Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/08/2026, 00:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-17_27e02652eb3ed8d9e8c32f186ac4bba7_elex_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-17_27e02652eb3ed8d9e8c32f186ac4bba7_elex_snatch.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-17_27e02652eb3ed8d9e8c32f186ac4bba7_elex_snatch.exe
- Size 4.8MB
- Sample260818-azzapsbr4s
- SHA256 a0bf97bd28d6e68e4bf2b0d98f061d2b9be1bb27f0545ec5b886821a436607e7
- MD5 27e02652eb3ed8d9e8c32f186ac4bba7
- SHA1 93a7c1e966209e78b68e04e4ac3880dce08a1591
- SHA512 3dd353d04e57e47f410174b4d2dcca04a8c97cb4d4aa1a9ba074ca8dfe8060440129c7dbb111913f59d2371b01adf568e436d2feb948be4928075561863132b8
- SSDEEP 98304:wp8H2c94HyPTxk7LTXF5JkoUpwdAGpSHR7ij4BSjq:Xay70RkFCAGpGSm
- TLSH T14D36E000FE8795F2E4421632959B62BF27259E064F319B87EA847B3EF9732D50D37206
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 15 IoCs
resource yara_rule behavioral1/memory/2564-6-0x00000000001A0000-0x0000000000DEF000-memory.dmp family_salatstealer behavioral1/memory/2564-7-0x00000000001A0000-0x0000000000DEF000-memory.dmp family_salatstealer behavioral1/memory/2564-8-0x00000000001A0000-0x0000000000DEF000-memory.dmp family_salatstealer behavioral1/memory/2564-9-0x00000000001A0000-0x0000000000DEF000-memory.dmp family_salatstealer behavioral1/memory/2564-10-0x00000000001A0000-0x0000000000DEF000-memory.dmp family_salatstealer behavioral1/memory/2564-11-0x00000000001A0000-0x0000000000DEF000-memory.dmp family_salatstealer behavioral1/memory/2564-18-0x00000000001A0000-0x0000000000DEF000-memory.dmp family_salatstealer behavioral1/memory/2564-19-0x00000000001A0000-0x0000000000DEF000-memory.dmp family_salatstealer behavioral1/memory/2564-20-0x00000000001A0000-0x0000000000DEF000-memory.dmp family_salatstealer behavioral1/memory/2564-21-0x00000000001A0000-0x0000000000DEF000-memory.dmp family_salatstealer behavioral1/memory/2564-22-0x00000000001A0000-0x0000000000DEF000-memory.dmp family_salatstealer behavioral1/memory/2564-23-0x00000000001A0000-0x0000000000DEF000-memory.dmp family_salatstealer behavioral1/memory/2564-24-0x00000000001A0000-0x0000000000DEF000-memory.dmp family_salatstealer behavioral1/memory/2564-25-0x00000000001A0000-0x0000000000DEF000-memory.dmp family_salatstealer behavioral1/memory/2564-26-0x00000000001A0000-0x0000000000DEF000-memory.dmp family_salatstealer - Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 15 IoCs
resource yara_rule behavioral1/memory/2564-6-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/2564-7-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/2564-8-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/2564-9-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/2564-10-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/2564-11-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/2564-18-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/2564-19-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/2564-20-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/2564-21-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/2564-22-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/2564-23-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/2564-24-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/2564-25-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/2564-26-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 15 IoCs
resource yara_rule behavioral1/memory/2564-6-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2564-7-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2564-8-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2564-9-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2564-10-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2564-11-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2564-18-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2564-19-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2564-20-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2564-21-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2564-22-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2564-23-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2564-24-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2564-25-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2564-26-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables containing SQL queries to confidential data stores. Observed in infostealers 15 IoCs
