Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 10:48
General
- Target v2raytun_windows.exe
- Size 67.1MB
- Sample261102-mwfemsbs9r
- SHA256 8a875738744a3defb3091b1bca62f365d2570d00fc5584e2a78e229a95badaa8
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 3 IoCs
- Executes dropped EXE 9 IoCs
- Loads dropped DLL 14 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 5 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies registry class 7 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\v2raytun_windows.exe"C:\Users\Admin\AppData\Local\Temp\v2raytun_windows.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\GBND2\v2raytun_windows.exe_4311015\app\v2RayTun-windows-x64-v3.10.15.exe"C:\Users\Admin\AppData\Local\GBND2\v2raytun_windows.exe_4311015\app\v2RayTun-windows-x64-v3.10.15.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-CU01N.tmp\v2RayTun-windows-x64-v3.10.15.tmp"C:\Users\Admin\AppData\Local\Temp\is-CU01N.tmp\v2RayTun-windows-x64-v3.10.15.tmp" /SL5="$501B6,62211102,726528,C:\Users\Admin\AppData\Local\GBND2\v2raytun_windows.exe_4311015\app\v2RayTun-windows-x64-v3.10.15.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-VKCMO.tmp\VC_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\is-VKCMO.tmp\VC_redist.x64.exe" /install /quiet /norestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{F1179074-1120-4AB9-8662-0EE309D9778F}\.cr\VC_redist.x64.exe"C:\Windows\Temp\{F1179074-1120-4AB9-8662-0EE309D9778F}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-VKCMO.tmp\VC_redist.x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /install /quiet /norestart5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{14B3FB5B-6BE2-4718-A8C2-9C2BCC8F2ED1}\.be\VC_redist.x64.exe"C:\Windows\Temp\{14B3FB5B-6BE2-4718-A8C2-9C2BCC8F2ED1}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{91CA367C-C1CC-428C-A7E6-13EDA35F1372} {689EE0CB-E7AD-4CFF-9AF4-EF3B764976A8} 59326⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files (x86)\v2RayTun\v2RayTun.exe"C:\Program Files (x86)\v2RayTun\v2RayTun.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\v2RayTun\xraycore.exeC:\Users\Admin\AppData\Local\Temp\v2RayTun\xraycore.exe version5⤵
- Executes dropped EXE
-
-
-
-
-
C:\Users\Admin\AppData\Local\GBND2\v2raytun_windows.exe_4311015\payload\gbnd_monetize_payload.exe"C:\Users\Admin\AppData\Local\GBND2\v2raytun_windows.exe_4311015\payload\gbnd_monetize_payload.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\MSBuild\svchost.exe"C:\Program Files (x86)\MSBuild\svchost.exe"3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
app.so
FontManifest.json
NativeAssetsManifest.json
geoip.dat
geosite.dat
xraycore.exe
Inter-Black.ttf
Inter-BlackItalic.ttf
Inter-Bold.ttf
Inter-BoldItalic.ttf
Inter-ExtraBold.ttf
Inter-ExtraBoldItalic.ttf
Inter-ExtraLight.ttf
Inter-ExtraLightItalic.ttf
Inter-Italic.ttf
Inter-Light.ttf
Inter-LightItalic.ttf
Inter-Medium.ttf
Inter-MediumItalic.ttf
Inter-Regular.ttf
Inter-SemiBold.ttf
Inter-SemiBoldItalic.ttf
Inter-Thin.ttf
Inter-ThinItalic.ttf
icon.ico
MaterialIcons-Regular.otf
is-5RJO4.tmp
is-6RN8H.tmp
is-H0UNG.tmp
is-N7I9V.tmp
is-RADPD.tmp
is-RKEF7.tmp
is-TGEHF.tmp
icudtl.dat
file_selector_windows_plugin.dll
flutter_windows.dll
local_notifier_plugin.dll
screen_retriever_windows_plugin.dll
tray_manager_plugin.dll
url_launcher_windows_plugin.dll
v2RayTun.exe
window_manager_plugin.dll
gbnd_monetize_payload.exe
v2RayTun-windows-x64-v3.10.15.tmp
ISSkinU.dll
Recall 6.6 Basic.cjstyles
VC_redist.x64.exe
awgcore.dll
libcore.dll
libhost.exe
wintun.dll
logo.png
wixstdba.dll
VC_redist.x64.exe
memory/852-1246-0x0000000000D20000-0x0000000001975000-memory.dmp
memory/852-1249-0x0000000000D20000-0x0000000001975000-memory.dmp
memory/2696-32-0x0000000000400000-0x00000000004BF000-memory.dmp
memory/3220-0-0x0000000000340000-0x000000000034A000-memory.dmp
memory/3220-25-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp
memory/3220-44-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp
memory/3220-24-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp
memory/3220-23-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp
memory/3220-4-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp
memory/3220-22-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp
memory/3220-1-0x00007FF99BCFF000-0x00007FF99BD00000-memory.dmp
memory/3220-3-0x00000000023B0000-0x00000000023BA000-memory.dmp
