0ce366b7463e6b3c9d389d1c799c9b64219e71112f13568e5e16efbfbebf9da9.exe

Summary

Methodology

The sample was executed in an isolated, instrumented Windows VM (host-only networking with emulated C2 responses) while process, file-system, registry and network activity were recorded. The verdict is derived by correlating observed runtime behaviour with static indicators. No sample binary was uploaded or redistributed.

Child processes (3)

• C:\Users\lab\AppData\Local\Temp\KRX Client.exe
• C:\Users\lab\AppData\Local\Temp\ddnet.exe
• C:\argus-vr-agent\quarantine\0ce366b7463e6b3c9d389d1c799c9b64219e71112f13568e5e16efbfbebf9da9_extracted\0ce366b7463e6b3c9d389d1c799c9b64219e71112f13568e5e16efbfbebf9da9.exe

Dropped files (2)

• C:\Users\lab\AppData\Local\Temp\ddnet.exe
• C:\Users\lab\AppData\Local\Temp\KRX Client.exe

MITRE ATT&CK

Indicators of Compromise (defanged)

• c85212d823d9412cb8eeec70e5145947
• e728a6a5c5b29ea0e1355639a1ee577edf2eb443
• C:\Users\lab\AppData\Local\Temp\KRX Client.exe
• C:\Users\lab\AppData\Local\Temp\ddnet.exe

IOCs (JSON)Copy

{
  "sha256": "0ce366b7463e6b3c9d389d1c799c9b64219e71112f13568e5e16efbfbebf9da9",
  "family": "SalatStealer",
  "verdict": "suspicious",
  "confidence": 95,
  "signals": [
    "executable-drop",
    "child-processes",
    "packed"
  ],
  "attack": [
    "T1105",
    "T1059",
    "T1027.002"
  ],
  "dropped": [
    "C:\\Users\\lab\\AppData\\Local\\Temp\\ddnet.exe",
    "C:\\Users\\lab\\AppData\\Local\\Temp\\KRX Client.exe"
  ],
  "children": [
    "C:\\Users\\lab\\AppData\\Local\\Temp\\KRX Client.exe",
    "C:\\Users\\lab\\AppData\\Local\\Temp\\ddnet.exe",
    "C:\\argus-vr-agent\\quarantine\\0ce366b7463e6b3c9d389d1c799c9b64219e71112f13568e5e16efbfbebf9da9_extracted\\0ce366b7463e6b3c9d389d1c799c9b64219e71112f13568e5e16efbfbebf9da9.exe"
  ]
}