salatstealer | ed6eeca40017dce6ca001cd63b9045aa30948963a21f2677ff0eb842881ba103

Analysis

max time kernel
148s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_1d238858920cdd38c8464f847bfd73d2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 11.0MB
Sample260822-e8th2aeb72
SHA256 ed6eeca40017dce6ca001cd63b9045aa30948963a21f2677ff0eb842881ba103
MD5 1d238858920cdd38c8464f847bfd73d2
SHA1 84df49767974480c492b4fb944a01d781c27adf7
SHA512 7dff12c380b5e0f75a557843710902296c98176c6be7a9d4b5617435c75acd6f753527d09982902a107b04fec2034a871ab1d992b54644ce520f218c68d90490
SSDEEP 196608:zDaPVcY72iprN3eay+oojSAzGqqGL7MU+By6QOpn:zDaPVciprln+ABvL7ZIy6Bx
TLSH
T1FFC6BE03ECA515E9C1A9E231897B9252BB72BC485B3523D32F60F3282F76BD46E75740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery salatstealer stealer

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0008000000024545-2.dat	family_salatstealer

Custom signature

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral1/files/0x0008000000024545-2.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Custom signature

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral1/files/0x0008000000024545-2.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Custom signature

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral1/files/0x0008000000024545-2.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Executes dropped EXE 2 IoCs

pid	Process
1600	updater_PwQfagMH.exe
4600	svchost.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\8cfc23ed-eefc-6ae8-6044-8b247c48edee	updater_PwQfagMH.exe
File opened for modification	C:\Program Files (x86)\Adobe\SppExtComObj.Exe	updater_PwQfagMH.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\8cfc23ed-eefc-6ae8-6044-8b247c48edee	updater_PwQfagMH.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\svchost.exe	updater_PwQfagMH.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater_PwQfagMH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1600	updater_PwQfagMH.exe
1600	updater_PwQfagMH.exe
1600	updater_PwQfagMH.exe
1600	updater_PwQfagMH.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 1600	3252	2026-08-22_1d238858920cdd38c8464f847bfd73d2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	86
PID 1600 wrote to memory of 4600	1600	updater_PwQfagMH.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-08-22_1d238858920cdd38c8464f847bfd73d2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_1d238858920cdd38c8464f847bfd73d2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Users\Admin\AppData\Local\Microsoft\updater_PwQfagMH.exe
  C:\Users\Admin\AppData\Local\Microsoft\updater_PwQfagMH.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Program Files (x86)\Windows Media Player\svchost.exe
    "C:\Program Files (x86)\Windows Media Player\svchost.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

updater_PwQfagMH.exe

Path C:\Users\Admin\AppData\Local\Microsoft\updater_PwQfagMH.exe
Size 12.0MB
SHA256 596c7e818a8d5f7026b88a4fdc275759b2ad3ee71356db438417de167c5e904e
MD5 150ebe6755b9f43405ee67a626387355
SHA1 7efc93939b713d9f0989f01d2e0735bbf43b2fe4
SHA512 3aead352693b442b7a9180432d5a661e336203d56fb5224e013dd5d20d849652301f549e09721913f4cb4386fdfc10a89e19617e0df9776b0bd635940a59cc3f
SSDEEP 49152:GRpK6fWxZHGQAulw19JRgfFC3b7HJFlwNwrH6PfLsdRyzVeAXH1SX8wRanDyBZOw:sKkWvw1rGtCfHur4EbRyIo4yrEpO/
TLSH
T1B5C65C11FACB54F6F9036831416BB27F23315D048B28DB9BEB583B6AF877691187A305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download