Analysis
- max time kernel
150s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 03:06
Behavioral task
behavioral1
Sample
2026-08-15_eed12f192a3c077a649c0619a8f1de73_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-15_eed12f192a3c077a649c0619a8f1de73_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
General
- Target 2026-08-15_eed12f192a3c077a649c0619a8f1de73_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe
- Size 11.1MB
- Sample260815-dlp2nadr21
- SHA256 f4ac09a175a2b0864ed46c1aed07248e2b5b5113712747ca1a5cc8d55bc9277d
- MD5 eed12f192a3c077a649c0619a8f1de73
- SHA1 776881348947df7abf16dcb121fc69fd2ac89122
- SHA512 cd887718b0df016c6b6cd18bcd3d80c36c12d3694fda5c2161b87166de5b95ecbb43f3174b59f160f396443e3e358c982597cbca2401dc916e2f07d737348657
- SSDEEP 49152:CnlDC/sT+NbD0m4tWrLR/whgkvbbrGIxoJaz+e0yo2Nyc+hCLN+ZPdqVwSHKQNIm:89C/stmfJ4f+S3CEdBK0
- TLSH T192C64A01FA8B54F5E9035831816FB23F63349D048B28DB9BEB547F6AFC776D1292A205
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 1 IoCs
resource yara_rule behavioral2/files/0x000c00000001c510-4.dat family_salatstealer - Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
resource yara_rule behavioral2/files/0x000c00000001c510-4.dat INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
resource yara_rule behavioral2/files/0x000c00000001c510-4.dat INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
resource yara_rule behavioral2/files/0x000c00000001c510-4.dat INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 21 2620 powershell.exe 22 2620 powershell.exe - Executes dropped EXE 2 IoCs
pid Process 6100 sihost.exe 800 sihost.exe - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Recovery ReAgentc.exe File opened for modification C:\Windows\SysWOW64\Recovery\ReAgent.xml ReAgentc.exe - Drops file in Program Files directory 22 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\MSBuild\winlogon.exe 2026-08-15_eed12f192a3c077a649c0619a8f1de73_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\lsass.exe 2026-08-15_eed12f192a3c077a649c0619a8f1de73_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File opened for modification C:\Program Files (x86)\Windows NT\SecurityHealthSystray.exe 2026-08-15_eed12f192a3c077a649c0619a8f1de73_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File created C:\Program Files (x86)\Windows Mail\ctfmon.exe 2026-08-15_eed12f192a3c077a649c0619a8f1de73_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File created C:\Program Files (x86)\MSBuild\d1db2e4d-d704-fbaa-58aa-c9c784364dd7 2026-08-15_eed12f192a3c077a649c0619a8f1de73_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File created C:\Program Files (x86)\Windows Media Player\d1db2e4d-d704-fbaa-58aa-c9c784364dd7 2026-08-15_eed12f192a3c077a649c0619a8f1de73_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File created C:\Program Files (x86)\Windows Media Player\sihost.exe 2026-08-15_eed12f192a3c077a649c0619a8f1de73_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\sihost.exe sihost.exe File created C:\Program Files (x86)\Windows Defender\svchost.exe 2026-08-15_eed12f192a3c077a649c0619a8f1de73_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File created C:\Program Files (x86)\Windows NT\d1db2e4d-d704-fbaa-58aa-c9c784364dd7 2026-08-15_eed12f192a3c077a649c0619a8f1de73_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File created C:\Program Files (x86)\MSBuild\winlogon.exe 2026-08-15_eed12f192a3c077a649c0619a8f1de73_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\d1db2e4d-d704-fbaa-58aa-c9c784364dd7 2026-08-15_eed12f192a3c077a649c0619a8f1de73_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File opened for modification C:\Program Files (x86)\Windows Media Player\sihost.exe 2026-08-15_eed12f192a3c077a649c0619a8f1de73_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File created C:\Program Files (x86)\Windows Defender\d1db2e4d-d704-fbaa-58aa-c9c784364dd7 