salatstealer | db6c50bff6d12df001cec8103c85f883b248b9aa3d64cab52705cb49a63288e8

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/10/2026, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
28326d197372779076588602146ac0c45b5a25f0781e7cf3f437d4f2d19765b6.exe
Size 12.0MB
Sample261031-aee2bsht2j
SHA256 db6c50bff6d12df001cec8103c85f883b248b9aa3d64cab52705cb49a63288e8
MD5 d811a767b7e5d3acc743d4543692202f
SHA1 8ce33ddbe98aba6a89a28eab9fe29dcf500377f8
SHA512 9c64729a2c65957cf96ade601878e8133e80c19b09ae5a642be157323627b2ce9516e9e04b2ebdbd2021e3ba6cd8ee202e9ff198ad4ec5829c440c573121f8df
SSDEEP 98304:5kojYvrFhcCpkyke+V9Ye4S3HVdkEEO/:VYD3k1v0eT/EO/
TLSH
T197C65C11FACB54F6F9036831416BB27F23355D048B28DB9BEB183B6AF877691187A305
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery salatstealer stealer

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c6a1-3.dat	family_salatstealer

Executes a file named after a Windows system binary 1 TTPs 2 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Google\SecurityHealthService.exe	28326d197372779076588602146ac0c45b5a25f0781e7cf3f437d4f2d19765b6.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Google\SecurityHealthService.exe	SecurityHealthService.exe

Executes dropped EXE 1 IoCs

pid	Process
952	SecurityHealthService.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Media Player\smss.exe	28326d197372779076588602146ac0c45b5a25f0781e7cf3f437d4f2d19765b6.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\a9a3d87b-5e77-3d96-b3bb-2eab7e167b5e	28326d197372779076588602146ac0c45b5a25f0781e7cf3f437d4f2d19765b6.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 3 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	28326d197372779076588602146ac0c45b5a25f0781e7cf3f437d4f2d19765b6.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	28326d197372779076588602146ac0c45b5a25f0781e7cf3f437d4f2d19765b6.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityHealthService.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	28326d197372779076588602146ac0c45b5a25f0781e7cf3f437d4f2d19765b6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityHealthService.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3796	28326d197372779076588602146ac0c45b5a25f0781e7cf3f437d4f2d19765b6.exe
3796	28326d197372779076588602146ac0c45b5a25f0781e7cf3f437d4f2d19765b6.exe
3796	28326d197372779076588602146ac0c45b5a25f0781e7cf3f437d4f2d19765b6.exe
3796	28326d197372779076588602146ac0c45b5a25f0781e7cf3f437d4f2d19765b6.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 952	3796	28326d197372779076588602146ac0c45b5a25f0781e7cf3f437d4f2d19765b6.exe	90

C:\Users\Admin\AppData\Local\Temp\28326d197372779076588602146ac0c45b5a25f0781e7cf3f437d4f2d19765b6.exe
"C:\Users\Admin\AppData\Local\Temp\28326d197372779076588602146ac0c45b5a25f0781e7cf3f437d4f2d19765b6.exe"
1⤵
- Executes a file named after a Windows system binary
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Users\Admin\AppData\Local\Google\SecurityHealthService.exe
  C:\Users\Admin\AppData\Local\Google\SecurityHealthService.exe
  2⤵
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

services.exe

Path C:\Users\Admin\AppData\Local\PeerDistRepub\services.exe
Size 12.0MB
SHA256 db6c50bff6d12df001cec8103c85f883b248b9aa3d64cab52705cb49a63288e8
MD5 d811a767b7e5d3acc743d4543692202f
SHA1 8ce33ddbe98aba6a89a28eab9fe29dcf500377f8
SHA512 9c64729a2c65957cf96ade601878e8133e80c19b09ae5a642be157323627b2ce9516e9e04b2ebdbd2021e3ba6cd8ee202e9ff198ad4ec5829c440c573121f8df
SSDEEP 98304:5kojYvrFhcCpkyke+V9Ye4S3HVdkEEO/:VYD3k1v0eT/EO/
TLSH
T197C65C11FACB54F6F9036831416BB27F23355D048B28DB9BEB183B6AF877691187A305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download