salatstealer | 8d5d913136a711beb8d1053c63615027925a7726dc030c16eff8e9056ca0f00f

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 06:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
upd.exe
Size 3.6MB
Sample261002-g52rcavves
SHA256 8d5d913136a711beb8d1053c63615027925a7726dc030c16eff8e9056ca0f00f
MD5 a80e70c82d4d0a0cbe57f1d8c9272fbc
SHA1 285129c00b3d9e7fcebdae7bf2e0f21e27f213e1
SHA512 cf08fc361e9f2ed6b53eb43babc999558acb3e2c1e177eb1496deab8afc61f8e7b97bb3373b8db21c908f11cd586558796764b7b619db4ef2a86f01859170b09
SSDEEP 98304:WN4Dd5s9XBE52PboeSRRROgfbBp+4H/TYrmjCe1WbboM:44Dd5s4scVnjorMClb9
TLSH
T129062354FA8390F1ED539CB1101FFBBF8A35A424906ECEB6DBD66B41F876831550CA0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery salatstealer persistence privilege_escalation stealer upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 12 IoCs

resource	yara_rule
behavioral2/memory/5396-14-0x0000000000400000-0x0000000001014000-memory.dmp	family_salatstealer
behavioral2/memory/5396-16-0x0000000000400000-0x0000000001014000-memory.dmp	family_salatstealer
behavioral2/memory/5396-18-0x0000000000400000-0x0000000001014000-memory.dmp	family_salatstealer
behavioral2/memory/5396-20-0x0000000000400000-0x0000000001014000-memory.dmp	family_salatstealer
behavioral2/memory/5396-25-0x0000000000400000-0x0000000001014000-memory.dmp	family_salatstealer
behavioral2/memory/5396-27-0x0000000000400000-0x0000000001014000-memory.dmp	family_salatstealer
behavioral2/memory/5396-29-0x0000000000400000-0x0000000001014000-memory.dmp	family_salatstealer
behavioral2/memory/5396-34-0x0000000000400000-0x0000000001014000-memory.dmp	family_salatstealer
behavioral2/memory/5396-38-0x0000000000400000-0x0000000001014000-memory.dmp	family_salatstealer
behavioral2/memory/5396-40-0x0000000000400000-0x0000000001014000-memory.dmp	family_salatstealer
behavioral2/memory/5396-42-0x0000000000400000-0x0000000001014000-memory.dmp	family_salatstealer
behavioral2/memory/5396-46-0x0000000000400000-0x0000000001014000-memory.dmp	family_salatstealer

Adds policy Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	upd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\1 = "\"C:\\Users\\Admin\\AppData\\Local\\htq4uq.exe\""	upd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\htq4uq = "\"C:\\Users\\Admin\\AppData\\Local\\htq4uq.exe\""	upd.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\htq4uq.lnk	upd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\htq4uq.url	upd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2324 set thread context of 5396	2324	upd.exe	93

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5396-10-0x0000000000400000-0x0000000001014000-memory.dmp	upx
behavioral2/memory/5396-14-0x0000000000400000-0x0000000001014000-memory.dmp	upx
behavioral2/memory/5396-16-0x0000000000400000-0x0000000001014000-memory.dmp	upx
behavioral2/memory/5396-18-0x0000000000400000-0x0000000001014000-memory.dmp	upx
behavioral2/memory/5396-20-0x0000000000400000-0x0000000001014000-memory.dmp	upx
behavioral2/memory/5396-25-0x0000000000400000-0x0000000001014000-memory.dmp	upx
behavioral2/memory/5396-27-0x0000000000400000-0x0000000001014000-memory.dmp	upx
behavioral2/memory/5396-29-0x0000000000400000-0x0000000001014000-memory.dmp	upx
behavioral2/memory/5396-34-0x0000000000400000-0x0000000001014000-memory.dmp	upx
behavioral2/memory/5396-38-0x0000000000400000-0x0000000001014000-memory.dmp	upx
behavioral2/memory/5396-40-0x0000000000400000-0x0000000001014000-memory.dmp	upx
behavioral2/memory/5396-42-0x0000000000400000-0x0000000001014000-memory.dmp	upx
behavioral2/memory/5396-46-0x0000000000400000-0x0000000001014000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5504	1788	WerFault.exe	88

