Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 20:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_c1238d87e88fe56caf0640f69ab7ddbb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_c1238d87e88fe56caf0640f69ab7ddbb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target 2026-08-20_c1238d87e88fe56caf0640f69ab7ddbb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
- Size 334KB
- Sample260820-ywb8rsvblf
- SHA256 f306f8e09c08ab4dbd161528a5943ce2a0e154e294a1bb3178104e7baa942ea9
- MD5 c1238d87e88fe56caf0640f69ab7ddbb
- SHA1 24e8c4a08322d49e1e9c24784914f2c3f90a6b9d
- SHA512 666f3e0f4396811bb32b6d7e7f241c894f9305682c1fdf8084495310142d7b861bba3bdcb6168f6401afa28edcc9ea1081df7fcd5fffe83f4942a9b9bf591c1f
- SSDEEP 6144:i+CpcbL3UZ6JQJ62ZXZhEb7Hcqh8lIFWoJoZGXkOiY:A6jyJ62tgb7Hb6+D7
- TLSH T153747D19F7A514FDE5678138C8424906E7B2BC1647A0E7CF23E04AA62F277D19E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 11 IoCs
resource yara_rule behavioral2/memory/296-69-0x0000000000740000-0x000000000138F000-memory.dmp family_salatstealer behavioral2/memory/296-70-0x0000000000740000-0x000000000138F000-memory.dmp family_salatstealer behavioral2/memory/296-71-0x0000000000740000-0x000000000138F000-memory.dmp family_salatstealer behavioral2/memory/296-72-0x0000000000740000-0x000000000138F000-memory.dmp family_salatstealer behavioral2/memory/296-74-0x0000000000740000-0x000000000138F000-memory.dmp family_salatstealer behavioral2/memory/296-76-0x0000000000740000-0x000000000138F000-memory.dmp family_salatstealer behavioral2/memory/296-84-0x0000000000740000-0x000000000138F000-memory.dmp family_salatstealer behavioral2/memory/1268-85-0x0000000000910000-0x000000000155F000-memory.dmp family_salatstealer behavioral2/memory/1268-86-0x0000000000910000-0x000000000155F000-memory.dmp family_salatstealer behavioral2/memory/1268-87-0x0000000000910000-0x000000000155F000-memory.dmp family_salatstealer behavioral2/memory/1268-88-0x0000000000910000-0x000000000155F000-memory.dmp family_salatstealer - Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 11 IoCs
resource yara_rule behavioral2/memory/296-69-0x0000000000740000-0x000000000138F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/296-70-0x0000000000740000-0x000000000138F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/296-71-0x0000000000740000-0x000000000138F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/296-72-0x0000000000740000-0x000000000138F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/296-74-0x0000000000740000-0x000000000138F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/296-76-0x0000000000740000-0x000000000138F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/296-84-0x0000000000740000-0x000000000138F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/1268-85-0x0000000000910000-0x000000000155F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/1268-86-0x0000000000910000-0x000000000155F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/1268-87-0x0000000000910000-0x000000000155F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/1268-88-0x0000000000910000-0x000000000155F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 11 IoCs
resource yara_rule behavioral2/memory/296-69-0x0000000000740000-0x000000000138F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/296-70-0x0000000000740000-0x000000000138F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/296-71-0x0000000000740000-0x000000000138F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/296-72-0x0000000000740000-0x000000000138F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/296-74-0x0000000000740000-0x000000000138F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/296-76-0x0000000000740000-0x000000000138F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/296-84-0x0000000000740000-0x000000000138F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/1268-85-0x0000000000910000-0x000000000155F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/1268-86-0x0000000000910000-0x000000000155F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/1268-87-0x0000000000910000-0x000000000155F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/1268-88-0x0000000000910000-0x000000000155F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables containing SQL queries to confidential data stores. Observed in infostealers 11 IoCs
