Analysis
- user interaction
yes - max time kernel
149s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
19/08/2026, 04:08
General
- Target bot_v3.exe
- Size 43.1MB
- Sample260819-eqraysdl7t
- SHA256 b03e9657b6d14754a89b519aa07388ac95e61258c217edad4adf68a5ba2488e1
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 54 IoCs
- Enumerates VirtualBox registry keys 2 TTPs 20 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 10 IoCs
- Looks for VMWare Tools registry key 2 TTPs 10 IoCs
- Looks for VMWare services registry key. 1 TTPs 20 IoCs
- Executes dropped EXE 10 IoCs
- Adds Run key to start application 2 TTPs 8 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 14 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bot_v3.exe"C:\Users\Admin\AppData\Local\Temp\bot_v3.exe"1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Windows Mail\SecurityHealthService.exe"C:\Program Files (x86)\Windows Mail\SecurityHealthService.exe"2⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Common Files\StartMenuExperienceHost.exe"C:\Program Files (x86)\Common Files\StartMenuExperienceHost.exe"1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\svchost.exe"C:\Program Files (x86)\Microsoft\svchost.exe"1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Mozilla\ShellHost.exeC:\Users\Admin\AppData\Local\Mozilla\ShellHost.exe1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Mozilla Maintenance Service\GpuService_9e1e7c.exe"C:\Program Files (x86)\Mozilla Maintenance Service\GpuService_9e1e7c.exe"1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Adobe\OfficeClickToRun.exe"C:\Program Files (x86)\Adobe\OfficeClickToRun.exe"1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Windows NT\winlogon.exe"C:\Program Files (x86)\Windows NT\winlogon.exe"1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Windows Mail\SecurityHealthService.exe"C:\Program Files (x86)\Windows Mail\SecurityHealthService.exe"1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\WindowsPowerShell\smss.exe"C:\Program Files (x86)\WindowsPowerShell\smss.exe"1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartMenuExperienceHost.exe
svc_470bf943.log
svc_470bf943.log
svc_470bf943.log
svc_470bf943.log
svc_470bf943.log
svc_470bf943.log
svc_470bf943.log
svc_470bf943.log
svc_470bf943.log
svc_470bf943.log
svc_470bf943.log
svc_470bf943.log
svc_470bf943.log
svc_470bf943.log
GpuService_9e1e7c.exe
memory/1148-190-0x0000000004290000-0x0000000004EEF000-memory.dmp
memory/1148-243-0x0000000000F60000-0x0000000001782000-memory.dmp
memory/1148-188-0x0000000004290000-0x0000000004EEF000-memory.dmp
memory/1148-191-0x0000000004290000-0x0000000004EEF000-memory.dmp
memory/1148-187-0x0000000004290000-0x0000000004EEF000-memory.dmp
memory/1148-232-0x0000000004290000-0x0000000004EEF000-memory.dmp
memory/1148-103-0x0000000004290000-0x0000000004EEF000-memory.dmp
memory/1148-189-0x0000000004290000-0x0000000004EEF000-memory.dmp
memory/2216-209-0x0000000003BA0000-0x00000000047FF000-memory.dmp
memory/2216-210-0x0000000003BA0000-0x00000000047FF000-memory.dmp
memory/2216-213-0x0000000003BA0000-0x00000000047FF000-memory.dmp
memory/2216-161-0x0000000003BA0000-0x00000000047FF000-memory.dmp
memory/2216-238-0x0000000003BA0000-0x00000000047FF000-memory.dmp
memory/2216-247-0x0000000000170000-0x0000000000992000-memory.dmp
memory/2216-211-0x0000000003BA0000-0x00000000047FF000-memory.dmp
memory/2216-212-0x0000000003BA0000-0x00000000047FF000-memory.dmp
