Analysis
- user interaction
yes - max time kernel
131s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
27/08/2026, 12:33
General
- Target install.ps1
- Size 15KB
- Sample260827-prg4sahe72
- SHA256 9f43b2b206b6dd7e0b0b98c42911b9213fccf8a9a4db370e48790e11ee2284d6
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 4 IoCs
- UAC bypass 3 TTPs 4 IoCs
- Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 2 IoCs
- Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 1 IoCs
Possible Turn off User Account Control's privilege elevation for standard users.
- UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 4 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\install.ps11⤵
- UAC bypass
- Badlisted process makes network request
- Downloads MZ/PE file
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\CiTool.exe"C:\Windows\system32\CiTool.exe" -r2⤵
-
-
C:\Users\Admin\AppData\Roaming\Windows\EdgeProcHandler.exe"C:\Users\Admin\AppData\Roaming\Windows\EdgeProcHandler.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Sidebar\WmiPrvSE.exe"C:\Program Files (x86)\Windows Sidebar\WmiPrvSE.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_4vkpwh5m.dbn.ps1
EdgeProcHandler.exe
memory/2552-18-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/2552-40-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/2552-6-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/2552-7-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/2552-8-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/2552-9-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/2552-10-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/2552-14-0x0000028966F10000-0x0000028966FC2000-memory.dmp
memory/2552-15-0x0000028966FD0000-0x0000028966FDA000-memory.dmp
memory/2552-13-0x0000028966EF0000-0x0000028966F0E000-memory.dmp
memory/2552-16-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/2552-17-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/2552-0-0x00007FFB6A85F000-0x00007FFB6A860000-memory.dmp
memory/2552-19-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/2552-5-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/2552-43-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/2552-20-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/2552-24-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/2552-4-0x00000289669E0000-0x0000028966A02000-memory.dmp
memory/2552-21-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/2552-1-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/2552-41-0x00000289676E0000-0x00000289676FE000-memory.dmp
memory/2552-22-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/2656-37-0x0000000000EF0000-0x0000000001B44000-memory.dmp
memory/2656-44-0x0000000000EF0000-0x0000000001B44000-memory.dmp
memory/2656-45-0x0000000000EF0000-0x0000000001B44000-memory.dmp
memory/2656-55-0x0000000000EF0000-0x0000000001B44000-memory.dmp
memory/3852-54-0x00000000001B0000-0x0000000000E04000-memory.dmp
memory/3852-57-0x00000000001B0000-0x0000000000E04000-memory.dmp