Analysis
- user interaction
yes - max time kernel
90s - max time network
92s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 17:48
General
- Target SolaraV3.exe
- Size 3.4MB
- Sample260910-wdvlaawsgs
- SHA256 cf6042bfce6b28fe3ea18ab35865a72c9e109039dd3ebdddd03ac0e7a0bcbbc5
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 10 IoCs
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- UPX packed file 14 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SolaraV3.exe"C:\Users\Admin\AppData\Local\Temp\SolaraV3.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\WindowsPowerShell\sihost.exe"C:\Program Files (x86)\WindowsPowerShell\sihost.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\sihost.exe"C:\Program Files (x86)\Microsoft\Edge\Application\sihost.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
sihost.exe
memory/1184-32-0x00000000069B0000-0x00000000069FC000-memory.dmp
memory/1184-28-0x0000000006570000-0x00000000068CB000-memory.dmp
memory/1184-51-0x00000000741C0000-0x000000007497C000-memory.dmp
memory/1184-49-0x00000000741C0000-0x000000007497C000-memory.dmp
memory/1184-48-0x00000000741D2000-0x00000000741D3000-memory.dmp
memory/1184-47-0x0000000009120000-0x00000000096DA000-memory.dmp
memory/1184-46-0x0000000008390000-0x00000000083B2000-memory.dmp
memory/1184-14-0x00000000741D2000-0x00000000741D3000-memory.dmp
memory/1184-15-0x0000000003090000-0x00000000030C6000-memory.dmp
memory/1184-16-0x00000000741C0000-0x000000007497C000-memory.dmp
memory/1184-18-0x0000000005B70000-0x00000000061BA000-memory.dmp
memory/1184-21-0x00000000741C0000-0x000000007497C000-memory.dmp
memory/1184-45-0x0000000007FB0000-0x0000000008046000-memory.dmp
memory/1184-23-0x0000000005B10000-0x0000000005B32000-memory.dmp
memory/1184-24-0x0000000006230000-0x0000000006296000-memory.dmp
memory/1184-25-0x00000000063D0000-0x0000000006436000-memory.dmp
memory/1184-44-0x0000000007F00000-0x0000000007F0A000-memory.dmp
memory/1184-43-0x0000000007EA0000-0x0000000007EBA000-memory.dmp
memory/1184-42-0x00000000084E0000-0x0000000008B5C000-memory.dmp
memory/1184-31-0x00000000068F0000-0x000000000690E000-memory.dmp
memory/1184-36-0x0000000070490000-0x00000000704DC000-memory.dmp
memory/1184-37-0x0000000070690000-0x00000000709EB000-memory.dmp
memory/1184-35-0x0000000007D20000-0x0000000007D56000-memory.dmp
memory/1184-33-0x0000000007AF0000-0x0000000007B38000-memory.dmp
memory/1184-41-0x0000000007D80000-0x0000000007E23000-memory.dmp
memory/1184-40-0x0000000007D60000-0x0000000007D80000-memory.dmp
memory/2256-52-0x0000000000A70000-0x00000000016C5000-memory.dmp
memory/2256-54-0x0000000000A70000-0x00000000016C5000-memory.dmp
memory/2256-11-0x0000000000A70000-0x00000000016C5000-memory.dmp
memory/2256-10-0x0000000000A70000-0x00000000016C5000-memory.dmp
memory/2256-53-0x0000000000A70000-0x00000000016C5000-memory.dmp
memory/2256-34-0x0000000000A70000-0x00000000016C5000-memory.dmp
memory/2256-9-0x0000000000A70000-0x00000000016C5000-memory.dmp
memory/2756-30-0x00000000009F0000-0x0000000001645000-memory.dmp
memory/2756-22-0x00000000009F0000-0x0000000001645000-memory.dmp
memory/4272-0-0x0000000000390000-0x0000000000FE5000-memory.dmp
memory/4272-1-0x0000000000390000-0x0000000000FE5000-memory.dmp
memory/4272-8-0x0000000000390000-0x0000000000FE5000-memory.dmp
memory/4272-2-0x0000000000390000-0x0000000000FE5000-memory.dmp