resource yara_rule behavioral1/memory/2564-6-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2564-7-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2564-8-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2564-9-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2564-10-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2564-11-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2564-18-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2564-19-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2564-20-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2564-21-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2564-22-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2564-23-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2564-24-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2564-25-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2564-26-0x00000000001A0000-0x0000000000DEF000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - UPX dump on OEP (original entry point) 17 IoCs
resource yara_rule behavioral1/files/0x00070000000243dd-3.dat UPX behavioral1/memory/2564-5-0x00000000001A0000-0x0000000000DEF000-memory.dmp UPX behavioral1/memory/2564-6-0x00000000001A0000-0x0000000000DEF000-memory.dmp UPX behavioral1/memory/2564-7-0x00000000001A0000-0x0000000000DEF000-memory.dmp UPX behavioral1/memory/2564-8-0x00000000001A0000-0x0000000000DEF000-memory.dmp UPX behavioral1/memory/2564-9-0x00000000001A0000-0x0000000000DEF000-memory.dmp UPX behavioral1/memory/2564-10-0x00000000001A0000-0x0000000000DEF000-memory.dmp UPX behavioral1/memory/2564-11-0x00000000001A0000-0x0000000000DEF000-memory.dmp UPX behavioral1/memory/2564-18-0x00000000001A0000-0x0000000000DEF000-memory.dmp UPX behavioral1/memory/2564-19-0x00000000001A0000-0x0000000000DEF000-memory.dmp UPX behavioral1/memory/2564-20-0x00000000001A0000-0x0000000000DEF000-memory.dmp UPX behavioral1/memory/2564-21-0x00000000001A0000-0x0000000000DEF000-memory.dmp UPX behavioral1/memory/2564-22-0x00000000001A0000-0x0000000000DEF000-memory.dmp UPX behavioral1/memory/2564-23-0x00000000001A0000-0x0000000000DEF000-memory.dmp UPX behavioral1/memory/2564-24-0x00000000001A0000-0x0000000000DEF000-memory.dmp UPX behavioral1/memory/2564-25-0x00000000001A0000-0x0000000000DEF000-memory.dmp UPX behavioral1/memory/2564-26-0x00000000001A0000-0x0000000000DEF000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 2564 203944.068.exe -
resource yara_rule behavioral1/files/0x00070000000243dd-3.dat upx behavioral1/memory/2564-5-0x00000000001A0000-0x0000000000DEF000-memory.dmp upx behavioral1/memory/2564-6-0x00000000001A0000-0x0000000000DEF000-memory.dmp upx behavioral1/memory/2564-7-0x00000000001A0000-0x0000000000DEF000-memory.dmp upx behavioral1/memory/2564-8-0x00000000001A0000-0x0000000000DEF000-memory.dmp upx behavioral1/memory/2564-9-0x00000000001A0000-0x0000000000DEF000-memory.dmp upx behavioral1/memory/2564-10-0x00000000001A0000-0x0000000000DEF000-memory.dmp upx behavioral1/memory/2564-11-0x00000000001A0000-0x0000000000DEF000-memory.dmp upx behavioral1/memory/2564-18-0x00000000001A0000-0x0000000000DEF000-memory.dmp upx behavioral1/memory/2564-19-0x00000000001A0000-0x0000000000DEF000-memory.dmp upx behavioral1/memory/2564-20-0x00000000001A0000-0x0000000000DEF000-memory.dmp upx behavioral1/memory/2564-21-0x00000000001A0000-0x0000000000DEF000-memory.dmp upx behavioral1/memory/2564-22-0x00000000001A0000-0x0000000000DEF000-memory.dmp upx behavioral1/memory/2564-23-0x00000000001A0000-0x0000000000DEF000-memory.dmp upx behavioral1/memory/2564-24-0x00000000001A0000-0x0000000000DEF000-memory.dmp upx behavioral1/memory/2564-25-0x00000000001A0000-0x0000000000DEF000-memory.dmp upx behavioral1/memory/2564-26-0x00000000001A0000-0x0000000000DEF000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 203944.068.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-17_27e02652eb3ed8d9e8c32f186ac4bba7_elex_snatch.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2564 203944.068.exe 2564 203944.068.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4076 wrote to memory of 2564 4076 2026-08-17_27e02652eb3ed8d9e8c32f186ac4bba7_elex_snatch.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_27e02652eb3ed8d9e8c32f186ac4bba7_elex_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_27e02652eb3ed8d9e8c32f186ac4bba7_elex_snatch.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\203944.068.exeC:\Users\Admin\AppData\Local\Temp\203944.068.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2564
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\203944.068.exe
- Size 3.4MB
- SHA256 94fdb92f47aadc28c85f7968bdcc0093e9db8aee3daf6e982e6d135e04bd7205
- MD5 a34664cf3bc2a225b2f5ec5fe6cebc7f
- SHA1 c9cc0861afe00993e2f6754b63de6e128a82ee20
- SHA512 5e1f0b0e2d8f85ae7770519764754436b75532ba8751119ef7c99b6f68a0cd50e8f1e13832a7243aab14ac982aff975734022c8e7dda08760ff203b9844028ee
- SSDEEP 98304:z9g9SE6hSnotzMkaPVeW4XZrDurLm+yqvxkWU:ZGYJlbXRDu2Jqpk
- TLSH T192F5335AEC0A6FDAE46E4A39F51CFEC6AFCA6F45C1637349B88692C4F8641007352C85
- MD5 SHA1 SHA512 SSDEEP TLSH