Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/09/2026, 03:10
General
- Target 7c04a11b72485957f38a65a92666de7d0a6f80fee78e45638a5db5505ae318e1.exe
- Size 3.4MB
- Sample260924-dn8lsacf88
- SHA256 7c04a11b72485957f38a65a92666de7d0a6f80fee78e45638a5db5505ae318e1
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 17 IoCs
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- UPX packed file 21 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c04a11b72485957f38a65a92666de7d0a6f80fee78e45638a5db5505ae318e1.exe"C:\Users\Admin\AppData\Local\Temp\7c04a11b72485957f38a65a92666de7d0a6f80fee78e45638a5db5505ae318e1.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\sihost.exe"C:\Program Files (x86)\Microsoft\sihost.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\sihost.exe"C:\Program Files (x86)\Microsoft\Edge\Application\sihost.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
sihost.exe
__PSScriptPolicyTest_ljf2x3jw.nrx.ps1
memory/264-18-0x0000000000770000-0x00000000013C5000-memory.dmp
memory/264-70-0x0000000000770000-0x00000000013C5000-memory.dmp
memory/264-61-0x0000000000770000-0x00000000013C5000-memory.dmp
memory/264-66-0x0000000000770000-0x00000000013C5000-memory.dmp
memory/264-14-0x0000000000770000-0x00000000013C5000-memory.dmp
memory/264-67-0x0000000000770000-0x00000000013C5000-memory.dmp
memory/264-15-0x0000000000770000-0x00000000013C5000-memory.dmp
memory/264-16-0x0000000000770000-0x00000000013C5000-memory.dmp
memory/264-17-0x0000000000770000-0x00000000013C5000-memory.dmp
memory/264-68-0x0000000000770000-0x00000000013C5000-memory.dmp
memory/264-19-0x0000000000770000-0x00000000013C5000-memory.dmp
memory/264-69-0x0000000000770000-0x00000000013C5000-memory.dmp
memory/476-13-0x0000000000DD0000-0x0000000001A25000-memory.dmp
memory/476-1-0x0000000000DD0000-0x0000000001A25000-memory.dmp
memory/476-0-0x0000000000DD0000-0x0000000001A25000-memory.dmp
memory/476-3-0x0000000000DD0000-0x0000000001A25000-memory.dmp
memory/476-2-0x0000000000DD0000-0x0000000001A25000-memory.dmp
memory/476-4-0x0000000000DD0000-0x0000000001A25000-memory.dmp
memory/2836-22-0x0000000074682000-0x0000000074683000-memory.dmp
memory/2836-57-0x0000000008370000-0x00000000089EC000-memory.dmp
memory/2836-42-0x0000000006770000-0x000000000678E000-memory.dmp
memory/2836-33-0x0000000006140000-0x00000000061A6000-memory.dmp
memory/2836-39-0x0000000006200000-0x000000000655B000-memory.dmp
memory/2836-43-0x00000000067A0000-0x00000000067EC000-memory.dmp
memory/2836-23-0x0000000002F30000-0x0000000002F66000-memory.dmp
memory/2836-45-0x0000000006D40000-0x0000000006D88000-memory.dmp
memory/2836-46-0x0000000007BA0000-0x0000000007BD6000-memory.dmp
memory/2836-47-0x0000000070930000-0x000000007097C000-memory.dmp
memory/2836-48-0x0000000070BF0000-0x0000000070F4B000-memory.dmp
memory/2836-55-0x0000000007BE0000-0x0000000007C00000-memory.dmp
memory/2836-56-0x0000000007C00000-0x0000000007CA3000-memory.dmp
memory/2836-32-0x00000000060D0000-0x0000000006136000-memory.dmp
memory/2836-58-0x0000000005570000-0x000000000558A000-memory.dmp
memory/2836-59-0x0000000007DB0000-0x0000000007DBA000-memory.dmp
memory/2836-60-0x0000000007EE0000-0x0000000007F76000-memory.dmp
memory/2836-31-0x0000000005850000-0x0000000005872000-memory.dmp
memory/2836-62-0x00000000082B0000-0x00000000082D2000-memory.dmp
memory/2836-63-0x0000000008FB0000-0x000000000956A000-memory.dmp
memory/2836-65-0x0000000074670000-0x0000000074E2C000-memory.dmp
memory/2836-28-0x0000000074670000-0x0000000074E2C000-memory.dmp
memory/2836-25-0x0000000074670000-0x0000000074E2C000-memory.dmp
memory/2836-27-0x0000000005990000-0x0000000005FDA000-memory.dmp
memory/3428-30-0x0000000000850000-0x00000000014A5000-memory.dmp
memory/3428-44-0x0000000000850000-0x00000000014A5000-memory.dmp