salatstealer | 09259b16d68a008be0155ff81e7db2eb60bd95f231170d21ab9992ade6c0ac8f

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/08/2026, 13:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
99 nights script injector auto.exe
Size 7.1MB
Sample260821-qyn2ca1dpg
SHA256 09259b16d68a008be0155ff81e7db2eb60bd95f231170d21ab9992ade6c0ac8f
MD5 db35c3ffa5a0f16ff60aa30f2641b766
SHA1 de230ec58a834a19da59a7c379dc41792dddf842
SHA512 7e8f4a96d7c077a1a041f84cf204e275d5473471785cfee368d932c0b5fcf95a93fdbec224be98af9a9f8ba33be7bc1fd25517b9962c1212e58476dfc08a6839
SSDEEP 49152:ECDq3i3OWk1QZ6jq7u+ltlhQODM1DmQOQkdA/uqboBsFckgC+X0nWiKVYpm7um6H:EC+rTYQUoPIamHeumvBh8huTiEp
TLSH
T150764917ECA558E9C0ADC13085729563BF717C481B2063D72B60F6287F76BE46EBA384
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution salatstealer persistence stealer

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000002432e-6.dat	family_salatstealer

Executes dropped EXE 2 IoCs

pid	Process
4292	99 nights script injector auto.exe
4988	99 nights script injector auto.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
960	powershell.exe
4016	powershell.exe
3860	powershell.exe
472	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1968	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
960	powershell.exe
960	powershell.exe
4016	powershell.exe
4016	powershell.exe
3860	powershell.exe
3860	powershell.exe
472	powershell.exe
472	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	960	powershell.exe
Token: SeDebugPrivilege	4016	powershell.exe
Token: SeDebugPrivilege	3860	powershell.exe
Token: SeDebugPrivilege	472	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 1968	4132	99 nights script injector auto.exe	86
PID 4132 wrote to memory of 4292	4132	99 nights script injector auto.exe	89
PID 4292 wrote to memory of 960	4292	99 nights script injector auto.exe	90
PID 4292 wrote to memory of 4016	4292	99 nights script injector auto.exe	93
PID 4292 wrote to memory of 3860	4292	99 nights script injector auto.exe	95
PID 4292 wrote to memory of 472	4292	99 nights script injector auto.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\99 nights script injector auto.exe
"C:\Users\Admin\AppData\Local\Temp\99 nights script injector auto.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Windows\system32\schtasks.exe
  schtasks /Create /XML "C:\Users\Admin\AppData\Local\Temp\99 nights script injector auto_task.xml" /TN "99 nights script injector auto" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1968
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\99 nights script injector auto.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\99 nights script injector auto.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4016
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Query \"select * from Win32_OperatingSystem\").Caption"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3860
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:472

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\99 nights script injector auto.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\99 nights script injector auto.exe"
1⤵
- Executes dropped EXE
PID:4988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 2c34ed2846f42d9a8f4b06875f709b4d4e5b6feb76a7fd9826fefc7a88aafdff
MD5 0cecac901b1dd0035582b623c2bdb0e0
SHA1 de63909fad482bde0fb8bd1e89bd175384665a6d
SHA512 367559e719680bd24560eefe62eb4117761a3e4263c48fce200b05ddf70c2327df6489fa64ef04f6c5421bc4c6d3554360f2f59c5689ec361f7f2f7e419b2170
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

99 nights script injector auto_task.xml

Path C:\Users\Admin\AppData\Local\Temp\99 nights script injector auto_task.xml
Size 1KB
SHA256 fd4421d7b2a8930d4611f1690c39f64eb4ff62553e55a9f5363f2c3149f847d8
MD5 30834d17e0a6aa203becbcd573d78ca6
SHA1 efbef551485ede0b8a92fdd228b6fb0451272133
SHA512 6f08e3b954c693521131f46fce79845c5091251defa1032806c981791031f3fe152b7073346310e915bdc672dffb31bba22fe01aa6f456b7904f98e7dbb2a9e9
TLSH
T1E72145905C14F11FB55BA63EC75153C2767E97A90AB18039DDC84DBC748A1CA711387B
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_u0uxx2gs.gwj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u0uxx2gs.gwj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

99 nights script injector auto.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\99 nights script injector auto.exe
Size 7.1MB
SHA256 09259b16d68a008be0155ff81e7db2eb60bd95f231170d21ab9992ade6c0ac8f
MD5 db35c3ffa5a0f16ff60aa30f2641b766
SHA1 de230ec58a834a19da59a7c379dc41792dddf842
SHA512 7e8f4a96d7c077a1a041f84cf204e275d5473471785cfee368d932c0b5fcf95a93fdbec224be98af9a9f8ba33be7bc1fd25517b9962c1212e58476dfc08a6839
SSDEEP 49152:ECDq3i3OWk1QZ6jq7u+ltlhQODM1DmQOQkdA/uqboBsFckgC+X0nWiKVYpm7um6H:EC+rTYQUoPIamHeumvBh8huTiEp
TLSH
T150764917ECA558E9C0ADC13085729563BF717C481B2063D72B60F6287F76BE46EBA384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/960-13-0x000002F0E72F0000-0x000002F0E7312000-memory.dmp

Download