Malware analysis ZapretX.exe Malicious activity | ANY.RUN

Add for printing

File name:	ZapretX.exe
Full analysis:	https://app.any.run/tasks/1593663a-ef69-4704-9691-936028d2278a
Verdict:	Malicious activity
Threats:	Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. Malware Trends Tracker >>>
Analysis date:	June 02, 2026, 21:24:13
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	salatstealer stealer auto windivert-sys mal-driver susp-powershell golang upx
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32+ executable (GUI) x86-64, for MS Windows, 8 sections
MD5:	5C8DD6D1AC3404A24ACE5FA0DFAA9681
SHA1:	F17CFBE357ACE0D29A4C112FB9B039D7F4559A3B
SHA256:	AC7B66D754BB3AA871427118459C73AC7DCBF67709E022760F737A1C4C760BC4
SSDEEP:	98304:Gr6mtGB5wmE+HTT6te+IvoU/rfewsDprEhHy1CTF1kGV0TWoulCRf3Yhmzt/LbYp:28KGxMQmePRd

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 300 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 240 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
Google Chrome (133.0.6943.127)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Java(TM) SE Development Kit 25.0.2 (64-bit) (25.0.2.0)
Microsoft Edge (133.0.3065.92)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (136.0)
Mozilla Maintenance Service (136.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- SALATSTEALER has been found (auto)
  - ZapretX.exe (PID: 2956)
- Detects Cygwin installation
  - ZapretX.exe (PID: 2956)
- Malicious driver has been detected
  - ZapretX.exe (PID: 2956)
- SALATSTEALER mutex has been found
  - zapret.exe (PID: 7688)
- SALATSTEALER has been detected (YARA)
  - zapret.exe (PID: 7688)
SUSPICIOUS
- Reads Internet Explorer settings
  - ZapretX.exe (PID: 2956)
- Reads Microsoft Outlook installation path
  - ZapretX.exe (PID: 2956)
- Reads the date of Windows installation
  - ZapretX.exe (PID: 2956)
- Drops a system driver (possible attempt to evade defenses)
  - ZapretX.exe (PID: 2956)
- Starts CMD.EXE for commands execution
  - cmd.exe (PID: 9188)
- Executable content was dropped or overwritten
  - ZapretX.exe (PID: 2956)
- Executing commands from a ".bat" file
  - ZapretX.exe (PID: 2956)
- The executable file from the user directory is run by the CMD process
  - zapret.exe (PID: 7760)
- Application launched itself
  - zapret.exe (PID: 7760)
- Multiple wallet extension IDs have been found
  - zapret.exe (PID: 7688)
INFO
- There is functionality for taking screenshot (YARA)
  - ZapretX.exe (PID: 2956)
  - zapret.exe (PID: 7688)
- Reads security settings of Internet Explorer
  - ZapretX.exe (PID: 2956)
  - zapret.exe (PID: 7760)
  - Taskmgr.exe (PID: 7592)
- Checks supported languages
  - ZapretX.exe (PID: 2956)
  - zapret.exe (PID: 7760)
  - zapret.exe (PID: 7688)
- The sample compiled with english language support
  - ZapretX.exe (PID: 2956)
- Process checks computer location settings
  - ZapretX.exe (PID: 2956)
  - zapret.exe (PID: 7760)
- Create files in a temporary directory
  - ZapretX.exe (PID: 2956)
- Reads the computer name
  - ZapretX.exe (PID: 2956)
  - zapret.exe (PID: 7760)
  - zapret.exe (PID: 7688)
- Reads the machine GUID from the registry
  - zapret.exe (PID: 7760)
  - zapret.exe (PID: 7688)
- UPX packer has been detected
  - zapret.exe (PID: 7688)
- Found Base64 encoded access to Windows Defender via PowerShell (YARA)
  - zapret.exe (PID: 7688)
- Detects GO elliptic curve encryption (YARA)
  - zapret.exe (PID: 7688)
- Found Base64 encoded access to environment variables via PowerShell (YARA)
  - zapret.exe (PID: 7688)
- Application based on Golang
  - zapret.exe (PID: 7688)
- Manual execution by a user
  - Taskmgr.exe (PID: 7504)
  - Taskmgr.exe (PID: 7592)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Generic Win/DOS Executable (50)
.exe	\|	DOS Executable Generic (50)