2026-08-15_eed12f192a3c077a649c0619a8f1de73_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File created C:\Program Files (x86)\Windows Mail\d1db2e4d-d704-fbaa-58aa-c9c784364dd7 2026-08-15_eed12f192a3c077a649c0619a8f1de73_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File opened for modification C:\Program Files (x86)\Windows Mail\ctfmon.exe 2026-08-15_eed12f192a3c077a649c0619a8f1de73_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File created C:\Program Files (x86)\WindowsPowerShell\d1db2e4d-d704-fbaa-58aa-c9c784364dd7 2026-08-15_eed12f192a3c077a649c0619a8f1de73_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File created C:\Program Files (x86)\WindowsPowerShell\StartMenuExperienceHost.exe 2026-08-15_eed12f192a3c077a649c0619a8f1de73_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File opened for modification C:\Program Files (x86)\Microsoft\lsass.exe 2026-08-15_eed12f192a3c077a649c0619a8f1de73_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File opened for modification C:\Program Files (x86)\Windows Defender\svchost.exe 2026-08-15_eed12f192a3c077a649c0619a8f1de73_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File created C:\Program Files (x86)\Windows NT\SecurityHealthSystray.exe 2026-08-15_eed12f192a3c077a649c0619a8f1de73_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\StartMenuExperienceHost.exe 2026-08-15_eed12f192a3c077a649c0619a8f1de73_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Panther\UnattendGC\setuperr.log ReAgentc.exe File opened for modification C:\Windows\Panther\UnattendGC\diagerr.xml ReAgentc.exe File opened for modification C:\Windows\Panther\UnattendGC\diagwrn.xml ReAgentc.exe File opened for modification C:\Windows\Logs\ReAgent\ReAgent.log ReAgentc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sihost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ReAgentc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-15_eed12f192a3c077a649c0619a8f1de73_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sihost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe - Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 4932 2026-08-15_eed12f192a3c077a649c0619a8f1de73_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe 4932 2026-08-15_eed12f192a3c077a649c0619a8f1de73_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe 4932 2026-08-15_eed12f192a3c077a649c0619a8f1de73_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe 4932 2026-08-15_eed12f192a3c077a649c0619a8f1de73_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe 6100 sihost.exe 6100 sihost.exe 6100 sihost.exe 6100 sihost.exe 6100 sihost.exe 6100 sihost.exe 6100 sihost.exe 6100 sihost.exe 2620 powershell.exe 6100 sihost.exe 6100 sihost.exe 6100 sihost.exe 6100 sihost.exe 6100 sihost.exe 6100 sihost.exe 6100 sihost.exe 6100 sihost.exe 6100 sihost.exe 6100 sihost.exe 6100 sihost.exe 6100 sihost.exe 6100 sihost.exe 6100 sihost.exe 2620 powershell.exe 800 sihost.exe 800 sihost.exe 6100 sihost.exe 6100 sihost.exe 6100 sihost.exe 6100 sihost.exe 6100 sihost.exe 6100 sihost.exe 6100 sihost.exe 6100 sihost.exe 6100 sihost.exe 6100 sihost.exe 6100 sihost.exe 6100 sihost.exe 6100 sihost.exe 6100 sihost.exe 6100 sihost.exe 6100 sihost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 6100 sihost.exe Token: SeDebugPrivilege 2620 powershell.exe Token: SeIncreaseQuotaPrivilege 2620 powershell.exe Token: SeSecurityPrivilege 2620 powershell.exe Token: SeTakeOwnershipPrivilege 2620 powershell.exe Token: SeLoadDriverPrivilege 2620 powershell.exe Token: SeSystemProfilePrivilege 2620 powershell.exe Token: SeSystemtimePrivilege 2620 powershell.exe Token: SeProfSingleProcessPrivilege 2620 powershell.exe Token: SeIncBasePriorityPrivilege 2620 powershell.exe Token: SeCreatePagefilePrivilege 2620 powershell.exe Token: SeBackupPrivilege 2620 powershell.exe Token: SeRestorePrivilege 2620 powershell.exe Token: SeShutdownPrivilege 2620 powershell.exe Token: SeDebugPrivilege 2620 powershell.exe Token: