Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
28/08/2026, 12:29
General
- Target bhdprova.exe
- Size 3.4MB
- Sample260828-ppdctach57
- SHA256 3f9737e941753db6667f24b1a627a1b0c12f22734ddc5c717e956d2729a7cd5c
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 13 IoCs
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bhdprova.exe"C:\Users\Admin\AppData\Local\Temp\bhdprova.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exeC:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\winlogon.exeC:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\winlogon.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
fontdrvhost.exe
memory/1048-20-0x0000000000CF0000-0x0000000001947000-memory.dmp
memory/1048-38-0x0000000000CF0000-0x0000000001947000-memory.dmp
memory/1048-55-0x0000000000CF0000-0x0000000001947000-memory.dmp
memory/1048-56-0x0000000000CF0000-0x0000000001947000-memory.dmp
memory/1048-23-0x0000000000CF0000-0x0000000001947000-memory.dmp
memory/1048-13-0x0000000000CF0000-0x0000000001947000-memory.dmp
memory/1048-22-0x0000000000CF0000-0x0000000001947000-memory.dmp
memory/1048-21-0x0000000000CF0000-0x0000000001947000-memory.dmp
memory/2836-5-0x0000000000680000-0x00000000012D7000-memory.dmp
memory/2836-14-0x0000000000680000-0x00000000012D7000-memory.dmp
memory/2836-0-0x0000000000680000-0x00000000012D7000-memory.dmp
memory/2836-3-0x0000000000680000-0x00000000012D7000-memory.dmp
memory/2836-2-0x0000000000680000-0x00000000012D7000-memory.dmp
memory/2836-1-0x0000000000680000-0x00000000012D7000-memory.dmp
memory/4400-19-0x0000000000950000-0x00000000015A7000-memory.dmp
memory/4400-17-0x0000000000950000-0x00000000015A7000-memory.dmp
memory/5628-32-0x0000000005F60000-0x0000000005FC6000-memory.dmp
memory/5628-41-0x00000000702C0000-0x000000007030C000-memory.dmp
memory/5628-30-0x0000000005700000-0x0000000005722000-memory.dmp
memory/5628-27-0x0000000073F30000-0x00000000746EC000-memory.dmp
memory/5628-31-0x0000000005EF0000-0x0000000005F56000-memory.dmp
memory/5628-35-0x00000000061F0000-0x000000000654B000-memory.dmp
memory/5628-36-0x0000000006170000-0x000000000618E000-memory.dmp
memory/5628-37-0x00000000065A0000-0x00000000065EC000-memory.dmp
memory/5628-28-0x00000000057B0000-0x0000000005DFA000-memory.dmp
memory/5628-39-0x00000000074D0000-0x0000000007518000-memory.dmp
memory/5628-40-0x0000000007980000-0x00000000079B6000-memory.dmp
memory/5628-29-0x0000000073F30000-0x00000000746EC000-memory.dmp
memory/5628-46-0x00000000079E0000-0x0000000007A83000-memory.dmp
memory/5628-45-0x00000000079C0000-0x00000000079E0000-memory.dmp
memory/5628-42-0x0000000070420000-0x000000007077B000-memory.dmp
memory/5628-47-0x0000000008170000-0x00000000087EC000-memory.dmp
memory/5628-48-0x0000000007B30000-0x0000000007B4A000-memory.dmp
memory/5628-49-0x0000000007B90000-0x0000000007B9A000-memory.dmp
memory/5628-50-0x0000000007C40000-0x0000000007CD6000-memory.dmp
memory/5628-51-0x0000000008020000-0x0000000008042000-memory.dmp
memory/5628-52-0x0000000008DB0000-0x000000000936A000-memory.dmp
memory/5628-54-0x0000000073F30000-0x00000000746EC000-memory.dmp
memory/5628-26-0x0000000005010000-0x0000000005046000-memory.dmp
memory/5628-25-0x0000000073F42000-0x0000000073F43000-memory.dmp