salatstealer | 09259b16d68a008be0155ff81e7db2eb60bd95f231170d21ab9992ade6c0ac8f

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 13:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
99 nights script injector auto.exe
Size 7.1MB
Sample260821-qyn2ca1dpg
SHA256 09259b16d68a008be0155ff81e7db2eb60bd95f231170d21ab9992ade6c0ac8f
MD5 db35c3ffa5a0f16ff60aa30f2641b766
SHA1 de230ec58a834a19da59a7c379dc41792dddf842
SHA512 7e8f4a96d7c077a1a041f84cf204e275d5473471785cfee368d932c0b5fcf95a93fdbec224be98af9a9f8ba33be7bc1fd25517b9962c1212e58476dfc08a6839
SSDEEP 49152:ECDq3i3OWk1QZ6jq7u+ltlhQODM1DmQOQkdA/uqboBsFckgC+X0nWiKVYpm7um6H:EC+rTYQUoPIamHeumvBh8huTiEp
TLSH
T150764917ECA558E9C0ADC13085729563BF717C481B2063D72B60F6287F76BE46EBA384
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution salatstealer persistence stealer

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral4/files/0x000600000001b85f-5.dat	family_salatstealer

Executes dropped EXE 2 IoCs

pid	Process
2732	99 nights script injector auto.exe
2452	99 nights script injector auto.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5044	powershell.exe
3876	powershell.exe
2032	powershell.exe
2800	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1540	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2800	powershell.exe
2800	powershell.exe
5044	powershell.exe
5044	powershell.exe
3876	powershell.exe
3876	powershell.exe
2032	powershell.exe
2032	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2800	powershell.exe
Token: SeDebugPrivilege	5044	powershell.exe
Token: SeDebugPrivilege	3876	powershell.exe
Token: SeDebugPrivilege	2032	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 1540	4420	99 nights script injector auto.exe	89
PID 4420 wrote to memory of 2732	4420	99 nights script injector auto.exe	92
PID 2732 wrote to memory of 2800	2732	99 nights script injector auto.exe	93
PID 2732 wrote to memory of 5044	2732	99 nights script injector auto.exe	96
PID 2732 wrote to memory of 3876	2732	99 nights script injector auto.exe	98
PID 2732 wrote to memory of 2032	2732	99 nights script injector auto.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\99 nights script injector auto.exe
"C:\Users\Admin\AppData\Local\Temp\99 nights script injector auto.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Windows\system32\schtasks.exe
  schtasks /Create /XML "C:\Users\Admin\AppData\Local\Temp\99 nights script injector auto_task.xml" /TN "99 nights script injector auto" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1540
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\99 nights script injector auto.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\99 nights script injector auto.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2800
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Query \"select * from Win32_OperatingSystem\").Caption"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2032

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\99 nights script injector auto.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\99 nights script injector auto.exe"
1⤵
- Executes dropped EXE
PID:2452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 54aa570220e696de49a9a588711123e43032522c4578b6fa4f918d2666c1cb32
MD5 27db61c440595c38f5a7b661c618d0c9
SHA1 87613fdda39013791c068bdeec060f945fa2e908
SHA512 e367d57ce85719fa4e3cfd8083e0a5f71110b3f845c1ea7d3a0a3393066cfa90b96712701f044b731fab41ff6a751b7f4db794795c1f3aec955f642c3df25586
TLSH
T1FC115733F3CC8624C89A413650CEAC1036B587DB519ECE6BBB84D154B43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

99 nights script injector auto_task.xml

Path C:\Users\Admin\AppData\Local\Temp\99 nights script injector auto_task.xml
Size 1KB
SHA256 fd4421d7b2a8930d4611f1690c39f64eb4ff62553e55a9f5363f2c3149f847d8
MD5 30834d17e0a6aa203becbcd573d78ca6
SHA1 efbef551485ede0b8a92fdd228b6fb0451272133
SHA512 6f08e3b954c693521131f46fce79845c5091251defa1032806c981791031f3fe152b7073346310e915bdc672dffb31bba22fe01aa6f456b7904f98e7dbb2a9e9
TLSH
T1E72145905C14F11FB55BA63EC75153C2767E97A90AB18039DDC84DBC748A1CA711387B
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_bljpanpu.s5b.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bljpanpu.s5b.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

99 nights script injector auto.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\99 nights script injector auto.exe
Size 7.1MB
SHA256 09259b16d68a008be0155ff81e7db2eb60bd95f231170d21ab9992ade6c0ac8f
MD5 db35c3ffa5a0f16ff60aa30f2641b766
SHA1 de230ec58a834a19da59a7c379dc41792dddf842
SHA512 7e8f4a96d7c077a1a041f84cf204e275d5473471785cfee368d932c0b5fcf95a93fdbec224be98af9a9f8ba33be7bc1fd25517b9962c1212e58476dfc08a6839
SSDEEP 49152:ECDq3i3OWk1QZ6jq7u+ltlhQODM1DmQOQkdA/uqboBsFckgC+X0nWiKVYpm7um6H:EC+rTYQUoPIamHeumvBh8huTiEp
TLSH
T150764917ECA558E9C0ADC13085729563BF717C481B2063D72B60F6287F76BE46EBA384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2800-10-0x000001D79DA10000-0x000001D79DA32000-memory.dmp

Download