EXIF

EXE

MachineType:	AMD AMD64
TimeStamp:	2026:02:01 18:16:26+00:00
ImageFileCharacteristics:	Executable, Large address aware
PEType:	PE32+
LinkerVersion:	14.44
CodeSize:	313344
InitializedDataSize:	166400
UninitializedDataSize:	-
EntryPoint:	0x33d00
OSVersion:	6
ImageVersion:	-
SubsystemVersion:	6
Subsystem:	Windows GUI

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

297

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

2956

"C:\Users\admin\AppData\Local\Temp\ZapretX.exe"

C:\Users\admin\AppData\Local\Temp\ZapretX.exe

explorer.exe

User:

admin

Integrity Level:

MEDIUM

Exit code:

Modules

Images
c:\users\admin\appdata\local\temp\zapretx.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

3084

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

7504

"C:\WINDOWS\system32\taskmgr.exe" /4

C:\Windows\System32\Taskmgr.exe

—

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Task Manager

Exit code:

3221226540

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll

7592

"C:\WINDOWS\system32\taskmgr.exe" /4

C:\Windows\System32\Taskmgr.exe

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Task Manager

Exit code:

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

7688

"C:\Users\admin\AppData\Local\Temp\zapret.exe"

C:\Users\admin\AppData\Local\Temp\zapret.exe

zapret.exe

User:

admin

Integrity Level:

HIGH

Exit code:

1073807364

Modules

Images
c:\users\admin\appdata\local\temp\zapret.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\bcryptprimitives.dll

7760

zapret.exe

C:\Users\admin\AppData\Local\Temp\zapret.exe

—

cmd.exe

User:

admin

Integrity Level:

MEDIUM

Exit code:

Modules

Images
c:\users\admin\appdata\local\temp\zapret.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\bcryptprimitives.dll

9188

C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\openglmodfix.bat" "

