Analysis
-
max time kernel
20s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
30-06-2024 17:48
Behavioral task
behavioral1
Sample
SLIMELOADER.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
SLIMELOADER.exe
Resource
win10v2004-20240508-en
General
-
Target
SLIMELOADER.exe
-
Size
19.1MB
-
MD5
039f81a11a351a2fdb41846f5fa11dbb
-
SHA1
6914bb55d8ab00f9c2e87979deb49e08ac1d7a15
-
SHA256
b0108278516de7de2e1af03443dce40071f80e43345488c457b94ca48647706a
-
SHA512
039bb5aaaad98fc5bdfd1cc508e140671253ba88bbd024375cac9de173843f8457a166e1719d3ed155599273cc3e87e8fe642dfde3d0e8915e8dfc342bb8cf01
-
SSDEEP
393216:zqPnLFXlrFWmQ6DOETgsvfGUgWVBE0d8vO4z8ksqc9Cm:2PLFXNFRQrETFHdPqsqI
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
SLIMELOADER.exepid process 1516 SLIMELOADER.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI22322\python310.dll upx behavioral1/memory/1516-123-0x000007FEF58E0000-0x000007FEF5D4E000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
SLIMELOADER.exedescription pid process target process PID 2232 wrote to memory of 1516 2232 SLIMELOADER.exe SLIMELOADER.exe PID 2232 wrote to memory of 1516 2232 SLIMELOADER.exe SLIMELOADER.exe PID 2232 wrote to memory of 1516 2232 SLIMELOADER.exe SLIMELOADER.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI22322\python310.dllFilesize
1.4MB
MD569d4f13fbaeee9b551c2d9a4a94d4458
SHA169540d8dfc0ee299a7ff6585018c7db0662aa629
SHA256801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046
SHA5128e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378
-
memory/1516-123-0x000007FEF58E0000-0x000007FEF5D4E000-memory.dmpFilesize
4.4MB