<�P ${c|&N��fre�IIw^i����-7�,w3��`r���\�F?��ZS���0�i��J�W"O�B�~F�Gs]���u�qϸh�ݙ���%e[1�7?�0�VJl���Q�j����,�����R��L%ߡ���1^�'���[��?!=n����)�l��%�r���Lb GЂܺqY���R���X����@������* �u�7���{�M[��>�rHyT-����D�=���;|e%��Ԭ�8�E��/�{ �Aq)�� mGI����7�Jr6�.��2�L��9�Y y;G�{�+���k8�/���D� N>�eP�U5uI�*>�БۻDj̣r�)�#N�&��t��]��m�I��!�,G��ئ;���@n+ ��S`KԚ2̿:���`��]�\%~_�O�ܺ)"��xZ��Hq^���}����ա=EV$���B���3ր0�M7��-���2��Ӯ�_�2Q!(SKE��6g��30#����zu�qe# ��'gdg��\pQU�y���}C��J1�r�^b�0o��镳4�M��*`�f��1�d�P���ie�ڝ��/��{����z��݇���2��+���Gyv�u�X�����������b�K��Uᕷhjq)��F��Ui��f$����iA�Y/��L*�I]��y��{G"%~=�CW��:�!��/���(�2�%�u��7{ʌo���P��=Ӫ��Ē�.��偗ӽ�s���nK�(~�}0H$��\X9��A"5��h(��͎� ��G�-P��c$&ZGl�AI؆*:�#��}�[�b�_ƾ���ӑ�l��nw�8��r:kׇsכ�c� |���%��W�*!rJa�e�ۅ��9�,!��XD,gB��J�eI)p�GjR٢�v���G����ݓ��O�$��o�5���D��&�b:%����ΖFR�Ph��dَ��=���PCɔ�4MX����!Ӓ>{rp��[��S*]��L������nvLy1Q ��.��?�*[���gd�L_��N�3T���@�Q�� ((sH�c�q{�7H��*��8n���KU�.u���RK�<b�����q���w�X�V��Νo���kx���p�n�)�ƔqKg,�f}ɥ�������J��H�o��w�Q�:r,���c��ɭ�rj���b!(��IQ�=������R�n���;#}` r������}���q�����O�N��g����I ���@J��I�f&�F!K뀯4�f�0-��pˤe`�X ����CekWUv�;/�oAL���JM������]u{��F�W�d���n�Ta���3�.�,运���(C0gd�k�� ~atuC��8}��>�ƀ�̇��-"������_�[��B�<,��T�#0��Dj�+3a�\5k!��_M�j���Q�y �7���'��v���PsSbRjv��.������Mg[�q�O�i��������R/�W�/Y��/�|`z-ݿ�H9�)����� ��/ �6�|D����6}z���&�]1�Hق�O�H0xR����w�Ѧtxl���gv1{��u�9��xE�w'p�VI��ˈ�Q!�'�i�lj�i�̰���ݴ@�&�T�d�t7ld/zsVت_˂W��E��V�#� ���~;�j.���5��/ �Y}m���Y�����0#*�7���Ǚ*�4�dD�4�����G�Q���~��e�kC��g�0�n"�E�)ް�O[t"g7}!_+ӞAz������)y�{P��=)��rB�ʍ��yfDFi ��Bh�6�n�p��0[��1X-��Ζ�h&� 獠��{<q�q׳n��w&�����U��%�ͭR�SDr�����0Fͽ� o��H� �KȆn�ڃn1���m-ˆ��V���4����>�t|^��yH�����@��E�n�z��"À�(�I�av�8�4�v�����7+��r����-8Aq�T���rZ��.���?�Еj��&=���fq lW�3�4���|#��r �e)RӀ/��<x���k�ͣ��=��a(��$s�c-|�E��0y��e�6*�af�����!�}z����k�CO�u&��hus���8 ��ڌ�,*��3��Hz��+Tk�x#S��C�Q�9-����I�} ݞ���l ������L�2�� ��U��>�n$cW)"��v��!|K�����&qSPp�ӻۚQӂb�i��?��[��&jDh^�������6.]��jP^��x,��9C Rsvs�T���q��)o1�O�J��X��1�R�q�-�[ 4����U2Wg�uv��;?�I���q]�>���GP�梲��@������e���D�?�4��Ʉz� �5��rY���~�����;����i1�5v&��>)2#���aG!�e�c厚щ>�'wd,��}����[��z/�Z5�\�۽��N�� �J�*V�@{��u�O[�S�䚖7��A�5��-#�' +���s�)�=mM�b2�T\;��T%�&p�W�<���� o����V� <YG�j����^�N}KY����͏u���,�6I��G��R�&7�WwA{o�{e�y�-+�p�F���`�����a�:�ԟ ��mg��^���� ��B��Z��ugqq���L��I0����D����7U:i(�3��0�����7�6�hT�.E9U��ƧX>�>������m����c�BjE*���1�M��}�[i5,�X)��2������4�F�;���UWQ�\���k#i���� ���4�C�H̆E�-�S�^�Vy[��<���.r���\g�����Aj!��£�Db� ���G�gA$��E-���dNDi��tm��?�ڋ��o�cdejSFN텦�4��dA��9�v�&��(�K5��a���`��������Ո�k?�u��N!,d^�'�Ѐ�R��N� E�q3�H�N�_�0�>CQ Fc��k'��ǂv��C� �v�z��S&X ������M�3���N8Ih4/ˋ��.��&��C��[���'9�é�B�=���t�w��PW��G��6��]pKe!e8��t��s
Static task
static1
Behavioral task
behavioral1
Sample
VixenSlottedLoader(2).exe
Resource
win11-20240412-en
General
-
Target
VixenSlottedLoader(2).exe
-
Size
5.3MB
-
MD5
411f04c7d73ea3ed8563b3d256e6be8c
-
SHA1
93c953ac6f4bf497ef7ded027b4498e56ef08377
-
SHA256
71291c10ccb5c7469ffa02c08971d5ef35c2eb727b4b0e78c94c41900a3c8139
-
SHA512
5112b6a26aa4e8597e58bfeb4417f40b119782cd06edbf219d9479d534ee256242314a257d845c48c70936dac95eb3a82c5958d8bdaea494a92737a437d82027
-
SSDEEP
98304:ORzXFhKQkNBZ4Ph7MRTpaOvWx/SvMswp7Rre9qc2pYgBjYV7Lqv:XPZcFkjrHSVi92iwj470
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource VixenSlottedLoader(2).exe
Files
-
VixenSlottedLoader(2).exe.exe windows:6 windows x64 arch:x64
0c3f36275c157c268d1bae73eac0a726
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
dwmapi
DwmExtendFrameIntoClientArea
kernel32
QueryPerformanceCounter
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
OpenClipboard
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetStockObject
imm32
ImmGetContext
msvcp140
_Query_perf_counter
d3d9
Direct3DCreate9Ex
d3dx9_43
D3DXCreateTextureFromFileInMemory
vcruntime140
__std_terminate
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
powf
api-ms-win-crt-runtime-l1-1-0
__p___argv
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 309KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 618KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.KYS0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.KYS1 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