C:\Windows\System32\cmd.exe

—

ZapretX.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Command Processor

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll

Add for printing

Total events

3 356

Read events

3 343

Write events

Delete events

Modification events


(PID) Process:	(2956) ZapretX.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:	write	Name:	CachePrefix
Value:
(PID) Process:	(2956) ZapretX.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:	write	Name:	CachePrefix
Value: Cookie:
(PID) Process:	(2956) ZapretX.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:	write	Name:	CachePrefix
Value: Visited:
(PID) Process:	(2956) ZapretX.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\LowRegistry
Operation:	delete value	Name:	AddToFavoritesInitialSelection
Value:
(PID) Process:	(2956) ZapretX.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\LowRegistry
Operation:	delete value	Name:	AddToFeedsInitialSelection
Value:
(PID) Process:	(7592) Taskmgr.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\TaskManager
Operation:	delete value	Name:	Preferences
Value:
(PID) Process:	(7592) Taskmgr.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\TaskManager
Operation:	write	Name:	Preferences
Value: 0D00000060000000600000006800000068000000E3010000DC010000000001000000008000000080D8010080DF010080000100018900000034000000310300008C020000E80300000000000000000000000000000F000000010000000000000058AAE83FF67F00000000000000000000000000002E0100001E0000008990000000000000FF00000001015002000000000D0000000000000098AAE83FF67F00000000000000000000FFFFFFFF960000001E0000008B900000010000000000000000101001000000000300000000000000B0AAE83FF67F00000000000000000000FFFFFFFF780000001E0000008C900000020000000000000001021200000000000400000000000000C8AAE83FF67F00000000000000000000FFFFFFFF960000001E0000008D900000030000000000000000011001000000000200000000000000E8AAE83FF67F00000000000000000000FFFFFFFF320000001E0000008A90000004000000000000000008200100000000050000000000000000ABE83FF67F00000000000000000000FFFFFFFFC80000001E0000008E90000005000000000000000001100100000000060000000000000028ABE83FF67F00000000000000000000FFFFFFFF040100001E0000008F90000006000000000000000001100100000000070000000000000050ABE83FF67F00000000000000000000FFFFFFFF49000000490000009090000007000000000000000004250000000000080000000000000080AAE83FF67F00000000000000000000FFFFFFFF49000000490000009190000008000000000000000004250000000000090000000000000070ABE83FF67F00000000000000000000FFFFFFFF490000004900000092900000090000000000000000042508000000000A0000000000000088ABE83FF67F00000000000000000000FFFFFFFF4900000049000000939000000A0000000000000000042508000000000B00000000000000A8ABE83FF67F00000000000000000000FFFFFFFF490000004900000039A000000B0000000000000000042509000000001C00000000000000C8ABE83FF67F00000000000000000000FFFFFFFFC8000000490000003AA000000C0000000000000000011009000000001D00000000000000F0ABE83FF67F00000000000000000000FFFFFFFF64000000490000004CA000000D0000000000000000021508000000001E0000000000000010ACE83FF67F00000000000000000000FFFFFFFF64000000490000004DA000000E000000000000000002150800000000030000000A000000010000000000000058AAE83FF67F0000000000000000000000000000D70000001E0000008990000000000000FF00000001015002000000000400000000000000C8AAE83FF67F0000000000000000000001000000960000001E0000008D900000010000000000000001011000000000000300000000000000B0AAE83FF67F00000000000000000000FFFFFFFF640000001E0000008C900000020000000000000000021000000000000C0000000000000040ACE83FF67F0000000000000000000003000000640000001E00000094900000030000000000000001021000000000000D0000000000000068ACE83FF67F00000000000000000000FFFFFFFF640000001E00000095900000040000000000000000011001000000000E0000000000000090ACE83FF67F0000000000000000000005000000320000001E00000096900000050000000000000001042001000000000F00000000000000B8ACE83FF67F0000000000000000000006000000320000001E00000097900000060000000000000001042001000000001000000000000000D8ACE83FF67F0000000000000000000007000000460000001E00000098900000070000000000000001011001000000001100000000000000F8ACE83FF67F00000000000000000000FFFFFFFF640000001E0000009990000008000000000000000001100100000000060000000000000028ABE83FF67F0000000000000000000009000000040100001E0000008F9000000900000000000000010110010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000B000000010000000000000058AAE83FF67F0000000000000000000000000000D70000001E0000009E90000000000000FF0000000101500200000000120000000000000020ADE83FF67F00000000000000000000FFFFFFFF2D0000001E0000009B90000001000000000000000004200100000000140000000000000040ADE83FF67F00000000000000000000FFFFFFFF640000001E0000009D90000002000000000000000001100100000000130000000000000068ADE83FF67F00000000000000000000FFFFFFFF640000001E0000009C900000030000000000000000011001000000000300000000000000B0AAE83FF67F00000000000000000000FFFFFFFF640000001E0000008C90000004000000000000000102100000000000070000000000000050ABE83FF67F000000000000000000000500000049000000490000009090000005000000000000000104210000000000080000000000000080AAE83FF67F000000000000000000000600000049000000490000009190000006000000000000000104210000000000090000000000000070ABE83FF67F0000000000000000000007000000490000004900000092900000070000000000000001042108000000000A0000000000000088ABE83FF67F0000000000000000000008000000490000004900000093900000080000000000000001042108000000000B00000000000000A8ABE83FF67F0000000000000000000009000000490000004900000039A00000090000000000000001042109000000001C00000000000000C8ABE83FF67F000000000000000000000A00000064000000490000003AA000000A00000000000000000110090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000008000000010000000000000058AAE83FF67F0000000000000000000000000000C60000001E000000B090000000000000FF0000000101500200000000150000000000000088ADE83FF67F00000000000000000000FFFFFFFF6B0000001E000000B1900000010000000000000000042500000000001600000000000000B8ADE83FF67F00000000000000000000FFFFFFFF6B0000001E000000B2900000020000000000000000042500000000001800000000000000E0ADE83FF67F00000000000000000000FFFFFFFF6B0000001E000000B490000003000000000000000004250000000000170000000000000008AEE83FF67F00000000000000000000FFFFFFFF6B0000001E000000B390000004000000000000000004250000000000190000000000000040AEE83FF67F00000000000000000000FFFFFFFFA00000001E000000B5900000050000000000000000042001000000001A0000000000000070AEE83FF67F00000000000000000000FFFFFFFF7D0000001E000000B6900000060000000000000000042001000000001B00000000000000A0AEE83FF67F00000000000000000000FFFFFFFF7D0000001E000000B790000007000000000000000004200100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000DA00000000000000000000000000000000000000000000009D200000200000009100000064000000320000006400000050000000320000003200000028000000500000003C0000005000000050000000320000005000000050000000500000005000000050000000500000002800000050000000230000002300000023000000230000005000000050000000500000003200000032000000320000007800000078000000500000003C00000050000000500000009700000032000000780000003200000050000000500000005000000050000000000000000100000002000000030000000400000005000000060000000700000008000000090000000A0000000B0000000C0000000D0000000E0000000F000000100000001100000012000000130000001400000015000000160000001700000018000000190000001A0000001B0000001C0000001D0000001E0000001F000000200000002100000022000000230000002400000025000000260000002700000028000000290000002A0000002B0000002C00000000000000000000001F00000000000000B400000032000000D8000000640000006400000000000000000000000000000000000000000000000000000000000000000000000000000000000000DA000000000000000000000000000000000000009D200000200000009100000064000000320000009700000050000000320000003200000028000000500000003C000000500000005000000032000000500000005000000050000000500000005000000050000000500000002800000050000000230000002300000023000000230000005000000050000000500000003200000032000000320000007800000078000000500000003C0000005000000064000000780000003200000078000000780000003200000050000000500000005000000050000000C8000000000000000100000002000000030000000400000005000000060000000700000008000000090000000A0000000B0000000C0000000D0000000E0000000F000000100000001100000012000000130000001400000015000000160000001700000018000000190000001A0000001B0000001C0000001D0000001E0000001F000000200000002100000022000000230000002400000025000000260000002700000028000000290000002A0000002B0000002C0000002D0000002E0000002F00000000000000000000001F00000000000000B400000032000000D8000000640000006400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000002000000030000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000
(PID) Process:	(7592) Taskmgr.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run
Operation:	write	Name:	CCleaner Smart Cleaning
Value: 03000000388271EEFD58DA01
(PID) Process:	(7592) Taskmgr.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32
Operation:	write	Name:	SunJavaUpdateSched
Value: 030000006B0EA3ECFD58DA01
(PID) Process:	(7592) Taskmgr.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run
Operation:	write	Name:	OneDrive
Value: 03000000A31484EEAAD7D301