resource yara_rule behavioral2/memory/296-69-0x0000000000740000-0x000000000138F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/296-70-0x0000000000740000-0x000000000138F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/296-71-0x0000000000740000-0x000000000138F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/296-72-0x0000000000740000-0x000000000138F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/296-74-0x0000000000740000-0x000000000138F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/296-76-0x0000000000740000-0x000000000138F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/296-84-0x0000000000740000-0x000000000138F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/1268-85-0x0000000000910000-0x000000000155F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/1268-86-0x0000000000910000-0x000000000155F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/1268-87-0x0000000000910000-0x000000000155F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/1268-88-0x0000000000910000-0x000000000155F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - UPX dump on OEP (original entry point) 14 IoCs
resource yara_rule behavioral2/files/0x000c00000001c50d-60.dat UPX behavioral2/memory/296-67-0x0000000000740000-0x000000000138F000-memory.dmp UPX behavioral2/memory/296-69-0x0000000000740000-0x000000000138F000-memory.dmp UPX behavioral2/memory/296-70-0x0000000000740000-0x000000000138F000-memory.dmp UPX behavioral2/memory/296-71-0x0000000000740000-0x000000000138F000-memory.dmp UPX behavioral2/memory/296-72-0x0000000000740000-0x000000000138F000-memory.dmp UPX behavioral2/memory/296-74-0x0000000000740000-0x000000000138F000-memory.dmp UPX behavioral2/memory/296-76-0x0000000000740000-0x000000000138F000-memory.dmp UPX behavioral2/memory/1268-83-0x0000000000910000-0x000000000155F000-memory.dmp UPX behavioral2/memory/296-84-0x0000000000740000-0x000000000138F000-memory.dmp UPX behavioral2/memory/1268-85-0x0000000000910000-0x000000000155F000-memory.dmp UPX behavioral2/memory/1268-86-0x0000000000910000-0x000000000155F000-memory.dmp UPX behavioral2/memory/1268-87-0x0000000000910000-0x000000000155F000-memory.dmp UPX behavioral2/memory/1268-88-0x0000000000910000-0x000000000155F000-memory.dmp UPX - Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4960 powershell.exe 4960 powershell.exe - Downloads MZ/PE file 1 IoCs
flow pid Process 1 3644 2026-08-20_c1238d87e88fe56caf0640f69ab7ddbb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe - Executes dropped EXE 2 IoCs
pid Process 296 Network.exe 1268 RuntimeBroker.exe -
resource yara_rule behavioral2/files/0x000c00000001c50d-60.dat upx behavioral2/memory/296-67-0x0000000000740000-0x000000000138F000-memory.dmp upx behavioral2/memory/296-69-0x0000000000740000-0x000000000138F000-memory.dmp upx behavioral2/memory/296-70-0x0000000000740000-0x000000000138F000-memory.dmp upx behavioral2/memory/296-71-0x0000000000740000-0x000000000138F000-memory.dmp upx behavioral2/memory/296-72-0x0000000000740000-0x000000000138F000-memory.dmp upx behavioral2/memory/296-74-0x0000000000740000-0x000000000138F000-memory.dmp upx behavioral2/memory/296-76-0x0000000000740000-0x000000000138F000-memory.dmp upx behavioral2/memory/1268-83-0x0000000000910000-0x000000000155F000-memory.dmp upx behavioral2/memory/296-84-0x0000000000740000-0x000000000138F000-memory.dmp upx behavioral2/memory/1268-85-0x0000000000910000-0x000000000155F000-memory.dmp upx behavioral2/memory/1268-86-0x0000000000910000-0x000000000155F000-memory.dmp upx behavioral2/memory/1268-87-0x0000000000910000-0x000000000155F000-memory.dmp upx behavioral2/memory/1268-88-0x0000000000910000-0x000000000155F000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Network.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RuntimeBroker.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4960 powershell.exe 4960 powershell.exe 296 Network.exe 296 Network.exe 1268 RuntimeBroker.exe 1268 RuntimeBroker.