salatstealer | 1828f5ecbdfced544a1505f74ce66bb32fbb67ed814bcf08b41ab66d3ae3d0ae

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 06:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3a8eebc4e4817ea92a4ecb8415997e80.exe
Size 11.0MB
Sample260826-hm6s1stemd
SHA256 1828f5ecbdfced544a1505f74ce66bb32fbb67ed814bcf08b41ab66d3ae3d0ae
MD5 3a8eebc4e4817ea92a4ecb8415997e80
SHA1 8a2ea60d0acddc65eb0ae219d6dbdb4511d10cff
SHA512 a0468a03120c0bc53f91e3e5149a579116d4b9616e46ab76b6bc5413858150b32966123a6f1d25836ca09047a0084826a8903f3dbc60223c4be8a03c7dcba93f
SSDEEP 196608:KW5jZREFrJnJ8+nIWMBpcOxgYK0ed4Lcen2t:KW5jZ2dnJ8+c1Md4LrA
TLSH
T124C6BE03ECA155E9C0AEE23189669252FB717C885B3523D32B50F7386F76BE0AE75740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery salatstealer stealer

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c54a-2.dat	family_salatstealer

Executes dropped EXE 1 IoCs

pid	Process
4768	updater_KBSHUsgK.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater_KBSHUsgK.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4768	updater_KBSHUsgK.exe
4768	updater_KBSHUsgK.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 4768	4848	3a8eebc4e4817ea92a4ecb8415997e80.exe	90

C:\Users\Admin\AppData\Local\Temp\3a8eebc4e4817ea92a4ecb8415997e80.exe
"C:\Users\Admin\AppData\Local\Temp\3a8eebc4e4817ea92a4ecb8415997e80.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Users\Admin\AppData\Local\Microsoft\updater_KBSHUsgK.exe
  C:\Users\Admin\AppData\Local\Microsoft\updater_KBSHUsgK.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

updater_KBSHUsgK.exe

Path C:\Users\Admin\AppData\Local\Microsoft\updater_KBSHUsgK.exe
Size 12.0MB
SHA256 780c0ad28cbe5ae9561ac3e9b1364eddba72c3baf26b16cd246adcee36019bca
MD5 b023be3f662d5b8e6d7b8ab08fc01b22
SHA1 dc42ec829544a1de1a619576adfc84ce2ed63775
SHA512 22a8c5fba7c54ecc679e4f99541b8dc0929aaa784087c92622e0670a754921e41f8ce7d30a41814a26ab6b51124a22313e0ca681af3de163c1faa06d27cc09ac
SSDEEP 98304:IYdsWTxuFl1XiNZLe/330l8++qz46LEW:xxuMZicl8lSrYW
TLSH
T1FEC66C11FACB58F5E9035831406BB27F23315D048B28DB9BEB183B6AFC7B6A11976705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download