slui[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

slui.exe
Size

628KB
MD5

594112d4827c2e5cf8c4a58f1d89e520
SHA1

f623af21716bb921fae98877e5547e297e60b52d
SHA256

aede13535c1484f2df65ebe853429942ef66056af05ce625e0ed08731fbce36d
SHA512

4e78cd4c528dad6d8131b6924407313bd1f4d5071e7b7b49eeae31b7a1242ba76d7b3b5240530daa30657509303f8dc7617f4dd352fb02d5f3c33863244cc6fb
SSDEEP

12288:z0e5rgvRic7BMHd5o1ZQCeedo4hNhDdV8YvUyq3nyR:zjrgv5BMHyZQCrdouNbvC3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
slui.exe

Files

slui.exe
.exe windows:10 windows x64 arch:x64

301dd45e39bda479c0b8ef2f54eff747

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

slui.pdb

Imports

advapi32

EventWriteTransfer
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyW
RegDeleteKeyW
RegCreateKeyExW
EventRegister
EventUnregister
CheckTokenMembership
AllocateAndInitializeSid
FreeSid

kernel32

HeapFree
GetModuleHandleExW
CloseHandle
HeapAlloc
GetProcAddress
GetProcessHeap
GetLastError
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
FileTimeToSystemTime
DeleteCriticalSection
EncodePointer
GetCurrentThreadId
RaiseException
WaitForSingleObject
ReleaseSemaphore
SetEvent
Sleep
FreeLibrary
GetSystemDirectoryW
GetFileAttributesW
RegisterApplicationRestart
HeapSetInformation
GetCommandLineW
CreateEventW
DecodePointer
GetModuleFileNameW
VirtualQuery
LocalFree
ExpandEnvironmentStringsW
SystemTimeToFileTime
GetSystemTime
LockResource
LoadResource
FindResourceExW
FormatMessageW
LocalAlloc
LoadLibraryExW
GetCurrentProcess
SetLastError
CheckElevationEnabled
WaitForMultipleObjects
CreateSemaphoreW
FreeLibraryAndExitThread
GetCurrentThread
SetThreadPriority
CreateThread
GetThreadPriority
GetProcessAffinityMask
GetUserDefaultLCID

user32

AllowSetForegroundWindow
LoadCursorW
CallWindowProcW
GetWindowLongPtrW
DestroyWindow
SetWindowLongPtrW
MessageBoxW
SetForegroundWindow
DefWindowProcW
CreateWindowExW
GetDesktopWindow
RegisterClassW
GetWindowLongW
SetCursor

msvcrt

_lock
memset
_wcsicmp
_commode
_initterm
__setusermatherr
_onexit
_cexit
memmove
memcpy
memcmp
?terminate@@YAXXZ
__dllonexit
_unlock
__C_specific_handler
_acmdln
_exit
exit
__set_app_type
_ismbblead
_fmode
_purecall
towupper
_amsg_exit
_XcptFilter
_waccess_s
wcschr
wcsstr
_wtoi
swscanf_s
_vsnwprintf
__getmainargs
wcscmp

api-ms-win-core-com-l1-1-0

CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
StringFromGUID2
CoTaskMemAlloc
CoTaskMemFree
CoResumeClassObjects
CoRegisterClassObject
CoRevokeClassObject
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoAddRefServerProcess
CoSuspendClassObjects
CoReleaseServerProcess
CoUninitialize

oleaut32

SysFreeString
LoadTypeLi
SysAllocString
UnRegisterTypeLi
RegisterTypeLi
SystemTimeToVariantTime
VariantTimeToSystemTime

rpcrt4

RpcStringFreeW
I_RpcMapWin32Status
UuidToStringW

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW
TerminateProcess
GetCurrentProcessId

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
ReleaseSRWLockExclusive

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
SleepConditionVariableSRW

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy

winbrand

BrandingLoadString

ntdll

WinSqmSetDWORD

ole32

MkParseDisplayName
CreateBindCtx

shell32

CommandLineToArgvW
ShellExecuteExW

sppc

SLClose
SLOpen
SLpIsCurrentInstalledProductKeyDefaultKey
SLGetGenuineInformation

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW

slc

SLConsumeWindowsRight

Sections

.text
Size: 344KB - Virtual size: 341KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 228KB - Virtual size: 224KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 444B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

301dd45e39bda479c0b8ef2f54eff747

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

msvcrt

api-ms-win-core-com-l1-1-0

oleaut32

rpcrt4

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-processthreads-l1-1-1

winbrand

ntdll

ole32

shell32

sppc

wtsapi32

slc

Sections

.text Size: 344KB - Virtual size: 341KB

.rdata Size: 36KB - Virtual size: 32KB

.data Size: 4KB - Virtual size: 3KB

.pdata Size: 8KB - Virtual size: 6KB

.rsrc Size: 228KB - Virtual size: 224KB

.reloc Size: 4KB - Virtual size: 444B

.text
Size: 344KB - Virtual size: 341KB

.rdata
Size: 36KB - Virtual size: 32KB

.data
Size: 4KB - Virtual size: 3KB

.pdata
Size: 8KB - Virtual size: 6KB

.rsrc
Size: 228KB - Virtual size: 224KB

.reloc
Size: 4KB - Virtual size: 444B