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4960 powershell.exe Token: SeIncreaseQuotaPrivilege 4960 powershell.exe Token: SeSecurityPrivilege 4960 powershell.exe Token: SeTakeOwnershipPrivilege 4960 powershell.exe Token: SeLoadDriverPrivilege 4960 powershell.exe Token: SeSystemProfilePrivilege 4960 powershell.exe Token: SeSystemtimePrivilege 4960 powershell.exe Token: SeProfSingleProcessPrivilege 4960 powershell.exe Token: SeIncBasePriorityPrivilege 4960 powershell.exe Token: SeCreatePagefilePrivilege 4960 powershell.exe Token: SeBackupPrivilege 4960 powershell.exe Token: SeRestorePrivilege 4960 powershell.exe Token: SeShutdownPrivilege 4960 powershell.exe Token: SeDebugPrivilege 4960 powershell.exe Token: SeSystemEnvironmentPrivilege 4960 powershell.exe Token: SeRemoteShutdownPrivilege 4960 powershell.exe Token: SeUndockPrivilege 4960 powershell.exe Token: SeManageVolumePrivilege 4960 powershell.exe Token: 33 4960 powershell.exe Token: 34 4960 powershell.exe Token: 35 4960 powershell.exe Token: 36 4960 powershell.exe Token: SeIncreaseQuotaPrivilege 4960 powershell.exe Token: SeSecurityPrivilege 4960 powershell.exe Token: SeTakeOwnershipPrivilege 4960 powershell.exe Token: SeLoadDriverPrivilege 4960 powershell.exe Token: SeSystemProfilePrivilege 4960 powershell.exe Token: SeSystemtimePrivilege 4960 powershell.exe Token: SeProfSingleProcessPrivilege 4960 powershell.exe Token: SeIncBasePriorityPrivilege 4960 powershell.exe Token: SeCreatePagefilePrivilege 4960 powershell.exe Token: SeBackupPrivilege 4960 powershell.exe Token: SeRestorePrivilege 4960 powershell.exe Token: SeShutdownPrivilege 4960 powershell.exe Token: SeDebugPrivilege 4960 powershell.exe Token: SeSystemEnvironmentPrivilege 4960 powershell.exe Token: SeRemoteShutdownPrivilege 4960 powershell.exe Token: SeUndockPrivilege 4960 powershell.exe Token: SeManageVolumePrivilege 4960 powershell.exe Token: 33 4960 powershell.exe Token: 34 4960 powershell.exe Token: 35 4960 powershell.exe Token: 36 4960 powershell.exe Token: SeIncreaseQuotaPrivilege 4960 powershell.exe Token: SeSecurityPrivilege 4960 powershell.exe Token: SeTakeOwnershipPrivilege 4960 powershell.exe Token: SeLoadDriverPrivilege 4960 powershell.exe Token: SeSystemProfilePrivilege 4960 powershell.exe Token: SeSystemtimePrivilege 4960 powershell.exe Token: SeProfSingleProcessPrivilege 4960 powershell.exe Token: SeIncBasePriorityPrivilege 4960 powershell.exe Token: SeCreatePagefilePrivilege 4960 powershell.exe Token: SeBackupPrivilege 4960 powershell.exe Token: SeRestorePrivilege 4960 powershell.exe Token: SeShutdownPrivilege 4960 powershell.exe Token: SeDebugPrivilege 4960 powershell.exe Token: SeSystemEnvironmentPrivilege 4960 powershell.exe Token: SeRemoteShutdownPrivilege 4960 powershell.exe Token: SeUndockPrivilege 4960 powershell.exe Token: SeManageVolumePrivilege 4960 powershell.exe Token: 33 4960 powershell.exe Token: 34 4960 powershell.exe Token: 35 4960 powershell.exe Token: 36 4960 powershell.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3644 wrote to memory of 4960 3644 2026-08-20_c1238d87e88fe56caf0640f69ab7ddbb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 89 PID 3644 wrote to memory of 296 3644 2026-08-20_c1238d87e88fe56caf0640f69ab7ddbb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 92 PID 296 wrote to memory of 1268 296 Network.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_c1238d87e88fe56caf0640f69ab7ddbb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_c1238d87e88fe56caf0640f69ab7ddbb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"1⤵
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'; Add-MpPreference -ExclusionPath 'C:\ProgramData'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\szeq'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4960
-
-
C:\Users\Admin\AppData\Local\szeq\downloads\Network.exe"C:\Users\Admin\AppData\Local\szeq\downloads\Network.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Users\Admin\AppData\Roaming\RuntimeBroker.exeC:\Users\Admin\AppData\Roaming\RuntimeBroker.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1268
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\szeq\downloads\Network.exe
- Size 3.4MB
- SHA256 c02e2b1e61535024d4d7b829adf747907fb719bcb19560d753b0f6b10a95b0d8
- MD5 e7722735a7128302b1c430d18a602917
- SHA1 a678d1972c9db49b4d917e5480a0c62d63f3d6b6
- SHA512 a9f52636ea0c35946fa206eea5df23d3614d59851b707977b8db06f7bdd9b5fec96e33ee0de34ad375b20ec015368a97c9b866989f7c7f55aed27c9cce2ec427
- SSDEEP 98304:bH8BL4wuU0gNIrRGuUOrlTCB+irWUnb6xc9jdr:bHCkwudgNIFeOrlGczU+2
- TLSH T156F5333DE6A5E61AD032B033D70D8A3C9E5AA52E1DA679BCCA01DB92471050DF34773E
- MD5 SHA1 SHA512 SSDEEP TLSH