slothfulmedia | 6b16bcb53be07c25eb852a41dc0fd4d3eea9b5004e85de94b0a811060864d630

Analysis

Target

64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273.exe
Size

115KB
MD5

448838b2a60484ee78c2198f2c0c9c85
SHA1

f2c43a01cabaa694228f5354ea8c6bcf3b7a49b3
SHA256

64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273
SHA512

9e532af06e5f4764529211e8c5c749baa7b01c72f11b603218c3c08d70cf1e732f8d9d81ec257ca247aaa96d1502150a2f402b1b3914780b6344222b007dd53f

Score

10^/10

SlothfulMedia
SlothfulMedia is a malware used by sophisticated threat actors that drops a remote access tool.
trojan slothfulmedia

SlothfulMedia Main Payload 3 IoCs

Executes dropped EXE 2 IoCs

pid	Process
1244	mediaplayer.exe
1432	MwIJG.exe

Deletes itself 1 IoCs

pid	Process
1432	MwIJG.exe

Loads dropped DLL 3 IoCs

pid	Process
1684	64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273.exe
1684	64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273.exe
1684	64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1244	1684	64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273.exe	29
PID 1684 wrote to memory of 1244	1684	64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273.exe	29
PID 1684 wrote to memory of 1244	1684	64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273.exe	29
PID 1684 wrote to memory of 1244	1684	64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273.exe	29
PID 1684 wrote to memory of 1432	1684	64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273.exe	30
PID 1684 wrote to memory of 1432	1684	64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273.exe	30
PID 1684 wrote to memory of 1432	1684	64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273.exe	30
PID 1684 wrote to memory of 1432	1684	64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273.exe	30

C:\Users\Admin\AppData\Local\Temp\64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273.exe
"C:\Users\Admin\AppData\Local\Temp\64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Users\Admin\AppData\Roaming\Media\mediaplayer.exe
  "C:\Users\Admin\AppData\Roaming\Media\mediaplayer.exe"
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Users\Admin\AppData\Local\Temp\MwIJG.exe
  "C:\Users\Admin\AppData\Local\Temp\MwIJG.exe"
  2⤵
  - Executes dropped EXE
  - Deletes itself
  PID:1432

memory/1036-10-0x000007FEF7080000-0x000007FEF72FA000-memory.dmp

Filesize
2.5MB

Download