000707E0000-0x0000000070B3B000-memory.dmp
          Download

          memory/1048-92-0x0000000070680000-0x00000000706CC000-memory.dmp
          Download

          memory/1048-88-0x0000000006210000-0x000000000625C000-memory.dmp
          Download

          memory/1048-87-0x0000000006160000-0x000000000617E000-memory.dmp
          Download

          memory/1048-98-0x0000000007BC0000-0x000000000823C000-memory.dmp
          Download

          memory/1048-83-0x0000000005AC0000-0x0000000005B26000-memory.dmp
          Download

          memory/1048-80-0x0000000005400000-0x0000000005A4A000-memory.dmp
          Download

          memory/1364-58-0x0000000000CC0000-0x0000000001849000-memory.dmp
          Download

          memory/1364-54-0x0000000000CC0000-0x0000000001849000-memory.dmp
          Download

          memory/1592-67-0x0000000000A30000-0x00000000015B9000-memory.dmp
          Download

          memory/1992-45-0x0000000000CD0000-0x0000000001859000-memory.dmp
          Download

          memory/1992-48-0x0000000000CD0000-0x0000000001859000-memory.dmp
          Download

          memory/2028-71-0x00000000003A0000-0x0000000000F29000-memory.dmp
          Download

          memory/2028-70-0x00000000003A0000-0x0000000000F29000-memory.dmp
          Download

          memory/2352-68-0x0000000000220000-0x0000000000DA9000-memory.dmp
          Download

          memory/2480-19-0x00000000006B0000-0x0000000001239000-memory.dmp
          Download

          memory/2480-17-0x00000000006B0000-0x0000000001239000-memory.dmp
          Download

          memory/2620-21-0x0000000000AD0000-0x0000000001659000-memory.dmp
          Download

          memory/2620-18-0x0000000000AD0000-0x0000000001659000-memory.dmp
          Download

          memory/4240-29-0x00000000009C0000-0x0000000001549000-memory.dmp
          Download

          memory/4240-26-0x00000000009C0000-0x0000000001549000-memory.dmp
          Download

          memory/4696-115-0x0000000000970000-0x00000000014F9000-memory.dmp
          Download

          memory/4696-117-0x0000000000970000-0x00000000014F9000-memory.dmp
          Download

          memory/4696-73-0x0000000000970000-0x00000000014F9000-memory.dmp
          Download

          memory/4696-51-0x0000000000970000-0x00000000014F9000-memory.dmp
          Download

          memory/4696-114-0x0000000000970000-0x00000000014F9000-memory.dmp
          Download

          memory/4696-89-0x0000000000970000-0x00000000014F9000-memory.dmp
          Download

          memory/4696-69-0x0000000000970000-0x00000000014F9000-memory.dmp
          Download

          memory/4696-111-0x0000000000970000-0x00000000014F9000-memory.dmp
          Download

          memory/4696-118-0x0000000000970000-0x00000000014F9000-memory.dmp
          Download

          memory/4696-119-0x0000000000970000-0x00000000014F9000-memory.dmp
          Download

          memory/4696-72-0x0000000000970000-0x00000000014F9000-memory.dmp
          Download

          memory/5224-90-0x0000000000370000-0x0000000000EF9000-memory.dmp
          Download

          memory/5340-1-0x00000000002D0000-0x0000000000E59000-memory.dmp
          Download

          memory/5340-25-0x00000000002D0000-0x0000000000E59000-memory.dmp
          Download

          memory/5340-2-0x00000000002D0000-0x0000000000E59000-memory.dmp
          Download

          memory/5340-46-0x00000000002D0000-0x0000000000E59000-memory.dmp
          Download

          memory/5340-0-0x00000000002D0000-0x0000000000E59000-memory.dmp
          Download

          memory/5340-5-0x00000000002D0000-0x0000000000E59000-memory.dmp
          Download

          memory/5880-56-0x0000000000530000-0x00000000010B9000-memory.dmp
          Download

          memory/5880-60-0x0000000000530000-0x00000000010B9000-memory.dmp
          Download