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	upd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	upd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5396	upd.exe
5396	upd.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 2324	1788	upd.exe	89
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93
PID 2324 wrote to memory of 5396	2324	upd.exe	93

C:\Users\Admin\AppData\Local\Temp\upd.exe
"C:\Users\Admin\AppData\Local\Temp\upd.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Users\Admin\AppData\Local\Temp\upd.exe
  "C:\Users\Admin\AppData\Local\Temp\upd.exe"
  2⤵
  - Adds policy Run key to start application
  - Creates a file in the Startup directory
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Users\Admin\AppData\Local\Temp\upd.exe
    "C:\Users\Admin\AppData\Local\Temp\upd.exe"
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 184
  2⤵
  - Program crash
  PID:5504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1788 -ip 1788
1⤵
PID:4404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elpe-lcJ.tmp

Path C:\Users\Admin\AppData\Local\Temp\elpe-lcJ.tmp
Size 13B
SHA256 fe9f5f68c9fa16b73f1173e11fe416adc065e529a4d6dcf4d13bf48755b4d877
MD5 f93bae7ec95dbcb3474db65b2b44b577
SHA1 b6e4619aab79b6bb0d83db82f3e1cd9021eb54a7
SHA512 a6d94d285e82c2bafb454e176661530b450cb9d1ae1f0a369ae35de0588cf2184d2ecb01c1707543a8bfcf02880841328d3979f854d11c058bcc1cdb170de4e8
MD5 SHA1 SHA512

Submit Download

memory/1788-12-0x0000000000400000-0x0000000001020000-memory.dmp

Download

memory/2324-4-0x00000000FFAF0000-0x00000000FFEA0000-memory.dmp

Download

memory/2324-6-0x0000000002EB0000-0x0000000002EB1000-memory.dmp

Download

memory/2324-9-0x0000000002EC0000-0x0000000002EC1000-memory.dmp

Download

memory/2324-7-0x00000000FFAF0000-0x00000000FFEA0000-memory.dmp

Download

memory/2324-5-0x0000000002EB0000-0x0000000002EB1000-memory.dmp

Download

memory/2324-31-0x0000000000400000-0x0000000001020000-memory.dmp

Download

memory/2324-24-0x0000000000400000-0x0000000001020000-memory.dmp

Download

memory/2324-23-0x00000000FFAF0000-0x00000000FFEA0000-memory.dmp

Download

memory/2324-15-0x0000000000400000-0x0000000001020000-memory.dmp

Download

memory/5396-18-0x0000000000400000-0x0000000001014000-memory.dmp

Download

memory/5396-29-0x0000000000400000-0x0000000001014000-memory.dmp

Download

memory/5396-20-0x0000000000400000-0x0000000001014000-memory.dmp

Download

memory/5396-14-0x0000000000400000-0x0000000001014000-memory.dmp

Download

memory/5396-10-0x0000000000400000-0x0000000001014000-memory.dmp

Download

memory/5396-25-0x0000000000400000-0x0000000001014000-memory.dmp

Download

memory/5396-27-0x0000000000400000-0x0000000001014000-memory.dmp

Download

memory/5396-16-0x0000000000400000-0x0000000001014000-memory.dmp

Download

memory/5396-11-0x0000000001013000-0x0000000001014000-memory.dmp

Download

memory/5396-34-0x0000000000400000-0x0000000001014000-memory.dmp

Download

memory/5396-38-0x0000000000400000-0x0000000001014000-memory.dmp

Download

memory/5396-40-0x0000000000400000-0x0000000001014000-memory.dmp

Download

memory/5396-42-0x0000000000400000-0x0000000001014000-memory.dmp

Download

memory/5396-46-0x0000000000400000-0x0000000001014000-memory.dmp

Download