Analysis
- max time kernel
150s - max time network
156s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/10/2026, 17:48
General
- Target v2raytun_windows.exe
- Size 67.1MB
- Sample261030-wdf3wsfb29
- SHA256 b826ebf4cac4b13dc4d392b9d2cc712f3bd2650888dadfa7e378699add3da4d5
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 4 IoCs
- UAC bypass 3 TTPs 1 IoCs
- Executes dropped EXE 10 IoCs
- Loads dropped DLL 14 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 2 IoCs
- UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 7 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies registry class 7 IoCs
- Suspicious behavior: EnumeratesProcesses 47 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\v2raytun_windows.exe"C:\Users\Admin\AppData\Local\Temp\v2raytun_windows.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\GBND2\v2raytun_windows.exe_4311015\app\v2RayTun-windows-x64-v3.10.15.exe"C:\Users\Admin\AppData\Local\GBND2\v2raytun_windows.exe_4311015\app\v2RayTun-windows-x64-v3.10.15.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-O9V7B.tmp\v2RayTun-windows-x64-v3.10.15.tmp"C:\Users\Admin\AppData\Local\Temp\is-O9V7B.tmp\v2RayTun-windows-x64-v3.10.15.tmp" /SL5="$600DC,62211102,726528,C:\Users\Admin\AppData\Local\GBND2\v2raytun_windows.exe_4311015\app\v2RayTun-windows-x64-v3.10.15.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-A62UV.tmp\VC_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\is-A62UV.tmp\VC_redist.x64.exe" /install /quiet /norestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{5061375C-CB4D-4B4F-B8A1-901EB0B903D1}\.cr\VC_redist.x64.exe"C:\Windows\Temp\{5061375C-CB4D-4B4F-B8A1-901EB0B903D1}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-A62UV.tmp\VC_redist.x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /install /quiet /norestart5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{2B1148E1-AEB7-42AD-8386-493E19B18367}\.be\VC_redist.x64.exe"C:\Windows\Temp\{2B1148E1-AEB7-42AD-8386-493E19B18367}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{7E757825-15A1-4D12-AA5A-E0AAD3C46CCE} {4E256276-6DE4-4CDF-8781-A57CE22D2DE5} 55766⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files (x86)\v2RayTun\v2RayTun.exe"C:\Program Files (x86)\v2RayTun\v2RayTun.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\v2RayTun\xraycore.exeC:\Users\Admin\AppData\Local\Temp\v2RayTun\xraycore.exe version5⤵
- Executes dropped EXE
-
-
-
-
-
C:\Users\Admin\AppData\Local\GBND2\v2raytun_windows.exe_4311015\payload\gbnd_monetize_payload.exe"C:\Users\Admin\AppData\Local\GBND2\v2raytun_windows.exe_4311015\payload\gbnd_monetize_payload.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\MSBuild\dllhost.exe"C:\Program Files (x86)\MSBuild\dllhost.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe4⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ReAgentc.exe"C:\Windows\system32\ReAgentc.exe" /disable5⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\dllhost.exe"C:\Program Files (x86)\Microsoft\Edge\Application\dllhost.exe" -4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC1⤵
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
app.so
FontManifest.json
NativeAssetsManifest.json
xraycore.exe
Inter-Black.ttf
Inter-BlackItalic.ttf
Inter-Bold.ttf
Inter-BoldItalic.ttf
Inter-ExtraBold.ttf
Inter-ExtraBoldItalic.ttf
Inter-ExtraLight.ttf
Inter-ExtraLightItalic.ttf
Inter-Italic.ttf
Inter-Light.ttf
Inter-LightItalic.ttf
Inter-Medium.ttf
Inter-MediumItalic.ttf
Inter-Regular.ttf
Inter-SemiBold.ttf
Inter-SemiBoldItalic.ttf
Inter-Thin.ttf
Inter-ThinItalic.ttf
icon.ico
MaterialIcons-Regular.otf
