Resubmissions
12/09/2026, 13:32
260912-qs6n7shr4t1010/09/2026, 14:53
260910-r9hjdayybw1010/09/2026, 14:51
260910-r8bdnsdn9z10Analysis
- user interaction
yes - max time kernel
200s - max time network
210s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
12/09/2026, 13:32
General
- Target TelegramSessionKill.exe
- Size 8.7MB
- Sample260912-qs6n7shr4t
- SHA256 b9b91b6efc2f0541403c6ed2fa0c515a9e6d1b723d283028dee6159ef45f6a67
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 5 IoCs
- Enumerates VirtualBox registry keys 2 TTPs 4 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
- Looks for VMWare Tools registry key 2 TTPs 2 IoCs
- Looks for VMWare services registry key. 1 TTPs 4 IoCs
- Executes dropped EXE 5 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Costura .NET executable packer 1 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
- Drops file in Program Files directory 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Modifies data under HKEY_USERS 1 IoCs
- Modifies registry class 41 IoCs
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TelegramSessionKill.exe"C:\Users\Admin\AppData\Local\Temp\TelegramSessionKill.exe"1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TelegramSessionKiller_a3961b.exe"C:\Users\Admin\AppData\Local\Temp\TelegramSessionKiller_a3961b.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\sesskill_6dc631.exe"C:\Users\Admin\AppData\Local\Temp\sesskill_6dc631.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\GpuService_0394c2.exe"C:\Users\Admin\AppData\Local\Temp\GpuService_0394c2.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Defender\winlogon.exe"C:\Program Files (x86)\Windows Defender\winlogon.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe4⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\winlogon.exe"C:\Program Files (x86)\Microsoft\Edge\Application\winlogon.exe" -4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\TelegramSessionKill.exe"C:\Users\Admin\AppData\Local\Temp\TelegramSessionKill.exe"1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost1⤵
-
C:\Windows\system32\control.exe"C:\Windows\system32\control.exe" /name Microsoft.NetworkAndSharingCenter1⤵
- Modifies registry class
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
5Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
svc_3e3f5186.log
svc_3e3f5186.log
svc_3e3f5186.log
svc_3e3f5186.log
GpuService_0394c2.exe
TelegramSessionKiller_a3961b.exe
sesskill_6dc631.exe
memory/792-1340-0x0000000000AC0000-0x0000000001716000-memory.dmp
memory/792-1685-0x0000000000AC0000-0x0000000001716000-memory.dmp
memory/792-1754-0x0000000000AC0000-0x0000000001716000-memory.dmp
memory/1960-1780-0x00000000070E0000-0x0000000007116000-memory.dmp
memory/1960-1766-0x0000000005660000-0x00000000056C6000-memory.dmp
memory/1960-1782-0x0000000070280000-0x00000000705DB000-memory.dmp
memory/1960-1785-0x0000000007120000-0x0000000007140000-memory.dmp
memory/1960-1786-0x0000000007140000-0x00000000071E3000-memory.dmp
memory/1960-1781-0x0000000070120000-0x000000007016C000-memory.dmp
memory/1960-1787-0x00000000078D0000-0x0000000007F4C000-memory.dmp
memory/1960-1779-0x0000000006C20000-0x0000000006C68000-memory.dmp
memory/1960-1776-0x0000000005C70000-0x0000000005CBC000-memory.dmp
memory/1960-1775-0x0000000005C50000-0x0000000005C6E000-memory.dmp
memory/1960-1770-0x0000000005740000-0x0000000005A9B000-memory.dmp
memory/1960-1788-0x0000000007290000-0x00000000072AA000-memory.dmp
memory/1960-1767-0x00000000056D0000-0x0000000005736000-memory.dmp
memory/1960-1765-0x0000000004D40000-0x0000000004D62000-memory.dmp
memory/1960-1763-0x0000000004E20000-0x000000000546A000-memory.dmp
memory/1960-1761-0x0000000004770000-0x00000000047A6000-memory.dmp
memory/1960-1791-0x0000000007790000-0x00000000077B2000-memory.dmp
memory/1960-1789-0x00000000072F0000-0x00000000072FA000-memory.dmp
memory/1960-1790-0x00000000073A0000-0x0000000007436000-memory.dmp
memory/2896-525-0x0000000000D80000-0x00000000019D5000-memory.dmp
memory/2896-1683-0x0000000000D80000-0x00000000019D5000-memory.dmp
memory/3188-1753-0x00000000003A0000-0x0000000000FF6000-memory.dmp
memory/3188-1757-0x00000000003A0000-0x0000000000FF6000-memory.dmp
memory/4108-102-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-63-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-138-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-150-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-148-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-146-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-143-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-144-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-140-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-136-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-134-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-132-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-130-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-129-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-126-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-124-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-122-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-118-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-116-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-114-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-112-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-110-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-108-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-106-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-104-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-90-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-100-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-98-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-96-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-94-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-91-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-88-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-85-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-83-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-81-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-79-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-77-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-76-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-73-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-71-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-69-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-68-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-66-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-120-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-57-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-1546-0x0000000074240000-0x00000000749FC000-memory.dmp
memory/4108-1545-0x0000000074252000-0x0000000074253000-memory.dmp
memory/4108-1674-0x0000000074240000-0x00000000749FC000-memory.dmp
memory/4108-1675-0x0000000005F00000-0x000000000604C000-memory.dmp
memory/4108-1677-0x0000000006050000-0x000000000606A000-memory.dmp
memory/4108-1678-0x0000000006080000-0x0000000006088000-memory.dmp
memory/4108-1679-0x00000000060A0000-0x00000000060A8000-memory.dmp
memory/4108-1676-0x0000000005CF0000-0x0000000005DC8000-memory.dmp
memory/4108-1680-0x00000000060C0000-0x00000000060E8000-memory.dmp
memory/4108-1681-0x0000000006100000-0x0000000006108000-memory.dmp
memory/4108-1682-0x0000000006110000-0x000000000612E000-memory.dmp
memory/4108-36-0x0000000074240000-0x00000000749FC000-memory.dmp
memory/4108-23-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-1687-0x0000000074240000-0x00000000749FC000-memory.dmp
memory/4108-26-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-28-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-30-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-32-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-34-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-37-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-39-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-41-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-45-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-48-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-50-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-18-0x0000000074252000-0x0000000074253000-memory.dmp
memory/4108-53-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-92-0x0000000074240000-0x00000000749FC000-memory.dmp
memory/4108-19-0x0000000005200000-0x00000000053AA000-memory.dmp
memory/4108-51-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-55-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-59-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-61-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-43-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-24-0x0000000005970000-0x0000000005B12000-memory.dmp
memory/4108-22-0x0000000005970000-0x0000000005B18000-memory.dmp
memory/4108-21-0x00000000053B0000-0x000000000596A000-memory.dmp
memory/4108-20-0x0000000074240000-0x00000000749FC000-memory.dmp
memory/5636-1778-0x00000000005F0000-0x0000000001246000-memory.dmp
memory/5636-1774-0x00000000005F0000-0x0000000001246000-memory.dmp