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
2956	ZapretX.exe	C:\Users\admin\AppData\Local\Temp\general.bat		text
		MD5:0AC556C85F0D739609285815922D1699	SHA256:C4F7F5708DE5323B55EA85E2EF140C43426352875593EAE1C0B94BFC769A4477
2956	ZapretX.exe	C:\Users\admin\AppData\Local\Temp\general (FAKE TLS AUTO ALT3).bat		text
		MD5:3CA95FD9B8109CC6B154D90988F01321	SHA256:7679E6F52CE95ED5C554DE668286A40F2AC9B845CC69A3619A313F10E43CEF46
2956	ZapretX.exe	C:\Users\admin\AppData\Local\Temp\general (FAKE TLS AUTO ALT).bat		text
		MD5:6545370A3D960F825186816B546B2BF2	SHA256:0A3744D9A42DD439B3576FA1D031D3D2EF6F93564BDB575A6AFB0C8A3A056AC2
2956	ZapretX.exe	C:\Users\admin\AppData\Local\Temp\general (FAKE TLS AUTO).bat		text
		MD5:4B09787D50D75067B8F7E9A95EF84748	SHA256:FA227E6C9527B093D8099018B059C798F89E2984140FD903613E598A71B76276
2956	ZapretX.exe	C:\Users\admin\AppData\Local\Temp\general (SIMPLE FAKE ALT2).bat		text
		MD5:19254D284A9643E034B0DC548BDB1DC4	SHA256:7AD976EC3968A3DCE1E0B54B81E77EC1F925A78EB31930DEEAA8359B23201F1A
2956	ZapretX.exe	C:\Users\admin\AppData\Local\Temp\general (FAKE TLS AUTO ALT2).bat		text
		MD5:1CE3CAA8F2FFB279C6435FF245DB45CF	SHA256:1E9A3D1FE257F10C9355DBEF5A45CCA9765B57E2CE1F549225C68C86FF1C8D8B
2956	ZapretX.exe	C:\Users\admin\AppData\Local\Temp\bin\quic_initial_www_google_com.bin		binary
		MD5:312526D39958D89B1F8AB67789AB985F	SHA256:F4589C57749F956BB30538197A521D7005F8B0A8723B4707E72405E51DDAC50A
2956	ZapretX.exe	C:\Users\admin\AppData\Local\Temp\general (SIMPLE FAKE ALT).bat		text
		MD5:6697B88F229FFF35F241B32DE084314F	SHA256:B9F847180EF1DA5908870221ACF03A469FC0DCA87DADF7404350893D24CA02F2
2956	ZapretX.exe	C:\Users\admin\AppData\Local\Temp\general (SIMPLE FAKE).bat		text
		MD5:B37665DF1F26CC7831732ECA575A01E5	SHA256:3D8BFBF6758E41C12D3E4975C451E20A92A0CF3A429E3C283D686B92172B2732
2956	ZapretX.exe	C:\Users\admin\AppData\Local\Temp\openglmodfix.bat		text
		MD5:49F438F1A64B2325B75D03791D3695A1	SHA256:FC72C5013E6EE881597310C0EC36A4B4F181D4AB2053C229AF129BF466CE6E38

