Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
30/10/2026, 17:48
General
- Target v2raytun_windows.exe
- Size 67.1MB
- Sample261030-wdf3wsfb29
- SHA256 b826ebf4cac4b13dc4d392b9d2cc712f3bd2650888dadfa7e378699add3da4d5
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 6 IoCs
- UAC bypass 3 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 11 IoCs
- Loads dropped DLL 11 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 2 IoCs
- UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies registry class 7 IoCs
- Suspicious behavior: EnumeratesProcesses 45 IoCs
- Suspicious use of AdjustPrivilegeToken 13 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\v2raytun_windows.exe"C:\Users\Admin\AppData\Local\Temp\v2raytun_windows.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\GBND2\v2raytun_windows.exe_4311015\app\v2RayTun-windows-x64-v3.10.15.exe"C:\Users\Admin\AppData\Local\GBND2\v2raytun_windows.exe_4311015\app\v2RayTun-windows-x64-v3.10.15.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-67296.tmp\v2RayTun-windows-x64-v3.10.15.tmp"C:\Users\Admin\AppData\Local\Temp\is-67296.tmp\v2RayTun-windows-x64-v3.10.15.tmp" /SL5="$B0054,62211102,726528,C:\Users\Admin\AppData\Local\GBND2\v2raytun_windows.exe_4311015\app\v2RayTun-windows-x64-v3.10.15.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-TDKRQ.tmp\VC_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\is-TDKRQ.tmp\VC_redist.x64.exe" /install /quiet /norestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{20F4647C-FE88-44D7-9625-4BE02B6FB1F3}\.cr\VC_redist.x64.exe"C:\Windows\Temp\{20F4647C-FE88-44D7-9625-4BE02B6FB1F3}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-TDKRQ.tmp\VC_redist.x64.exe" -burn.filehandle.attached=704 -burn.filehandle.self=708 /install /quiet /norestart5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{D36F8675-1A1B-40E0-82FB-573079A2B31A}\.be\VC_redist.x64.exe"C:\Windows\Temp\{D36F8675-1A1B-40E0-82FB-573079A2B31A}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{13012418-69CE-4B03-AD50-35C4A65FBF64} {22846CAB-4118-47F4-9F7A-EA77866F0D7F} 42446⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files (x86)\v2RayTun\v2RayTun.exe"C:\Program Files (x86)\v2RayTun\v2RayTun.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\v2RayTun\xraycore.exeC:\Users\Admin\AppData\Local\Temp\v2RayTun\xraycore.exe version5⤵
- Executes dropped EXE
-
-
-
-
-
C:\Users\Admin\AppData\Local\GBND2\v2raytun_windows.exe_4311015\payload\gbnd_monetize_payload.exe"C:\Users\Admin\AppData\Local\GBND2\v2raytun_windows.exe_4311015\payload\gbnd_monetize_payload.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\WindowsPowerShell\explorer.exe"C:\Program Files (x86)\WindowsPowerShell\explorer.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe4⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ReAgentc.exe"C:\Windows\system32\ReAgentc.exe" /disable5⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\explorer.exe"C:\Program Files (x86)\Microsoft\Edge\Application\explorer.exe" -4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Google\Chrome\Application\explorer.exe"C:\Program Files\Google\Chrome\Application\explorer.exe" -4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
app.so
FontManifest.json
NativeAssetsManifest.json
geosite.dat
xraycore.exe
Inter-Black.ttf
Inter-BlackItalic.ttf
Inter-Bold.ttf
Inter-BoldItalic.ttf
Inter-ExtraBold.ttf
Inter-ExtraBoldItalic.ttf
Inter-ExtraLight.ttf
Inter-ExtraLightItalic.ttf
Inter-Italic.ttf
Inter-Light.ttf
Inter-LightItalic.ttf
Inter-Medium.ttf
Inter-MediumItalic.ttf
Inter-Regular.ttf
Inter-SemiBold.ttf
Inter-SemiBoldItalic.ttf
