Overview
overview
10Static
static
5SlayerRAT ...il.dll
windows10-2004-x64
1SlayerRAT ...am.dll
windows10-2004-x64
1SlayerRAT ...ch.dll
windows10-2004-x64
1SlayerRAT ...fm.dll
windows10-2004-x64
1SlayerRAT ...oc.dll
windows10-2004-x64
1SlayerRAT ...pw.dll
windows10-2004-x64
1SlayerRAT ...c2.dll
windows10-2004-x64
1SlayerRAT ...2x.exe
windows10-2004-x64
10SlayerRAT ...ub.exe
windows10-2004-x64
4SlayerRAT ...ad.exe
windows10-2004-x64
4Analysis
-
max time kernel
99s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2023 21:38
Static task
static1
Behavioral task
behavioral1
Sample
SlayerRAT v0.7.2 By X-Slayer/Mono.Cecil.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral2
Sample
SlayerRAT v0.7.2 By X-Slayer/Plugin/cam.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
SlayerRAT v0.7.2 By X-Slayer/Plugin/ch.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral4
Sample
SlayerRAT v0.7.2 By X-Slayer/Plugin/fm.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
SlayerRAT v0.7.2 By X-Slayer/Plugin/proc.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral6
Sample
SlayerRAT v0.7.2 By X-Slayer/Plugin/pw.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
SlayerRAT v0.7.2 By X-Slayer/Plugin/sc2.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral8
Sample
SlayerRAT v0.7.2 By X-Slayer/SlayerRAT v 0.7.2x.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
SlayerRAT v0.7.2 By X-Slayer/Stub.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral10
Sample
SlayerRAT v0.7.2 By X-Slayer/Stubdownload.exe
Resource
win10v2004-20230220-en
General
-
Target
SlayerRAT v0.7.2 By X-Slayer/Stub.exe
-
Size
52KB
-
MD5
657dd4a924f163a0eb584827437e512f
-
SHA1
118047b78043a6abd3c644e18dc65a63616c9aa8
-
SHA256
ef91e64b9cf910f90b8a075c87721bb46ab13cc6845697bb06c0754a98378728
-
SHA512
fbc8058bf05b1d5b89039a40ab11c36d0bfdfb3af65e39d32225857f1045ff33547624a4205957e7b5dce3abe0264f1a20098f73db5d7359971a9fd48025675b
-
SSDEEP
1536:jiBAendYsO5yQshvQjEBvS470xb2IZhVLWx:uasGXLWx
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
Processes:
dw20.exedescription ioc process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp dw20.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
dw20.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
dw20.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
dw20.exedescription pid process Token: SeRestorePrivilege 2188 dw20.exe Token: SeBackupPrivilege 2188 dw20.exe Token: SeBackupPrivilege 2188 dw20.exe Token: SeBackupPrivilege 2188 dw20.exe Token: SeBackupPrivilege 2188 dw20.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Stub.exedescription pid process target process PID 3144 wrote to memory of 2188 3144 Stub.exe dw20.exe PID 3144 wrote to memory of 2188 3144 Stub.exe dw20.exe PID 3144 wrote to memory of 2188 3144 Stub.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SlayerRAT v0.7.2 By X-Slayer\Stub.exe"C:\Users\Admin\AppData\Local\Temp\SlayerRAT v0.7.2 By X-Slayer\Stub.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8482⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2188
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3144-133-0x0000000000D30000-0x0000000000D40000-memory.dmpFilesize
64KB