Analysis
- user interaction
yes - max time kernel
118s - max time network
121s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
20/10/2026, 10:20
General
- Target rat(2).exe
- Size 7.0MB
- Sample261020-mdhgaayvbx
- SHA256 e46b8b30d115c742680b31a794e1cd10c7d04c8cf0bbf6d80a311b004a85dbb7
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Using powershell.exe command.
- Executes dropped EXE 2 IoCs
- Uses WMI to collect hardware manufacturer information 2 TTPs 1 IoCs
Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.
- Direct Volume Access: Opens a physical disk for reading 1 TTPs 2 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\rat(2).exe"C:\Users\Admin\AppData\Local\Temp\rat(2).exe"1⤵
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\rat(2).exe' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionProcess 'rat(2).exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\schtasks.exeschtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\rat(2)_task.xml /TN rat(2) /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rat(2).exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\rat(2).exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rat(2).exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\rat(2).exe1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rat(2).exe' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionProcess 'rat(2).exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"2⤵
- Uses WMI to collect hardware manufacturer information
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(Get-WmiObject -Query \"select * from Win32_OperatingSystem\").Caption"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_ebeop1a4.n3l.ps1
rat(2)_task.xml
rat(2).exe
memory/3004-15-0x00007FF414EA0000-0x00007FF414EB0000-memory.dmp
memory/3004-19-0x0000024CEEFD0000-0x0000024CEEFEC000-memory.dmp
memory/3004-21-0x0000024CEF010000-0x0000024CEF02A000-memory.dmp
memory/3004-22-0x0000024CEEB60000-0x0000024CEEB68000-memory.dmp
memory/3004-23-0x0000024CEEFF0000-0x0000024CEEFF6000-memory.dmp
memory/3004-24-0x0000024CEF000000-0x0000024CEF00A000-memory.dmp
memory/3004-25-0x0000024CD3100000-0x0000024CD3110000-memory.dmp
memory/3004-20-0x0000024CEEB50000-0x0000024CEEB5A000-memory.dmp
memory/3004-18-0x0000024CEEB40000-0x0000024CEEB4A000-memory.dmp
memory/3004-17-0x0000024CEEA80000-0x0000024CEEB33000-memory.dmp
memory/3004-0-0x0000024CD3100000-0x0000024CD3110000-memory.dmp
memory/3004-16-0x0000024CEEA60000-0x0000024CEEA7C000-memory.dmp
memory/3004-8-0x0000024CD3100000-0x0000024CD3110000-memory.dmp
memory/3004-7-0x0000024CEE9C0000-0x0000024CEE9E2000-memory.dmp