General
- Target 6446789645919a0aa36e6711dd5cf187e9b1db367ce883efcae0ad812f73053a.exe
- Size 43.9MB
- Sample261030-afnpvsfx81
- SHA256 6446789645919a0aa36e6711dd5cf187e9b1db367ce883efcae0ad812f73053a
Malware Config
Targets
-
- Target 6446789645919a0aa36e6711dd5cf187e9b1db367ce883efcae0ad812f73053a.exe
- Size 43.9MB
- SHA256 6446789645919a0aa36e6711dd5cf187e9b1db367ce883efcae0ad812f73053a
Score10/10-
Detect SalatStealer payload
-
Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
-
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Windows security bypass
-
XMRig Miner payload
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Windows security modification
-
Adds Run key to start application
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Access Token Manipulation
1Parent PID Spoofing
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Access Token Manipulation
1Parent PID Spoofing
1Debugger Evasion
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
3