Analysis
- user interaction
yes - max time kernel
53s - max time network
54s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 17:22
Behavioral task
behavioral1
Sample
DIRECTX.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
600 seconds
General
- Target DIRECTX.exe
- Size 3.1MB
- Sample261027-vxz5faey5x
- SHA256 24f73831b1b123faca5af3935455e3e9ed9ee45dcf4b990afb20b02042712355
- MD5 f5445b1b612a70d5bc7924775f07b7bc
- SHA1 c303799a1dc9be69736690d55c1431887cb49421
- SHA512 e49ae8fa04a51c8ccc3104a16e57000739fa7eaddc6bbefab424d7516be05382cdc4ca2cf12e778074254d87ee82e108b20fa17de08d49c46864b01d678a2359
- SSDEEP 98304:iUK00sCaz3/9+hA4xLS3y1bvs0WBa17QL:vv0sCaz3/9INS3y1b1WBX
- TLSH T124E5335EE108913BFB72F5B1D008ED6D6106FD42F757A2DE896F122DA48B2479893C8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 5 IoCs
resource yara_rule behavioral1/memory/4672-1-0x0000000000C60000-0x00000000017E9000-memory.dmp family_salatstealer behavioral1/memory/4672-2-0x0000000000C60000-0x00000000017E9000-memory.dmp family_salatstealer behavioral1/memory/4672-3-0x0000000000C60000-0x00000000017E9000-memory.dmp family_salatstealer behavioral1/memory/4672-29-0x0000000000C60000-0x00000000017E9000-memory.dmp family_salatstealer behavioral1/memory/4672-30-0x0000000000C60000-0x00000000017E9000-memory.dmp family_salatstealer -
resource yara_rule behavioral1/memory/4672-0-0x0000000000C60000-0x00000000017E9000-memory.dmp upx behavioral1/memory/4672-1-0x0000000000C60000-0x00000000017E9000-memory.dmp upx behavioral1/memory/4672-2-0x0000000000C60000-0x00000000017E9000-memory.dmp upx behavioral1/memory/4672-3-0x0000000000C60000-0x00000000017E9000-memory.dmp upx behavioral1/memory/4672-29-0x0000000000C60000-0x00000000017E9000-memory.dmp upx behavioral1/memory/4672-30-0x0000000000C60000-0x00000000017E9000-memory.dmp upx - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname DIRECTX.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain DIRECTX.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DIRECTX.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4672 DIRECTX.exe 4672 DIRECTX.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2872 taskmgr.exe Token: SeSystemProfilePrivilege 2872 taskmgr.exe Token: SeCreateGlobalPrivilege 2872 taskmgr.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe - Suspicious use of SendNotifyMessage 34 IoCs
pid Process 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DIRECTX.exe"C:\Users\Admin\AppData\Local\Temp\DIRECTX.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4672
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2872
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:6080
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1772