SeSystemEnvironmentPrivilege 2620 powershell.exe Token: SeRemoteShutdownPrivilege 2620 powershell.exe Token: SeUndockPrivilege 2620 powershell.exe Token: SeManageVolumePrivilege 2620 powershell.exe Token: 33 2620 powershell.exe Token: 34 2620 powershell.exe Token: 35 2620 powershell.exe Token: 36 2620 powershell.exe Token: SeIncreaseQuotaPrivilege 2620 powershell.exe Token: SeSecurityPrivilege 2620 powershell.exe Token: SeTakeOwnershipPrivilege 2620 powershell.exe Token: SeLoadDriverPrivilege 2620 powershell.exe Token: SeSystemProfilePrivilege 2620 powershell.exe Token: SeSystemtimePrivilege 2620 powershell.exe Token: SeProfSingleProcessPrivilege 2620 powershell.exe Token: SeIncBasePriorityPrivilege 2620 powershell.exe Token: SeCreatePagefilePrivilege 2620 powershell.exe Token: SeBackupPrivilege 2620 powershell.exe Token: SeRestorePrivilege 2620 powershell.exe Token: SeShutdownPrivilege 2620 powershell.exe Token: SeDebugPrivilege 2620 powershell.exe Token: SeSystemEnvironmentPrivilege 2620 powershell.exe Token: SeRemoteShutdownPrivilege 2620 powershell.exe Token: SeUndockPrivilege 2620 powershell.exe Token: SeManageVolumePrivilege 2620 powershell.exe Token: 33 2620 powershell.exe Token: 34 2620 powershell.exe Token: 35 2620 powershell.exe Token: 36 2620 powershell.exe Token: SeIncreaseQuotaPrivilege 2620 powershell.exe Token: SeSecurityPrivilege 2620 powershell.exe Token: SeTakeOwnershipPrivilege 2620 powershell.exe Token: SeLoadDriverPrivilege 2620 powershell.exe Token: SeSystemProfilePrivilege 2620 powershell.exe Token: SeSystemtimePrivilege 2620 powershell.exe Token: SeProfSingleProcessPrivilege 2620 powershell.exe Token: SeIncBasePriorityPrivilege 2620 powershell.exe Token: SeCreatePagefilePrivilege 2620 powershell.exe Token: SeBackupPrivilege 2620 powershell.exe Token: SeRestorePrivilege 2620 powershell.exe Token: SeShutdownPrivilege 2620 powershell.exe Token: SeDebugPrivilege 2620 powershell.exe Token: SeSystemEnvironmentPrivilege 2620 powershell.exe Token: SeRemoteShutdownPrivilege 2620 powershell.exe Token: SeUndockPrivilege 2620 powershell.exe Token: SeManageVolumePrivilege 2620 powershell.exe Token: 33 2620 powershell.exe Token: 34 2620 powershell.exe Token: 35 2620 powershell.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4932 wrote to memory of 6100 4932 2026-08-15_eed12f192a3c077a649c0619a8f1de73_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe 91 PID 6100 wrote to memory of 2620 6100 sihost.exe 93 PID 6100 wrote to memory of 800 6100 sihost.exe 95 PID 2620 wrote to memory of 5236 2620 powershell.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_eed12f192a3c077a649c0619a8f1de73_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_eed12f192a3c077a649c0619a8f1de73_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Program Files (x86)\Windows Media Player\sihost.exe"C:\Program Files (x86)\Windows Media Player\sihost.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\ReAgentc.exe"C:\Windows\system32\ReAgentc.exe" /disable4⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5236
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\sihost.exe"C:\Program Files (x86)\Microsoft\Edge\Application\sihost.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:800
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2264
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC1⤵PID:1408
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\explorer.exe
- Size 11.1MB
- SHA256 f4ac09a175a2b0864ed46c1aed07248e2b5b5113712747ca1a5cc8d55bc9277d
- MD5 eed12f192a3c077a649c0619a8f1de73
- SHA1 776881348947df7abf16dcb121fc69fd2ac89122
- SHA512 cd887718b0df016c6b6cd18bcd3d80c36c12d3694fda5c2161b87166de5b95ecbb43f3174b59f160f396443e3e358c982597cbca2401dc916e2f07d737348657
- SSDEEP 49152:CnlDC/sT+NbD0m4tWrLR/whgkvbbrGIxoJaz+e0yo2Nyc+hCLN+ZPdqVwSHKQNIm:89C/stmfJ4f+S3CEdBK0
- TLSH T192C64A01FA8B54F5E9035831816FB23F63349D048B28DB9BEB547F6AFC776D1292A205
- MD5 SHA1 SHA512 SSDEEP TLSH