salatstealer | b91994601fad857b193b6a4d425d737983fda33d4edac370028afea3ff397231

Analysis

max time kernel
149s
max time network
62s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 11:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b91994601fad857b193b6a4d425d737983fda33d4edac370028afea3ff397231.bin.bat
Size 12.7MB
Sample261030-n3traaed59
SHA256 b91994601fad857b193b6a4d425d737983fda33d4edac370028afea3ff397231
MD5 8ba8fcb89a37bd782289ceab99ecdb2e
SHA1 7cc23beba2c81ab27c85d54c3e3c23305e7704ab
SHA512 5011e6823bef38faad22d99accdf1f4a3dc0f983d6486937e11f50b43fa218dd7de5121d6fc350a3f7d77d61fd7e19cade14b56591b5d7bab36906e45139ffab
SSDEEP 49152:GYJZB1zf1AShb/lCG17d1wXhQ1+DxnSstWu5Ju2WrTmBGS4as+hQ8jxK9pXYHdzQ:j
TLSH
T176D69C322603BCFA3F6E6EC599142D404C4D3D974254C9A4BE4EF8B3A6DE1486FAE474
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution salatstealer stealer upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 4 IoCs

resource	yara_rule
behavioral2/memory/4364-13147-0x0000000000D80000-0x00000000019D4000-memory.dmp	family_salatstealer
behavioral2/memory/4364-13148-0x0000000000D80000-0x00000000019D4000-memory.dmp	family_salatstealer
behavioral2/memory/4364-13155-0x0000000000D80000-0x00000000019D4000-memory.dmp	family_salatstealer
behavioral2/memory/3584-13158-0x0000000000DD0000-0x0000000001A24000-memory.dmp	family_salatstealer

Executes dropped EXE 3 IoCs

pid	Process
6140	vcomp140.exe
4364	updater_UKdsXrSJ.exe
3584	smartscreen.exe

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
4612	certutil.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000e0000000007b6-13144.dat	upx
behavioral2/memory/4364-13146-0x0000000000D80000-0x00000000019D4000-memory.dmp	upx
behavioral2/memory/4364-13147-0x0000000000D80000-0x00000000019D4000-memory.dmp	upx
behavioral2/memory/4364-13148-0x0000000000D80000-0x00000000019D4000-memory.dmp	upx
behavioral2/memory/3584-13156-0x0000000000DD0000-0x0000000001A24000-memory.dmp	upx
behavioral2/memory/4364-13155-0x0000000000D80000-0x00000000019D4000-memory.dmp	upx
behavioral2/memory/3584-13158-0x0000000000DD0000-0x0000000001A24000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\9f2d4481-2a9c-32d3-c7ad-df713efb812a	updater_UKdsXrSJ.exe
File opened for modification	C:\Program Files (x86)\Microsoft\OfficeClickToRun.exe	updater_UKdsXrSJ.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5464	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 3 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	updater_UKdsXrSJ.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	updater_UKdsXrSJ.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	smartscreen.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smartscreen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcomp140.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater_UKdsXrSJ.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4364	updater_UKdsXrSJ.exe
4364	updater_UKdsXrSJ.exe
4364	updater_UKdsXrSJ.exe
4364	updater_UKdsXrSJ.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5464 wrote to memory of 4612	5464	cmd.exe	92
PID 5464 wrote to memory of 6140	5464	cmd.exe	93
PID 6140 wrote to memory of 4364	6140	vcomp140.exe	94
PID 4364 wrote to memory of 3584	4364	updater_UKdsXrSJ.exe	97

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b91994601fad857b193b6a4d425d737983fda33d4edac370028afea3ff397231.bin.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5464
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\vcomp140.tmp" "C:\Users\Admin\AppData\Local\Temp\vcomp140.exe"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:4612
- C:\Users\Admin\AppData\Local\Temp\vcomp140.exe
  "C:\Users\Admin\AppData\Local\Temp\vcomp140.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6140
- - C:\Users\Admin\AppData\Local\Microsoft\updater_UKdsXrSJ.exe
    C:\Users\Admin\AppData\Local\Microsoft\updater_UKdsXrSJ.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4364
  - - C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\smartscreen.exe
      C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\smartscreen.exe
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      PID:3584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

