Analysis
- max time kernel
86s - max time network
90s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
10/09/2026, 17:48
General
- Target SolaraV3.exe
- Size 3.4MB
- Sample260910-wdvlaawsgs
- SHA256 cf6042bfce6b28fe3ea18ab35865a72c9e109039dd3ebdddd03ac0e7a0bcbbc5
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 8 IoCs
- Executes dropped EXE 1 IoCs
- UPX packed file 16 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SolaraV3.exe"C:\Users\Admin\AppData\Local\Temp\SolaraV3.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\wininit.exe"C:\Program Files (x86)\Microsoft\wininit.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
-
-
C:\Program Files\Google\Chrome\Application\wininit.exe"C:\Program Files\Google\Chrome\Application\wininit.exe" -3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\wininit.exe"C:\Program Files (x86)\Microsoft\Edge\Application\wininit.exe" -3⤵
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
wininit.exe
wininit.exe
__PSScriptPolicyTest_n5dchrpb.vxy.ps1
memory/224-45-0x0000000000420000-0x0000000001075000-memory.dmp
memory/224-44-0x0000000000420000-0x0000000001075000-memory.dmp
memory/3056-1-0x00000000003A0000-0x0000000000FF5000-memory.dmp
memory/3056-2-0x00000000003A0000-0x0000000000FF5000-memory.dmp
memory/3056-3-0x00000000003A0000-0x0000000000FF5000-memory.dmp
memory/3056-5-0x00000000003A0000-0x0000000000FF5000-memory.dmp
memory/3056-11-0x00000000003A0000-0x0000000000FF5000-memory.dmp
memory/3056-0-0x00000000003A0000-0x0000000000FF5000-memory.dmp
memory/4176-35-0x0000000005AA0000-0x0000000005ABE000-memory.dmp
memory/4176-34-0x0000000005580000-0x00000000058D7000-memory.dmp
memory/4176-24-0x0000000004CC0000-0x00000000052EA000-memory.dmp
memory/4176-22-0x0000000004680000-0x0000000004690000-memory.dmp
memory/4176-39-0x0000000006050000-0x0000000006096000-memory.dmp
memory/4176-25-0x0000000004BB0000-0x0000000004BD2000-memory.dmp
memory/4176-27-0x0000000005510000-0x0000000005576000-memory.dmp
memory/4176-26-0x00000000054A0000-0x0000000005506000-memory.dmp
memory/4176-20-0x00000000045C0000-0x00000000045F6000-memory.dmp
memory/4176-23-0x0000000004680000-0x0000000004690000-memory.dmp
memory/4176-36-0x0000000005AC0000-0x0000000005B0C000-memory.dmp
memory/4328-38-0x00000000007C0000-0x0000000001415000-memory.dmp
memory/4328-21-0x00000000007C0000-0x0000000001415000-memory.dmp
memory/4532-15-0x0000000000CE0000-0x0000000001935000-memory.dmp
memory/4532-14-0x0000000000CE0000-0x0000000001935000-memory.dmp
memory/4532-13-0x0000000000CE0000-0x0000000001935000-memory.dmp
memory/4532-12-0x0000000000CE0000-0x0000000001935000-memory.dmp