Analysis
- max time kernel
150s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
30/10/2026, 00:51
General
- Target tg-ws-proxy.exe
- Size 24.1MB
- Sample261030-a7hypach78
- SHA256 7491f3a43272c5d73553f7878e9309de6320738bd19ff6c9bf6594879781ca4e
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 19 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 4 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tg-ws-proxy.exe"C:\Users\Admin\AppData\Local\Temp\tg-ws-proxy.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\binder_3448\TgWsProxy.exe"C:\Users\Admin\AppData\Local\Temp\binder_3448\TgWsProxy.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Photo Viewer\fontdrvhost.exe"C:\Program Files (x86)\Windows Photo Viewer\fontdrvhost.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Google\Chrome\Application\fontdrvhost.exe"C:\Program Files\Google\Chrome\Application\fontdrvhost.exe" -4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\binder_3448\TgWsProxy.exe"C:\Users\Admin\AppData\Local\Temp\binder_3448\TgWsProxy.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_kmh3nxde.2xf.ps1
TgWsProxy.exe
memory/224-78-0x00000000000E0000-0x0000000000D34000-memory.dmp
memory/224-80-0x00000000000E0000-0x0000000000D34000-memory.dmp
memory/224-73-0x00000000000E0000-0x0000000000D34000-memory.dmp
memory/224-74-0x00000000000E0000-0x0000000000D34000-memory.dmp
memory/224-75-0x00000000000E0000-0x0000000000D34000-memory.dmp
memory/224-76-0x00000000000E0000-0x0000000000D34000-memory.dmp
memory/224-22-0x00000000000E0000-0x0000000000D34000-memory.dmp
memory/224-23-0x00000000000E0000-0x0000000000D34000-memory.dmp
memory/224-24-0x00000000000E0000-0x0000000000D34000-memory.dmp
memory/224-25-0x00000000000E0000-0x0000000000D34000-memory.dmp
memory/224-81-0x00000000000E0000-0x0000000000D34000-memory.dmp
memory/224-77-0x00000000000E0000-0x0000000000D34000-memory.dmp
memory/224-79-0x00000000000E0000-0x0000000000D34000-memory.dmp
memory/224-51-0x00000000000E0000-0x0000000000D34000-memory.dmp
memory/4000-12-0x0000000000D00000-0x0000000001954000-memory.dmp
memory/4000-11-0x0000000000D00000-0x0000000001954000-memory.dmp
memory/4456-21-0x0000000000D00000-0x0000000001954000-memory.dmp
memory/4456-15-0x0000000000D00000-0x0000000001954000-memory.dmp
memory/4456-14-0x0000000000D00000-0x0000000001954000-memory.dmp
memory/4456-13-0x0000000000D00000-0x0000000001954000-memory.dmp
memory/4456-10-0x0000000000D00000-0x0000000001954000-memory.dmp
memory/4460-67-0x0000000007D70000-0x0000000007D7E000-memory.dmp
memory/4460-46-0x00000000066F0000-0x000000000673C000-memory.dmp
memory/4460-49-0x0000000008040000-0x00000000086BA000-memory.dmp
memory/4460-50-0x00000000079E0000-0x00000000079FA000-memory.dmp
memory/4460-47-0x0000000006B90000-0x0000000006BD4000-memory.dmp
memory/4460-62-0x0000000007BF0000-0x0000000007C0E000-memory.dmp
memory/4460-54-0x0000000070390000-0x00000000706E4000-memory.dmp
memory/4460-53-0x000000006FC90000-0x000000006FCDC000-memory.dmp
memory/4460-52-0x0000000007BB0000-0x0000000007BE2000-memory.dmp
memory/4460-63-0x0000000007C10000-0x0000000007CB3000-memory.dmp
memory/4460-64-0x0000000007D10000-0x0000000007D1A000-memory.dmp
memory/4460-65-0x0000000007DE0000-0x0000000007E76000-memory.dmp
memory/4460-66-0x0000000007D40000-0x0000000007D51000-memory.dmp
memory/4460-48-0x0000000007940000-0x00000000079B6000-memory.dmp
memory/4460-68-0x0000000007D80000-0x0000000007D94000-memory.dmp
memory/4460-69-0x0000000007E80000-0x0000000007E9A000-memory.dmp
memory/4460-70-0x0000000007DB0000-0x0000000007DB8000-memory.dmp
memory/4460-45-0x0000000006640000-0x000000000665E000-memory.dmp
memory/4460-42-0x0000000006010000-0x0000000006364000-memory.dmp
memory/4460-35-0x0000000005F30000-0x0000000005F96000-memory.dmp
memory/4460-36-0x0000000005FA0000-0x0000000006006000-memory.dmp
memory/4460-34-0x0000000005660000-0x0000000005682000-memory.dmp
memory/4460-33-0x0000000005890000-0x0000000005EB8000-memory.dmp
memory/4460-31-0x0000000002CE0000-0x0000000002D16000-memory.dmp
memory/4748-32-0x0000000000460000-0x00000000010B4000-memory.dmp
memory/4748-30-0x0000000000460000-0x00000000010B4000-memory.dmp