memory/3220-2-0x0000000002370000-0x0000000002382000-memory.dmp
memory/4304-1247-0x00000000007D0000-0x0000000001425000-memory.dmp
memory/4304-41-0x00000000007D0000-0x0000000001425000-memory.dmp
memory/4304-190-0x00000000007D0000-0x0000000001425000-memory.dmp
memory/5788-60-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5788-109-0x0000000075410000-0x0000000075491000-memory.dmp
memory/5788-103-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5788-101-0x0000000075410000-0x0000000075491000-memory.dmp
memory/5788-97-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5788-95-0x0000000075410000-0x0000000075491000-memory.dmp
memory/5788-92-0x00000000776F0000-0x00000000777A1000-memory.dmp
memory/5788-91-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5788-89-0x0000000075410000-0x0000000075491000-memory.dmp
memory/5788-85-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5788-165-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5788-194-0x0000000002330000-0x0000000002331000-memory.dmp
memory/5788-119-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5788-123-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5788-74-0x0000000075EE0000-0x0000000076035000-memory.dmp
memory/5788-75-0x00000000754B0000-0x00000000756D7000-memory.dmp
memory/5788-76-0x0000000073E90000-0x0000000073FB8000-memory.dmp
memory/5788-78-0x00000000776F0000-0x00000000777A1000-memory.dmp
memory/5788-79-0x0000000076D00000-0x0000000076DE2000-memory.dmp
memory/5788-80-0x00000000761F0000-0x00000000767CC000-memory.dmp
memory/5788-127-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5788-129-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5788-133-0x00000000776F0000-0x00000000777A1000-memory.dmp
memory/5788-138-0x0000000074A40000-0x0000000074A65000-memory.dmp
memory/5788-140-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5788-143-0x0000000075410000-0x0000000075491000-memory.dmp
memory/5788-146-0x00000000776F0000-0x00000000777A1000-memory.dmp
memory/5788-145-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5788-82-0x00000000754B0000-0x00000000756D7000-memory.dmp
memory/5788-152-0x0000000074A40000-0x0000000074A65000-memory.dmp
memory/5788-153-0x0000000074080000-0x00000000740B3000-memory.dmp
memory/5788-155-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5788-151-0x0000000075410000-0x0000000075491000-memory.dmp
memory/5788-159-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5788-160-0x00000000776F0000-0x00000000777A1000-memory.dmp
memory/5788-163-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5788-84-0x0000000073E90000-0x0000000073FB8000-memory.dmp
memory/5788-83-0x0000000075410000-0x0000000075491000-memory.dmp
memory/5788-137-0x0000000075410000-0x0000000075491000-memory.dmp
memory/5788-81-0x0000000075EE0000-0x0000000076035000-memory.dmp
memory/5788-132-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5788-130-0x0000000075410000-0x0000000075491000-memory.dmp
memory/5788-77-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5788-68-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5788-69-0x00000000773B0000-0x00000000773D5000-memory.dmp
memory/5788-57-0x00000000772B0000-0x000000007732E000-memory.dmp
memory/5788-56-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5788-58-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5788-61-0x00000000772B0000-0x000000007732E000-memory.dmp
memory/5788-59-0x00000000772B0000-0x000000007732E000-memory.dmp
memory/5788-63-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5788-64-0x00000000772B0000-0x000000007732E000-memory.dmp
memory/5788-62-0x00000000773B0000-0x00000000773D5000-memory.dmp
memory/5788-65-0x00000000773B0000-0x00000000773D5000-memory.dmp
memory/5788-66-0x0000000074080000-0x00000000740B3000-memory.dmp
memory/5788-67-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5788-110-0x0000000074A40000-0x0000000074A65000-memory.dmp
memory/5788-112-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5788-115-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5788-73-0x00000000761F0000-0x00000000767CC000-memory.dmp
memory/5788-72-0x00000000776F0000-0x00000000777A1000-memory.dmp
memory/5788-70-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5788-71-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5788-55-0x00000000772B0000-0x000000007732E000-memory.dmp
memory/5788-45-0x0000000002330000-0x0000000002331000-memory.dmp