Inter-Thin.ttf
Inter-ThinItalic.ttf
icon.ico
MaterialIcons-Regular.otf
is-9EMHR.tmp
is-A37EK.tmp
is-AA6FR.tmp
is-NJ39C.tmp
is-OHH14.tmp
is-U6HGJ.tmp
is-UISFN.tmp
icudtl.dat
file_selector_windows_plugin.dll
flutter_windows.dll
local_notifier_plugin.dll
screen_retriever_windows_plugin.dll
tray_manager_plugin.dll
url_launcher_windows_plugin.dll
v2RayTun.exe
window_manager_plugin.dll
gbnd_monetize_payload.exe
__PSScriptPolicyTest_iqu44imj.ccs.ps1
v2RayTun-windows-x64-v3.10.15.tmp
ISSkinU.dll
Recall 6.6 Basic.cjstyles
VC_redist.x64.exe
awgcore.dll
geoip.dat
libcore.dll
libhost.exe
wintun.dll
VC_redist.x64.exe
logo.png
wixstdba.dll
memory/320-1281-0x0000000000970000-0x00000000015C5000-memory.dmp
memory/320-1300-0x0000000000970000-0x00000000015C5000-memory.dmp
memory/764-40-0x0000000000400000-0x00000000004BF000-memory.dmp
memory/764-48-0x0000000000400000-0x00000000004BF000-memory.dmp
memory/1056-96-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1056-105-0x00000000769F0000-0x0000000076FA3000-memory.dmp
memory/1056-73-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1056-72-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1056-70-0x0000000075E40000-0x0000000075E65000-memory.dmp
memory/1056-69-0x0000000076790000-0x000000007680A000-memory.dmp
memory/1056-68-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1056-67-0x0000000075E40000-0x0000000075E65000-memory.dmp
memory/1056-66-0x0000000076790000-0x000000007680A000-memory.dmp
memory/1056-64-0x0000000076790000-0x000000007680A000-memory.dmp
memory/1056-76-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1056-63-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1056-62-0x0000000076790000-0x000000007680A000-memory.dmp
memory/1056-60-0x0000000076790000-0x000000007680A000-memory.dmp
memory/1056-61-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1056-51-0x0000000000400000-0x000000000067A000-memory.dmp
memory/1056-65-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1056-71-0x0000000074430000-0x0000000074460000-memory.dmp
memory/1056-85-0x00000000769F0000-0x0000000076FA3000-memory.dmp
memory/1056-95-0x0000000074270000-0x0000000074392000-memory.dmp
memory/1056-98-0x00000000769F0000-0x0000000076FA3000-memory.dmp
memory/1056-102-0x0000000074270000-0x0000000074392000-memory.dmp
memory/1056-120-0x0000000075630000-0x0000000075840000-memory.dmp
memory/1056-78-0x00000000769F0000-0x0000000076FA3000-memory.dmp
memory/1056-79-0x0000000076890000-0x0000000076973000-memory.dmp
memory/1056-81-0x0000000074270000-0x0000000074392000-memory.dmp
memory/1056-82-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1056-83-0x0000000076FB0000-0x000000007705F000-memory.dmp
memory/1056-84-0x0000000076330000-0x000000007640C000-memory.dmp
memory/1056-86-0x0000000076890000-0x0000000076973000-memory.dmp
memory/1056-75-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1056-77-0x0000000076FB0000-0x000000007705F000-memory.dmp
memory/1056-80-0x0000000075630000-0x0000000075840000-memory.dmp
memory/1056-118-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1056-117-0x0000000074270000-0x0000000074392000-memory.dmp
memory/1056-116-0x0000000074AD0000-0x0000000074AF6000-memory.dmp
memory/1056-87-0x0000000075630000-0x0000000075840000-memory.dmp
memory/1056-115-0x0000000075500000-0x0000000075574000-memory.dmp
memory/1056-112-0x00000000769F0000-0x0000000076FA3000-memory.dmp
memory/1056-114-0x0000000075630000-0x0000000075840000-memory.dmp
memory/1056-113-0x0000000076890000-0x0000000076973000-memory.dmp
memory/1056-111-0x0000000076330000-0x000000007640C000-memory.dmp
memory/1056-88-0x0000000075500000-0x0000000075574000-memory.dmp
