Analysis
- user interaction
yes - max time kernel
20s - max time network
23s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 15:26
Behavioral task
behavioral1
Sample
wsaf.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
900 seconds
General
- Target wsaf.exe
- Size 3.4MB
- Sample260822-svdsbahn21
- SHA256 42766ba58d0f3c61f5b867769d41b0e5181994869067809c93d0a8be22e5ad6f
- MD5 2a7648b001ba6fe896add8f6c6882f14
- SHA1 0f337ddf5790a1ed48761db75af800d67e21e23b
- SHA512 6068e300b5704002e25c5d5015568406177bad29a101861cc22730ae8ab1b429ac7338540df6ef3e680c64dee084accd088ecfdfa1442e7ce6c91829a040659c
- SSDEEP 98304:ZetxuTcltcrQvLgR865dS1Yg5nbOdgT1:eur+2dZmDT1
- TLSH T13BF533988CB6C671F849BA3A78DB17C6DF553531E081C6FD8809B346A777D429280BF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 1 IoCs
resource yara_rule behavioral1/memory/1468-26-0x00000000002A0000-0x0000000000EF6000-memory.dmp family_salatstealer -
resource yara_rule behavioral1/memory/1468-0-0x00000000002A0000-0x0000000000EF6000-memory.dmp upx behavioral1/memory/1468-26-0x00000000002A0000-0x0000000000EF6000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wsaf.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe - Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1032 taskmgr.exe Token: SeSystemProfilePrivilege 1032 taskmgr.exe Token: SeCreateGlobalPrivilege 1032 taskmgr.exe - Suspicious use of FindShellTrayWindow 30 IoCs
pid Process 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe - Suspicious use of SendNotifyMessage 30 IoCs
pid Process 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1032 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\wsaf.exe"C:\Users\Admin\AppData\Local\Temp\wsaf.exe"1⤵
- System Location Discovery: System Language Discovery
PID:1468
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1032
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3700