memory/2432-349-0x0000000004B10000-0x000000000576F000-memory.dmp
memory/2432-351-0x0000000004B10000-0x000000000576F000-memory.dmp
memory/2432-350-0x0000000004B10000-0x000000000576F000-memory.dmp
memory/2608-204-0x0000000004E50000-0x0000000005AAF000-memory.dmp
memory/2608-236-0x0000000004E50000-0x0000000005AAF000-memory.dmp
memory/2608-206-0x0000000004E50000-0x0000000005AAF000-memory.dmp
memory/2608-145-0x0000000004E50000-0x0000000005AAF000-memory.dmp
memory/2608-246-0x0000000000840000-0x0000000001062000-memory.dmp
memory/2608-207-0x0000000004E50000-0x0000000005AAF000-memory.dmp
memory/2608-205-0x0000000004E50000-0x0000000005AAF000-memory.dmp
memory/2608-203-0x0000000004E50000-0x0000000005AAF000-memory.dmp
memory/3556-290-0x0000000004B10000-0x000000000576F000-memory.dmp
memory/3556-296-0x0000000004B10000-0x000000000576F000-memory.dmp
memory/3556-298-0x0000000000280000-0x0000000000AA2000-memory.dmp
memory/3556-294-0x0000000004B10000-0x000000000576F000-memory.dmp
memory/3556-293-0x0000000004B10000-0x000000000576F000-memory.dmp
memory/3556-292-0x0000000004B10000-0x000000000576F000-memory.dmp
memory/3556-291-0x0000000004B10000-0x000000000576F000-memory.dmp
memory/3556-283-0x0000000004B10000-0x000000000576F000-memory.dmp
memory/3940-48-0x0000000003F20000-0x0000000004B7F000-memory.dmp
memory/3940-44-0x0000000003F20000-0x0000000004B7F000-memory.dmp
memory/3940-41-0x0000000003F20000-0x0000000004B7F000-memory.dmp
memory/3940-43-0x0000000003F20000-0x0000000004B7F000-memory.dmp
memory/3940-332-0x0000000003F20000-0x0000000004B7F000-memory.dmp
memory/3940-39-0x0000000003F20000-0x0000000004B7F000-memory.dmp
memory/3940-45-0x0000000000E50000-0x0000000001672000-memory.dmp
memory/3940-32-0x0000000003F20000-0x0000000004B7F000-memory.dmp
memory/3940-42-0x0000000003F20000-0x0000000004B7F000-memory.dmp
memory/3940-53-0x0000000003F20000-0x0000000004B7F000-memory.dmp
memory/3940-49-0x0000000003F20000-0x0000000004B7F000-memory.dmp
memory/3940-40-0x0000000003F20000-0x0000000004B7F000-memory.dmp
memory/3940-52-0x0000000003F20000-0x0000000004B7F000-memory.dmp
memory/3940-38-0x0000000003F20000-0x0000000004B7F000-memory.dmp
memory/4664-258-0x0000000003E20000-0x0000000004A7F000-memory.dmp
memory/4664-253-0x0000000003E20000-0x0000000004A7F000-memory.dmp
memory/4664-223-0x0000000003E20000-0x0000000004A7F000-memory.dmp
memory/4664-262-0x0000000000D10000-0x0000000001532000-memory.dmp
memory/4664-257-0x0000000003E20000-0x0000000004A7F000-memory.dmp
memory/4664-255-0x0000000003E20000-0x0000000004A7F000-memory.dmp
memory/4664-254-0x0000000003E20000-0x0000000004A7F000-memory.dmp
memory/4664-256-0x0000000003E20000-0x0000000004A7F000-memory.dmp
memory/5012-46-0x0000000000EB0000-0x0000000001B06000-memory.dmp
memory/5012-18-0x0000000000EB0000-0x0000000001B06000-memory.dmp
memory/5012-208-0x0000000000EB0000-0x0000000001B06000-memory.dmp
memory/5012-51-0x0000000000EB0000-0x0000000001B06000-memory.dmp
memory/5012-47-0x0000000000EB0000-0x0000000001B06000-memory.dmp
memory/6028-251-0x0000000000F50000-0x0000000001772000-memory.dmp
memory/6028-241-0x0000000003C00000-0x000000000485F000-memory.dmp
memory/6028-250-0x0000000003C00000-0x000000000485F000-memory.dmp
memory/6028-239-0x0000000003C00000-0x000000000485F000-memory.dmp
memory/6028-240-0x0000000003C00000-0x000000000485F000-memory.dmp
memory/6028-235-0x0000000003C00000-0x000000000485F000-memory.dmp
memory/6028-178-0x0000000003C00000-0x000000000485F000-memory.dmp
memory/6028-242-0x0000000003C00000-0x000000000485F000-memory.dmp