memory/1056-110-0x0000000076FB0000-0x000000007705F000-memory.dmp
memory/1056-109-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1056-108-0x0000000074270000-0x0000000074392000-memory.dmp
memory/1056-107-0x0000000075500000-0x0000000075574000-memory.dmp
memory/1056-106-0x0000000075630000-0x0000000075840000-memory.dmp
memory/1056-74-0x0000000075E40000-0x0000000075E65000-memory.dmp
memory/1056-104-0x0000000076FB0000-0x000000007705F000-memory.dmp
memory/1056-103-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1056-101-0x0000000075500000-0x0000000075574000-memory.dmp
memory/1056-89-0x0000000074270000-0x0000000074392000-memory.dmp
memory/1056-100-0x0000000075E40000-0x0000000075E65000-memory.dmp
memory/1056-99-0x0000000075630000-0x0000000075840000-memory.dmp
memory/1056-97-0x0000000076FB0000-0x000000007705F000-memory.dmp
memory/1056-94-0x0000000075500000-0x0000000075574000-memory.dmp
memory/1056-93-0x0000000075630000-0x0000000075840000-memory.dmp
memory/1056-92-0x00000000769F0000-0x0000000076FA3000-memory.dmp
memory/1056-91-0x0000000076FB0000-0x000000007705F000-memory.dmp
memory/1056-90-0x0000000010000000-0x0000000010061000-memory.dmp
memory/2212-210-0x0000000000940000-0x0000000001595000-memory.dmp
memory/2212-215-0x0000000000940000-0x0000000001595000-memory.dmp
memory/2300-1275-0x00000000006A0000-0x00000000012F5000-memory.dmp
memory/2300-1260-0x00000000006A0000-0x00000000012F5000-memory.dmp
memory/2716-2-0x0000000002C50000-0x0000000002C5A000-memory.dmp
memory/2716-1-0x0000000001360000-0x0000000001372000-memory.dmp
memory/2716-3-0x00000000240A0000-0x00000000240B0000-memory.dmp
memory/2716-0-0x0000000000BA0000-0x0000000000BAA000-memory.dmp
memory/3304-1276-0x0000000006050000-0x0000000006094000-memory.dmp
memory/3304-1263-0x00000000054C0000-0x0000000005526000-memory.dmp
memory/3304-1296-0x00000000070C0000-0x00000000070DE000-memory.dmp
memory/3304-1298-0x00000000070E0000-0x0000000007183000-memory.dmp
memory/3304-1288-0x000000006EBE0000-0x000000006EF34000-memory.dmp
memory/3304-1287-0x000000006E8A0000-0x000000006E8EC000-memory.dmp
memory/3304-1286-0x0000000007060000-0x0000000007092000-memory.dmp
memory/3304-1283-0x0000000007520000-0x0000000007B9A000-memory.dmp
memory/3304-1284-0x0000000006EA0000-0x0000000006EBA000-memory.dmp
memory/3304-1282-0x0000000006E20000-0x0000000006E96000-memory.dmp
memory/3304-1314-0x0000000008150000-0x00000000086F4000-memory.dmp
memory/3304-1301-0x00000000072B0000-0x0000000007346000-memory.dmp
memory/3304-1273-0x0000000005B30000-0x0000000005B7C000-memory.dmp
memory/3304-1272-0x0000000005B10000-0x0000000005B2E000-memory.dmp
memory/3304-1269-0x0000000005530000-0x0000000005884000-memory.dmp
memory/3304-1299-0x00000000071E0000-0x00000000071EA000-memory.dmp
memory/3304-1262-0x00000000053E0000-0x0000000005446000-memory.dmp
memory/3304-1261-0x00000000051E0000-0x0000000005202000-memory.dmp
memory/3304-1302-0x0000000007210000-0x0000000007221000-memory.dmp
memory/3304-1259-0x0000000004BB0000-0x00000000051D8000-memory.dmp
memory/3304-1254-0x0000000000D70000-0x0000000000DA6000-memory.dmp
memory/3304-1303-0x0000000007240000-0x000000000724E000-memory.dmp
memory/3304-1304-0x0000000007270000-0x0000000007284000-memory.dmp
memory/3304-1313-0x0000000007380000-0x00000000073A2000-memory.dmp
memory/3304-1306-0x0000000007350000-0x0000000007358000-memory.dmp
memory/3304-1305-0x0000000007370000-0x000000000738A000-memory.dmp
memory/3856-44-0x0000000000100000-0x0000000000D55000-memory.dmp
memory/3856-50-0x0000000000100000-0x0000000000D55000-memory.dmp
memory/3856-49-0x0000000000100000-0x0000000000D55000-memory.dmp
memory/3856-211-0x0000000000100000-0x0000000000D55000-memory.dmp