updater_UKdsXrSJ.exe

Path C:\Users\Admin\AppData\Local\Microsoft\updater_UKdsXrSJ.exe
Size 3.4MB
SHA256 0a9d56f0d7971548402fb30123e978e8c2d6156c180a707e242212f72325df3d
MD5 01c24f88d18f2315665dd09402d64714
SHA1 2e5f88385f8dd31cfd4bacc452a65a5b503250c2
SHA512 9c5187bfe1d2b42c5cdb01de6f04167c6cd5bfdc991d419e19767d147bee0c000e767e1d2f5b18a86f0d1accf5de572730ffe0f8356d5d7a088a1f223d1a6c7d
SSDEEP 98304:uBQeLe5jCnW24oLq//Z3xfNyCXISNUKGyzt:pO2wuV/nN1fH
TLSH
T171F5331ECF0B9912E1A5CB7E050D671F8AD8B60BF6AD45E6A23B69F89F16138350C10D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcomp140.exe

Path C:\Users\Admin\AppData\Local\Temp\vcomp140.exe
Size 9.4MB
SHA256 fcaf1f466fe1574055cbc2f3d6b72080e77587204d03c513a10514f2aa40c8e7
MD5 9491f20f2e2551cd03f6041bb8903c30
SHA1 40093e09b1df9fb73ed39572189e78fc4d0e8b6a
SHA512 40cc0f1533d36cb65bcc376e7b361e826c0e5c3a10bf3e041b3cd9372c57c700eff00dcdee40666143a71f1733cb674506d97e9bb8430452f4bbaeacb2e3f260
SSDEEP 196608:JbW048ihnjBqMPxcTzfAsoiMJ19baWCQ:l29fPxcfosu7R
TLSH
T18CA69C41FECB98F6E903193001A7B26F67345D014F25CBD7EB647B2AE97B6A11833249
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcomp140.tmp

Path C:\Users\Admin\AppData\Local\Temp\vcomp140.tmp
Size 12.6MB
SHA256 9f04d1219599fb2ca751249ab75d0e3800638bd4e39ce54a87596166085d584b
MD5 c8a3cc76fd16b1e665cc08d6fe2c5fe6
SHA1 9dc8d69936215cb03a61dcc95816c33a390099b7
SHA512 a4bb9c88b834e009e5d937ec19e93de16369d2ee1817ec152c791a8e1f2dd68b524a0476ad37dc8e8e7e748678ef90fc17aafbb51fb470a078147a3adc91f9c8
SSDEEP 49152:bMnpblZP1E+plFliC7DHFUBNoG3J5YCdcGfp4MmlbwfOWmGgo1KyBLQ1HfOjfJqE:P
TLSH
T11BD68D320203BDFB3B6D5EC998002E514C5D3D874398DA94AE4EB1B7BADE2185F9E474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcomp140.tmp

Path C:\Users\Admin\AppData\Local\Temp\vcomp140.tmp
Size 29KB
SHA256 e9a59705ffaf038bc7ecc8677ad3f6d830cb56ce636423ddbf34b46c8f5d8932
MD5 3a4bd13d32bc8462f269fe75dd790bea
SHA1 d15da110fedc70f102621f5ff23151d4697f2653
SHA512 43ca7506e39ecaab1fd3a863dc152e58ac929d47deb363a3b744ea284160131925c8a8a5dbbd718879c13d2ad86f0b558003965c63cc1625db7590d58f7acfee
SSDEEP 768:Du3RMfe8YQdGld+wrI1MFKRt6cpSN3Dpe:Du3RMfe8Y2U6LTlpSze
TLSH
T14DD23A3502438D7F7B6CBEC69D241D898D8D2FC703989E499F4EE2329E9A2184B5B075
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3584-13156-0x0000000000DD0000-0x0000000001A24000-memory.dmp

Download

memory/3584-13158-0x0000000000DD0000-0x0000000001A24000-memory.dmp

Download

memory/4364-13146-0x0000000000D80000-0x00000000019D4000-memory.dmp

Download

memory/4364-13147-0x0000000000D80000-0x00000000019D4000-memory.dmp

Download

memory/4364-13148-0x0000000000D80000-0x00000000019D4000-memory.dmp

Download

memory/4364-13155-0x0000000000D80000-0x00000000019D4000-memory.dmp

Download