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

100

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5276	MoUsoCoreWorker.exe	GET	304	48.209.138.168:443	https://settings-win.data.microsoft.com/settings/v3.0/wsd/muse?ProcessorClockSpeed=3094&FlightIds=&UpdateOfferedDays=4294967295&BranchReadinessLevel=CB&OEMManufacturerName=DELL&IsCloudDomainJoined=0&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&sku=48&ActivationChannel=Retail&AttrDataVer=186&IsMDMEnrolled=0&ProcessorCores=6&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&TotalPhysicalRAM=6144&PrimaryDiskType=4294967295&FlightingBranchName=&ChassisTypeId=1&OEMModelNumber=DELL&SystemVolumeTotalCapacity=260281&sampleId=95271487&deviceClass=Windows.Desktop&App=muse&DisableDualScan=0&AppVer=10.0&OEMSubModel=J5CR&locale=en-US&IsAlwaysOnAlwaysConnectedCapable=0&ms=0&DefaultUserRegion=244&UpdateServiceUrl=http%3A%2F%2Fneverupdatewindows10.com&osVer=10.0.19045.4046.amd64fre.vb_release.191206-1406&os=windows&deviceId=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&DeferQualityUpdatePeriodInDays=0&ring=Retail&DeferFeatureUpdatePeriodInDays=30	US	—	—	whitelisted
9076	SIHClient.exe	GET	304	135.233.95.144:443	https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL	US	—	—	whitelisted
—	—	GET	200	23.11.40.157:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAjTxtAB8my1oj8MfWpz%2F7Y%3D	NL	binary	314 b	whitelisted
—	—	GET	200	204.79.197.203:80	http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQ3L3%2F%2Fa6ADK8NraY2GXzVaYrHG4AQUb6t%2B2v%2BXQ3LsO2d33oJhNYhHQoUCEzMAAAAFUWohyJgUzPcAAAAAAAU%3D	US	binary	959 b	whitelisted
9076	SIHClient.exe	GET	200	74.179.77.164:443	https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping	US	—	—	whitelisted
9076	SIHClient.exe	GET	200	135.233.95.144:443	https://slscr.update.microsoft.com/sls/ping	US	—	—	whitelisted
9076	SIHClient.exe	GET	304	135.233.95.144:443	https://slscr.update.microsoft.com/SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL	US	—	—	whitelisted
9108	svchost.exe	POST	200	40.126.31.129:443	https://login.live.com/RST2.srf	US	xml	1.24 Kb	whitelisted
9108	svchost.exe	POST	400	40.126.31.129:443	https://login.live.com/ppsecure/deviceaddcredential.srf	US	text	204 b	whitelisted
9108	svchost.exe	POST	400	40.126.31.129:443	https://login.live.com/ppsecure/deviceaddcredential.srf	US	text	204 b	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	Not routed	—	whitelisted
5276	MoUsoCoreWorker.exe	48.209.138.168:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
—	—	48.192.1.65:443	activation-v2.sls.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
5532	SearchApp.exe	184.86.251.27:443	www.bing.com	AKAMAI-ASN1	NL	whitelisted
8388	svchost.exe	48.209.138.168:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
—	—	23.11.40.157:80	ocsp.digicert.com	AKAMAI-AMS	NL	whitelisted
—	—	204.79.197.203:80	oneocsp.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
4	System	192.168.100.255:138	—	Not routed	—	whitelisted
3428	svchost.exe	172.211.123.248:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
9108	svchost.exe	40.126.31.129:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted

