Overview

overview

10

Static

static

3

2026-10-01...t_.exe

windows10-2004-x64

10

2026-10-01...t_.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/10/2026, 07:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-01_a06abfe63f60bef9e7c80e4ae8d4e0b8_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe
  • Size 10.2MB
  • Sample261002-h784wacc36
  • SHA256 67b5d75a1212439b3b83d7c003eb477d46ec1b376680b02320be0df68b25d6ca
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasiondiscoveryexecutionsalatstealerspywarestealertrojanupx

Malware Config

Signatures

  • Family: salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer
  • Detect SalatStealer payload 24 IoCs
  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 24 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 24 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 24 IoCs
  • UPX dump on OEP (original entry point) 31 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 31 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 11 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies system certificate store 2 TTPs 4 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_a06abfe63f60bef9e7c80e4ae8d4e0b8_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_a06abfe63f60bef9e7c80e4ae8d4e0b8_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_.exe"
    1⤵
    • Modifies trusted root certificate store through registry
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:3164
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Microsoft
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2764
    • C:\Users\Admin\AppData\Local\Microsoft\updater_WIazNOqb.exe
      C:\Users\Admin\AppData\Local\Microsoft\updater_WIazNOqb.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3528
      • C:\Program Files (x86)\Reference Assemblies\SearchHost.exe
        "C:\Program Files (x86)\Reference Assemblies\SearchHost.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:476
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe
          4⤵
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2904
        • C:\Program Files (x86)\Microsoft\Edge\Application\SearchHost.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\SearchHost.exe" -
          4⤵
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          PID:5752
    • C:\Users\Admin\AppData\Local\Microsoft\updater_laWNFlSU.exe
      C:\Users\Admin\AppData\Local\Microsoft\updater_laWNFlSU.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:812
      • C:\Users\Admin\AppData\Local\Microsoft\StartMenuExperienceHost.exe
        C:\Users\Admin\AppData\Local\Microsoft\StartMenuExperienceHost.exe
        3⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        PID:5312
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
      PID:1432

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          updater_WIazNOqb.exe
          • Path C:\Users\Admin\AppData\Local\Microsoft\updater_WIazNOqb.exe
          • Size 3.4MB
          • SHA256 7002994a0aedb01e8670555d610cd1c91652aed533e9e1ae4310fe594e5c288f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          updater_laWNFlSU.exe
          • Path C:\Users\Admin\AppData\Local\Microsoft\updater_laWNFlSU.exe
          • Size 3.4MB
          • SHA256 18e4b49fd7e15ca846c6346ce58268ff206974eefde55ef5998a2e9cd3b203e2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          __PSScriptPolicyTest_33frfkt1.c3y.psm1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_33frfkt1.c3y.psm1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/476-50-0x0000000000700000-0x0000000001354000-memory.dmp
          Download

          memory/476-49-0x0000000000700000-0x0000000001354000-memory.dmp
          Download

          memory/476-100-0x0000000000700000-0x0000000001354000-memory.dmp
          Download

          memory/476-98-0x0000000000700000-0x0000000001354000-memory.dmp
          Download

          memory/476-53-0x0000000000700000-0x0000000001354000-memory.dmp
          Download

          memory/476-52-0x0000000000700000-0x0000000001354000-memory.dmp
          Download

          memory/476-51-0x0000000000700000-0x0000000001354000-memory.dmp
          Download

          memory/476-84-0x0000000000700000-0x0000000001354000-memory.dmp
          Download

          memory/476-86-0x0000000000700000-0x0000000001354000-memory.dmp
          Download

          memory/476-60-0x0000000000700000-0x0000000001354000-memory.dmp
          Download

          memory/476-88-0x0000000000700000-0x0000000001354000-memory.dmp
          Download

          memory/812-87-0x0000000000970000-0x00000000015C7000-memory.dmp
          Download

          memory/812-83-0x0000000000970000-0x00000000015C7000-memory.dmp
          Download

          memory/812-91-0x0000000000970000-0x00000000015C7000-memory.dmp
          Download

          memory/812-96-0x0000000000970000-0x00000000015C7000-memory.dmp
          Download

          memory/812-85-0x0000000000970000-0x00000000015C7000-memory.dmp
          Download

          memory/812-59-0x0000000000970000-0x00000000015C7000-memory.dmp
          Download

          memory/2764-14-0x00000000706F0000-0x000000007073C000-memory.dmp
          Download

          memory/2764-18-0x0000000073DF0000-0x00000000745AC000-memory.dmp
          Download

          memory/2764-25-0x00000000076F0000-0x0000000007786000-memory.dmp
          Download

          memory/2764-26-0x0000000073E02000-0x0000000073E03000-memory.dmp
          Download

          memory/2764-27-0x0000000073DF0000-0x00000000745AC000-memory.dmp
          Download

          memory/2764-28-0x0000000073DF0000-0x00000000745AC000-memory.dmp
          Download

          memory/2764-30-0x0000000073DF0000-0x00000000745AC000-memory.dmp
          Download

          memory/2764-23-0x0000000007420000-0x000000000743A000-memory.dmp
          Download

          memory/2764-22-0x0000000007A60000-0x00000000080DC000-memory.dmp
          Download

          memory/2764-21-0x0000000073DF0000-0x00000000745AC000-memory.dmp
          Download

          memory/2764-20-0x0000000073DF0000-0x00000000745AC000-memory.dmp
          Download

          memory/2764-19-0x00000000072E0000-0x0000000007383000-memory.dmp
          Download

          memory/2764-17-0x00000000072C0000-0x00000000072E0000-memory.dmp
          Download

          memory/2764-24-0x0000000007490000-0x000000000749A000-memory.dmp
          Download

          memory/2764-13-0x0000000007280000-0x00000000072B6000-memory.dmp
          Download

          memory/2764-0-0x0000000073E02000-0x0000000073E03000-memory.dmp
          Download

          memory/2764-12-0x00000000060F0000-0x000000000613C000-memory.dmp
          Download

          memory/2764-11-0x00000000060A0000-0x00000000060BE000-memory.dmp
          Download

          memory/2764-10-0x0000000005BD0000-0x0000000005F2B000-memory.dmp
          Download

          memory/2764-7-0x0000000005B60000-0x0000000005BC6000-memory.dmp
          Download

          memory/2764-6-0x0000000005AF0000-0x0000000005B56000-memory.dmp
          Download

          memory/2764-5-0x0000000005950000-0x0000000005972000-memory.dmp
          Download

          memory/2764-4-0x0000000073DF0000-0x00000000745AC000-memory.dmp
          Download

          memory/2764-3-0x00000000052D0000-0x000000000591A000-memory.dmp
          Download

          memory/2764-2-0x0000000073DF0000-0x00000000745AC000-memory.dmp
          Download

          memory/2764-1-0x0000000004BE0000-0x0000000004C16000-memory.dmp
          Download

          memory/2904-75-0x00000000704A0000-0x00000000707FB000-memory.dmp
          Download

          memory/2904-63-0x0000000005A10000-0x0000000005D6B000-memory.dmp
          Download

          memory/2904-74-0x0000000070340000-0x000000007038C000-memory.dmp
          Download

          memory/2904-71-0x0000000006270000-0x00000000062B8000-memory.dmp
          Download

          memory/2904-78-0x00000000072E0000-0x0000000007383000-memory.dmp
          Download

          memory/2904-79-0x0000000007910000-0x0000000007932000-memory.dmp
          Download

          memory/2904-80-0x0000000008680000-0x0000000008C3A000-memory.dmp
          Download

          memory/2904-66-0x0000000006380000-0x00000000063CC000-memory.dmp
          Download

          memory/3528-47-0x0000000000250000-0x0000000000EA4000-memory.dmp
          Download

          memory/3528-41-0x0000000000250000-0x0000000000EA4000-memory.dmp
          Download

          memory/3528-40-0x0000000000250000-0x0000000000EA4000-memory.dmp
          Download

          memory/3528-39-0x0000000000250000-0x0000000000EA4000-memory.dmp
          Download

          memory/3528-38-0x0000000000250000-0x0000000000EA4000-memory.dmp
          Download

          memory/3528-37-0x0000000000250000-0x0000000000EA4000-memory.dmp
          Download

          memory/3528-36-0x0000000000250000-0x0000000000EA4000-memory.dmp
          Download

          memory/5312-97-0x0000000000D00000-0x0000000001957000-memory.dmp
          Download

          memory/5312-99-0x0000000000D00000-0x0000000001957000-memory.dmp
          Download

          memory/5312-101-0x0000000000D00000-0x0000000001957000-memory.dmp
          Download

          memory/5752-70-0x0000000000BF0000-0x0000000001844000-memory.dmp
          Download

          memory/5752-73-0x0000000000BF0000-0x0000000001844000-memory.dmp
          Download