Analysis
- max time kernel
23s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
30/10/2026, 00:09
General
- Target DiscordFix.exe
- Size 3.4MB
- Sample261030-afyvtstyfw
- SHA256 0c8d889bba69756ab0b1d8daedecda4eee20f8dff4d0f69eeecae459f555435a
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 4 IoCs
- UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 2 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DiscordFix.exe"C:\Users\Admin\AppData\Local\Temp\DiscordFix.exe"1⤵
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\PeerDistRepub\services.exeC:\Users\Admin\AppData\Local\PeerDistRepub\services.exe2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
-
C:\Windows\SysWOW64\ReAgentc.exe"C:\Windows\system32\ReAgentc.exe" /disable4⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\services.exe"C:\Program Files (x86)\Microsoft\Edge\Application\services.exe" -3⤵
-
-
C:\Program Files\Google\Chrome\Application\services.exe"C:\Program Files\Google\Chrome\Application\services.exe" -3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
services.exe
services.exe
services.exe
__PSScriptPolicyTest_03njqmhy.g2h.ps1
memory/3188-0-0x0000000000840000-0x0000000001497000-memory.dmp
memory/3188-1-0x0000000000840000-0x0000000001497000-memory.dmp
memory/3188-2-0x0000000000840000-0x0000000001497000-memory.dmp
memory/3188-10-0x0000000000840000-0x0000000001497000-memory.dmp
memory/3448-21-0x0000000000DA0000-0x00000000019F7000-memory.dmp
memory/3448-34-0x0000000000DA0000-0x00000000019F7000-memory.dmp
memory/4496-44-0x0000000000300000-0x0000000000F57000-memory.dmp
memory/4496-41-0x0000000000300000-0x0000000000F57000-memory.dmp
memory/4784-84-0x00000000007D0000-0x0000000001427000-memory.dmp
memory/4784-83-0x00000000007D0000-0x0000000001427000-memory.dmp
memory/4784-82-0x00000000007D0000-0x0000000001427000-memory.dmp
memory/4784-81-0x00000000007D0000-0x0000000001427000-memory.dmp
memory/4784-80-0x00000000007D0000-0x0000000001427000-memory.dmp
memory/4784-79-0x00000000007D0000-0x0000000001427000-memory.dmp
memory/4784-78-0x00000000007D0000-0x0000000001427000-memory.dmp
memory/4784-77-0x00000000007D0000-0x0000000001427000-memory.dmp
memory/4784-76-0x00000000007D0000-0x0000000001427000-memory.dmp
memory/4784-85-0x00000000007D0000-0x0000000001427000-memory.dmp
memory/4784-13-0x00000000007D0000-0x0000000001427000-memory.dmp
memory/4784-12-0x00000000007D0000-0x0000000001427000-memory.dmp
memory/4784-11-0x00000000007D0000-0x0000000001427000-memory.dmp
memory/5116-45-0x0000000007890000-0x0000000007906000-memory.dmp
memory/5116-64-0x0000000007CB0000-0x0000000007CC4000-memory.dmp
memory/5116-47-0x0000000007910000-0x000000000792A000-memory.dmp
memory/5116-46-0x0000000007F90000-0x000000000860A000-memory.dmp
memory/5116-50-0x0000000070D40000-0x0000000071094000-memory.dmp
memory/5116-59-0x0000000007B40000-0x0000000007BE3000-memory.dmp
memory/5116-60-0x0000000007C40000-0x0000000007C4A000-memory.dmp
memory/5116-58-0x0000000007B20000-0x0000000007B3E000-memory.dmp
memory/5116-49-0x0000000070530000-0x000000007057C000-memory.dmp
memory/5116-61-0x0000000007D10000-0x0000000007DA6000-memory.dmp
memory/5116-48-0x0000000007AE0000-0x0000000007B12000-memory.dmp
memory/5116-62-0x0000000007C70000-0x0000000007C81000-memory.dmp
memory/5116-63-0x0000000007CA0000-0x0000000007CAE000-memory.dmp
memory/5116-42-0x0000000006990000-0x00000000069D4000-memory.dmp
memory/5116-65-0x0000000007DB0000-0x0000000007DCA000-memory.dmp
memory/5116-66-0x0000000007CE0000-0x0000000007CE8000-memory.dmp
memory/5116-72-0x0000000007DB0000-0x0000000007DD2000-memory.dmp
memory/5116-73-0x0000000008BC0000-0x0000000009164000-memory.dmp
memory/5116-36-0x00000000065B0000-0x00000000065FC000-memory.dmp
memory/5116-35-0x0000000006570000-0x000000000658E000-memory.dmp
memory/5116-24-0x0000000005730000-0x0000000005796000-memory.dmp
memory/5116-31-0x0000000005F40000-0x0000000006294000-memory.dmp
memory/5116-25-0x0000000005ED0000-0x0000000005F36000-memory.dmp
memory/5116-23-0x0000000005590000-0x00000000055B2000-memory.dmp
memory/5116-17-0x0000000002D80000-0x0000000002D90000-memory.dmp
memory/5116-22-0x0000000002D80000-0x0000000002D90000-memory.dmp
memory/5116-20-0x00000000057A0000-0x0000000005DC8000-memory.dmp
memory/5116-19-0x0000000002C10000-0x0000000002C46000-memory.dmp