DNS requests

Domain	IP	Reputation
activation-v2.sls.microsoft.com	48.192.1.65	whitelisted
www.bing.com	184.86.251.27 184.86.251.7 184.86.251.21 184.86.251.9 2.16.241.205 2.16.241.218 2.16.241.201 184.86.251.13	whitelisted
ocsp.digicert.com	23.11.40.157	whitelisted
oneocsp.microsoft.com	204.79.197.203	whitelisted
google.com	142.251.13.139 142.251.13.100 142.251.13.138 142.251.13.113 142.251.13.102 142.251.13.101	whitelisted
client.wns.windows.com	172.211.123.248	whitelisted
login.live.com	40.126.31.129 40.126.31.128 20.190.159.68 20.190.159.4 40.126.31.131 40.126.31.69 20.190.159.73 20.190.159.71 20.190.160.4 40.126.32.133 40.126.32.140 40.126.32.136 40.126.32.74 40.126.32.76 20.190.160.2 20.190.160.132	whitelisted
settings-win.data.microsoft.com	48.209.6.48 48.209.138.168 48.209.133.15	whitelisted
crl.microsoft.com	2.21.20.138 2.21.20.137	whitelisted
www.microsoft.com	88.221.169.152	whitelisted

Threats

PID	Process	Class	Message
8388	svchost.exe	Unknown Traffic	ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
2232	svchost.exe	Misc activity	INFO [ANY.RUN] Google DNS-over-HTTPS service requested (dns. google)

Add for printing

No debug info

General Info

ZapretX.exe

5C8DD6D1AC3404A24ACE5FA0DFAA9681

F17CFBE357ACE0D29A4C112FB9B039D7F4559A3B

AC7B66D754BB3AA871427118459C73AC7DCBF67709E022760F737A1C4C760BC4

98304:Gr6mtGB5wmE+HTT6te+IvoU/rfewsDprEhHy1CTF1kGV0TWoulCRf3Yhmzt/LbYp:28KGxMQmePRd

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SALATSTEALER has been found (auto)

Detects Cygwin installation

Malicious driver has been detected

SALATSTEALER mutex has been found

SALATSTEALER has been detected (YARA)

SUSPICIOUS

Reads Internet Explorer settings

Reads Microsoft Outlook installation path

Reads the date of Windows installation

Drops a system driver (possible attempt to evade defenses)

Starts CMD.EXE for commands execution

Executable content was dropped or overwritten

Executing commands from a ".bat" file

The executable file from the user directory is run by the CMD process

Application launched itself

Multiple wallet extension IDs have been found

INFO

There is functionality for taking screenshot (YARA)

Reads security settings of Internet Explorer

Checks supported languages

The sample compiled with english language support

Process checks computer location settings

Create files in a temporary directory

Reads the computer name

Reads the machine GUID from the registry

UPX packer has been detected

Found Base64 encoded access to Windows Defender via PowerShell (YARA)

Detects GO elliptic curve encryption (YARA)

Found Base64 encoded access to environment variables via PowerShell (YARA)

Application based on Golang

Manual execution by a user

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings