salatstealer | dae1888fd81b76f284fa6c56f4fe674c2a3ac2477de0d3a66a11b7f7adc3fd3f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 01:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_fd0666ed24603d54392244cdcfae3e11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 7.0MB
Sample260910-bre3jatbla
SHA256 dae1888fd81b76f284fa6c56f4fe674c2a3ac2477de0d3a66a11b7f7adc3fd3f
MD5 fd0666ed24603d54392244cdcfae3e11
SHA1 71641eca0d1e3f2cf736b747bffa65bb865484d3
SHA512 8fe2d2f7cf3652fb2a8832104579f68c2e543435b5c6f4b1e1e8738973aac4b5c8835a4cd9372e8101d5576243d47351b3232bff8488f189e73bea402743cda1
SSDEEP 98304:MkISn0iq1Jx/dzdW3CeaFOumvBh8huTlE:M00iq1JZJw3CFj
TLSH
T1CD763907ECA554E9C0AEC13189639562BF717C485B3123D32B50F6386F76BE0AEBA750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution salatstealer persistence stealer

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000a00000002432c-5.dat	family_salatstealer

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral1/files/0x000a00000002432c-5.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Executes dropped EXE 2 IoCs

pid	Process
4948	2026-09-08_fd0666ed24603d54392244cdcfae3e11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
3944	2026-09-08_fd0666ed24603d54392244cdcfae3e11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4000	powershell.exe
376	powershell.exe
4416	powershell.exe
4216	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4432	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4000	powershell.exe
4000	powershell.exe
376	powershell.exe
376	powershell.exe
4416	powershell.exe
4416	powershell.exe
4216	powershell.exe
4216	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4000	powershell.exe
Token: SeDebugPrivilege	376	powershell.exe
Token: SeDebugPrivilege	4416	powershell.exe
Token: SeDebugPrivilege	4216	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 4432	4668	2026-09-08_fd0666ed24603d54392244cdcfae3e11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	84
PID 4668 wrote to memory of 4948	4668	2026-09-08_fd0666ed24603d54392244cdcfae3e11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	87
PID 4948 wrote to memory of 4000	4948	2026-09-08_fd0666ed24603d54392244cdcfae3e11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	88
PID 4948 wrote to memory of 376	4948	2026-09-08_fd0666ed24603d54392244cdcfae3e11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	91
PID 4948 wrote to memory of 4416	4948	2026-09-08_fd0666ed24603d54392244cdcfae3e11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 4948 wrote to memory of 4216	4948	2026-09-08_fd0666ed24603d54392244cdcfae3e11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-08_fd0666ed24603d54392244cdcfae3e11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_fd0666ed24603d54392244cdcfae3e11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Windows\system32\schtasks.exe
  schtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\2026-09-08_fd0666ed24603d54392244cdcfae3e11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_task.xml /TN 2026-09-08_fd0666ed24603d54392244cdcfae3e11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4432
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-09-08_fd0666ed24603d54392244cdcfae3e11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-09-08_fd0666ed24603d54392244cdcfae3e11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:376
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Query \"select * from Win32_OperatingSystem\").Caption"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4416
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4216

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-09-08_fd0666ed24603d54392244cdcfae3e11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-09-08_fd0666ed24603d54392244cdcfae3e11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
1⤵
- Executes dropped EXE
PID:3944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 f87c08d5feb6c8ab4219d4a21d4f2f04ecc31578929ba4f34501e57cf65d9301
MD5 f7363017484cd0dba88ece9adad5f43f
SHA1 063147195b000b748afc675ab55c5c9c8906a99f
SHA512 d899135b67a773389f6b627a523250902166427d9f11a4a4189e8ae889ea38532c751ce05dc26ee9a35f5a0fa83844e65fafa68b5160266517be51409f23b88b
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

2026-09-08_fd0666ed24603d54392244cdcfae3e11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_task.xml

Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_fd0666ed24603d54392244cdcfae3e11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_task.xml
Size 1KB
SHA256 8292f8baf0574989640dad0ffb023bb9e4e5fa511643bac97c976403043793a4
MD5 2c4b4863f41c533cf657a04beb0e0db1
SHA1 3519f4ed1423e849d6402f23d635a4fb901818b5
SHA512 82ab6298a8d37527d56a6d0cc483af6c45ec271aca9f8974f8edd2a54bb27b4c8cc7f111aa90ed751daad4ca1963db57d95dfaeca60ce19428b70961cf7fb467
TLSH
T1FD2154A05C24F51BB05B972BC7911382327E6BA546A18138C9CC0CEC748B68B6152677
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xbvrvs3d.3b1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xbvrvs3d.3b1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

2026-09-08_fd0666ed24603d54392244cdcfae3e11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-09-08_fd0666ed24603d54392244cdcfae3e11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 7.0MB
SHA256 dae1888fd81b76f284fa6c56f4fe674c2a3ac2477de0d3a66a11b7f7adc3fd3f
MD5 fd0666ed24603d54392244cdcfae3e11
SHA1 71641eca0d1e3f2cf736b747bffa65bb865484d3
SHA512 8fe2d2f7cf3652fb2a8832104579f68c2e543435b5c6f4b1e1e8738973aac4b5c8835a4cd9372e8101d5576243d47351b3232bff8488f189e73bea402743cda1
SSDEEP 98304:MkISn0iq1Jx/dzdW3CeaFOumvBh8huTlE:M00iq1JZJw3CFj
TLSH
T1CD763907ECA554E9C0AEC13189639562BF717C485B3123D32B50F6386F76BE0AEBA750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/376-29-0x00000196E98C0000-0x00000196E9ADC000-memory.dmp

Download

memory/4000-8-0x0000022842FF0000-0x0000022843012000-memory.dmp

Download

memory/4000-18-0x000002285B9F0000-0x000002285BC0C000-memory.dmp

Download

memory/4216-49-0x0000025FEA840000-0x0000025FEAA5C000-memory.dmp

Download

memory/4416-39-0x0000019D3A6B0000-0x0000019D3A8CC000-memory.dmp

Download