Overview
overview
10Static
static
5SlayerRAT ...il.dll
windows10-2004-x64
1SlayerRAT ...am.dll
windows10-2004-x64
1SlayerRAT ...ch.dll
windows10-2004-x64
1SlayerRAT ...fm.dll
windows10-2004-x64
1SlayerRAT ...oc.dll
windows10-2004-x64
1SlayerRAT ...pw.dll
windows10-2004-x64
1SlayerRAT ...c2.dll
windows10-2004-x64
1SlayerRAT ...2x.exe
windows10-2004-x64
10SlayerRAT ...ub.exe
windows10-2004-x64
4SlayerRAT ...ad.exe
windows10-2004-x64
4Analysis
-
max time kernel
96s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2023 21:38
Static task
static1
Behavioral task
behavioral1
Sample
SlayerRAT v0.7.2 By X-Slayer/Mono.Cecil.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral2
Sample
SlayerRAT v0.7.2 By X-Slayer/Plugin/cam.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
SlayerRAT v0.7.2 By X-Slayer/Plugin/ch.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral4
Sample
SlayerRAT v0.7.2 By X-Slayer/Plugin/fm.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
SlayerRAT v0.7.2 By X-Slayer/Plugin/proc.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral6
Sample
SlayerRAT v0.7.2 By X-Slayer/Plugin/pw.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
SlayerRAT v0.7.2 By X-Slayer/Plugin/sc2.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral8
Sample
SlayerRAT v0.7.2 By X-Slayer/SlayerRAT v 0.7.2x.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
SlayerRAT v0.7.2 By X-Slayer/Stub.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral10
Sample
SlayerRAT v0.7.2 By X-Slayer/Stubdownload.exe
Resource
win10v2004-20230220-en
General
-
Target
SlayerRAT v0.7.2 By X-Slayer/Stubdownload.exe
-
Size
18KB
-
MD5
b99ff62f03bf846189fe7a8b2ce6311e
-
SHA1
32a84ace75bc9ef68f0edfb303412bc93b5a3967
-
SHA256
b8a1f340423a7c8c32c364c61208b094fbd4ba05aee0dacb8d9d04584334dfc7
-
SHA512
06c5e15a4bf9ee483c2d62856fc72183b124c2c5e7ff07d6b35d0ad1355e9af6ee87785d874617b6119c22d2f6cac3a23da60465aad4b342255d2ba63c801254
-
SSDEEP
384:fvOrJRG3cJ4ev4KGa49O4RUx+LR2m/ti+FDo:3iRG3cJw5BBiyo
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
Processes:
dw20.exedescription ioc process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp dw20.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
dw20.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
dw20.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
dw20.exedescription pid process Token: SeRestorePrivilege 1608 dw20.exe Token: SeBackupPrivilege 1608 dw20.exe Token: SeBackupPrivilege 1608 dw20.exe Token: SeBackupPrivilege 1608 dw20.exe Token: SeBackupPrivilege 1608 dw20.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Stubdownload.exedescription pid process target process PID 2284 wrote to memory of 1608 2284 Stubdownload.exe dw20.exe PID 2284 wrote to memory of 1608 2284 Stubdownload.exe dw20.exe PID 2284 wrote to memory of 1608 2284 Stubdownload.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SlayerRAT v0.7.2 By X-Slayer\Stubdownload.exe"C:\Users\Admin\AppData\Local\Temp\SlayerRAT v0.7.2 By X-Slayer\Stubdownload.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8202⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:1608
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2284-133-0x0000000001950000-0x0000000001960000-memory.dmpFilesize
64KB