is-3TJ3A.tmp
is-6EP6U.tmp
is-9QRUH.tmp
is-ILDGR.tmp
is-IVTP6.tmp
is-LAUMA.tmp
is-UILCV.tmp
icudtl.dat
file_selector_windows_plugin.dll
flutter_windows.dll
local_notifier_plugin.dll
screen_retriever_windows_plugin.dll
tray_manager_plugin.dll
url_launcher_windows_plugin.dll
v2RayTun.exe
window_manager_plugin.dll
gbnd_monetize_payload.exe
__PSScriptPolicyTest_tnfk3voe.hfc.psm1
ISSkinU.dll
Recall 6.6 Basic.cjstyles
VC_redist.x64.exe
v2RayTun-windows-x64-v3.10.15.tmp
awgcore.dll
geoip.dat
geosite.dat
libcore.dll
libhost.exe
wintun.dll
logo.png
wixstdba.dll
VC_redist.x64.exe
memory/244-57-0x0000000076050000-0x00000000760CE000-memory.dmp
memory/244-89-0x0000000075750000-0x00000000757D1000-memory.dmp
memory/244-143-0x0000000075750000-0x00000000757D1000-memory.dmp
memory/244-130-0x0000000075750000-0x00000000757D1000-memory.dmp
memory/244-119-0x0000000010000000-0x0000000010061000-memory.dmp
memory/244-109-0x0000000075750000-0x00000000757D1000-memory.dmp
memory/244-110-0x0000000074DD0000-0x0000000074DF5000-memory.dmp
memory/244-91-0x0000000010000000-0x0000000010061000-memory.dmp
memory/244-77-0x0000000010000000-0x0000000010061000-memory.dmp
memory/244-72-0x00000000762E0000-0x0000000076391000-memory.dmp
memory/244-73-0x00000000777E0000-0x0000000077DBC000-memory.dmp
memory/244-68-0x0000000010000000-0x0000000010061000-memory.dmp
memory/244-64-0x0000000076050000-0x00000000760CE000-memory.dmp
memory/244-67-0x0000000010000000-0x0000000010061000-memory.dmp
memory/244-66-0x00000000743C0000-0x00000000743F3000-memory.dmp
memory/244-65-0x0000000075BB0000-0x0000000075BD5000-memory.dmp
memory/244-62-0x0000000075BB0000-0x0000000075BD5000-memory.dmp
memory/244-63-0x0000000010000000-0x0000000010061000-memory.dmp
memory/244-61-0x0000000076050000-0x00000000760CE000-memory.dmp
memory/244-59-0x0000000076050000-0x00000000760CE000-memory.dmp
memory/244-60-0x0000000010000000-0x0000000010061000-memory.dmp
memory/244-56-0x0000000010000000-0x0000000010061000-memory.dmp
memory/244-58-0x0000000010000000-0x0000000010061000-memory.dmp
memory/244-145-0x0000000010000000-0x0000000010061000-memory.dmp
memory/244-71-0x0000000010000000-0x0000000010061000-memory.dmp
memory/244-194-0x0000000002410000-0x0000000002411000-memory.dmp
memory/244-146-0x00000000762E0000-0x0000000076391000-memory.dmp
memory/244-45-0x0000000002410000-0x0000000002411000-memory.dmp
memory/244-153-0x00000000743C0000-0x00000000743F3000-memory.dmp
memory/244-55-0x0000000076050000-0x00000000760CE000-memory.dmp
memory/244-159-0x0000000010000000-0x0000000010061000-memory.dmp
memory/244-85-0x0000000010000000-0x0000000010061000-memory.dmp
memory/244-86-0x00000000762E0000-0x0000000076391000-memory.dmp
memory/244-123-0x0000000010000000-0x0000000010061000-memory.dmp
memory/244-95-0x0000000075750000-0x00000000757D1000-memory.dmp
memory/244-97-0x0000000010000000-0x0000000010061000-memory.dmp
memory/244-98-0x00000000762E0000-0x0000000076391000-memory.dmp
memory/244-101-0x0000000075750000-0x00000000757D1000-memory.dmp
memory/244-103-0x0000000010000000-0x0000000010061000-memory.dmp
memory/244-104-0x00000000762E0000-0x0000000076391000-memory.dmp
memory/244-112-0x0000000010000000-0x0000000010061000-memory.dmp
memory/244-69-0x0000000075BB0000-0x0000000075BD5000-memory.dmp
memory/244-70-0x0000000010000000-0x0000000010061000-memory.dmp
memory/244-170-0x0000000075750000-0x00000000757D1000-memory.dmp
memory/244-177-0x0000000010000000-0x0000000010061000-memory.dmp
memory/244-92-0x00000000762E0000-0x0000000076391000-memory.dmp
memory/244-176-0x0000000010000000-0x0000000010061000-memory.dmp
memory/244-174-0x0000000075750000-0x00000000757D1000-memory.dmp
memory/244-173-0x0000000010000000-0x0000000010061000-memory.dmp
memory/244-172-0x0000000010000000-0x0000000010061000-memory.dmp
memory/244-166-0x00000000762E0000-0x0000000076391000-memory.dmp
memory/244-165-0x0000000010000000-0x0000000010061000-memory.dmp
memory/244-163-0x0000000010000000-0x0000000010061000-memory.dmp
memory/244-160-0x00000000762E0000-0x0000000076391000-memory.dmp
memory/244-155-0x0000000010000000-0x0000000010061000-memory.dmp
memory/244-152-0x0000000074DD0000-0x0000000074DF5000-memory.dmp
memory/244-115-0x0000000010000000-0x0000000010061000-memory.dmp
memory/244-151-0x0000000075750000-0x00000000757D1000-memory.dmp
memory/244-147-0x0000000075F60000-0x0000000076042000-memory.dmp
memory/244-140-0x0000000010000000-0x0000000010061000-memory.dmp
memory/244-138-0x0000000074DD0000-0x0000000074DF5000-memory.dmp
memory/244-137-0x0000000075750000-0x00000000757D1000-memory.dmp
memory/244-132-0x0000000010000000-0x0000000010061000-memory.dmp
memory/244-129-0x0000000010000000-0x0000000010061000-memory.dmp
memory/244-127-0x0000000010000000-0x0000000010061000-memory.dmp
memory/1692-207-0x0000000000960000-0x00000000015B5000-memory.dmp
memory/1692-277-0x0000000000960000-0x00000000015B5000-memory.dmp
memory/2348-1266-0x0000000000990000-0x00000000015E5000-memory.dmp
memory/2348-1269-0x0000000000990000-0x00000000015E5000-memory.dmp
memory/4276-191-0x00000000003F0000-0x0000000001045000-memory.dmp
memory/4276-208-0x00000000003F0000-0x0000000001045000-memory.dmp
memory/4276-41-0x00000000003F0000-0x0000000001045000-memory.dmp
memory/4980-32-0x0000000000400000-0x00000000004BF000-memory.dmp
memory/5640-4-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/5640-3-0x0000000002C10000-0x0000000002C1A000-memory.dmp
memory/5640-7-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/5640-23-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/5640-2-0x0000000002BD0000-0x0000000002BE2000-memory.dmp
memory/5640-24-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/5640-1-0x0000000000AA0000-0x0000000000AAA000-memory.dmp
memory/5640-29-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/5640-0-0x00007FFA3124F000-0x00007FFA31250000-memory.dmp
memory/5640-44-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/5732-1272-0x000000006EB40000-0x000000006EB8C000-memory.dmp
memory/5732-1267-0x0000000007800000-0x0000000007848000-memory.dmp
memory/5732-1255-0x0000000006290000-0x00000000062F6000-memory.dmp
memory/5732-1251-0x0000000006180000-0x00000000061A2000-memory.dmp
memory/5732-1250-0x0000000005AE0000-0x000000000612A000-memory.dmp
memory/5732-1249-0x0000000002FF0000-0x0000000003026000-memory.dmp
memory/5732-1258-0x0000000006300000-0x000000000665B000-memory.dmp
memory/5732-1259-0x0000000006820000-0x000000000683E000-memory.dmp
memory/5732-1260-0x0000000006860000-0x00000000068AC000-memory.dmp
memory/5732-1253-0x0000000006220000-0x0000000006286000-memory.dmp
memory/5732-1271-0x0000000007C40000-0x0000000007C76000-memory.dmp
memory/5732-1283-0x0000000009070000-0x000000000962A000-memory.dmp
memory/5732-1273-0x000000006ECF0000-0x000000006F04B000-memory.dmp
memory/5732-1276-0x0000000007C80000-0x0000000007CA0000-memory.dmp
memory/5732-1277-0x0000000007CA0000-0x0000000007D43000-memory.dmp
memory/5732-1278-0x0000000008430000-0x0000000008AAC000-memory.dmp
memory/5732-1279-0x0000000007DE0000-0x0000000007DFA000-memory.dmp
memory/5732-1280-0x0000000007E40000-0x0000000007E4A000-memory.dmp
memory/5732-1281-0x0000000007EF0000-0x0000000007F86000-memory.dmp
memory/5732-1282-0x00000000082F0000-0x0000000008312000-memory.dmp