x�@Q�MճP<��4n�-Q.������D��K��v�*�)E��T-3��U��V��9��=����m����yP���p�0�[���0��={B�-;�GM����}$b�,sw�nc�RR�{��|D�'<S.��ن��h��!��_�U���S�K��{Y&p�T4�?5d5�_�%1��k�ދ��+.���(tS�>P��Mx���������Q/lI�ً����5 �����V''gM��wT�C�i3R�0T��xF�]IR�%+�o� ���1|��a���qZv��a�5���g.Q�D �0��� �U�������v�\���9� :���D_�Q�\�:3�i\s��5���4*l����w�j��c8_F���u�)�o�Ҙ��Z ,B�'��,|�-=�@F�3����2�9��f) ��B������p�!�=��o=�N����or��X|W���e�K�P����T���(���#���q�9�Z��C��1C���"�%-fG��b5:ޫ�X�"fvg�\F�}�V�7z.�)�p�Ц��zDP�UkW㊴ E�p)_���eA��{�nY��,C�ZG������& KB,�^_R�l�������bb���[|�����Cg*�_�\">��}?�O��:���A�D���ͭi�5�,a/'_Q�D��B�Z���͍� �^R�H#9�f�q�D���[))X��4�G�֚9ʓ�K��N�#+<恊�/j��6��`�o(�ܐG����+"�S�������+]�}c1]���{��,n���p � �����D�N[$!_���7mp��Yğ��s��� ���3��W�(�`"������*!�(�jO@cX�4~D����G��R2��> �c��<�̷l9�x�u��%H��D�y/���dr�Er`5���+k��?�<���G�MH��7��cgH���X�IR̬,hr."���_�!��Z��\�]�n���_�{/$A�;�H3��Se����ԝk�����S#�,U*i�ˁ��Z!��?� ��+��2�u kv_?�D��R� q "8�1A$/�n��)����0e�����m�O��BZ��Wa}H�IJ?$��E^�� :J����5.�lX������ģ���{k,a�|}��������+�o.����f����n�Ȗ�e+�?q���SB0oY6`����lH:��q����wP�#r�.R ɫ��Y8ﶎ�cqNX�ruZJUVg:��_�?6ΠVuOh�:5V�Q��lS��L�,�Y�c+N6T'[@�h�O��i\���2�5c�#�@��ܧ�u�$5k[�A���q����]��W��g�0��3�v���e'4&��9J�e����[�=�LK���n�َ��v`������t}=�͠���&�s��],���j)*��'`x�ˑH�f���nK�O���7s��j�ݍ�,���m9^�Ȅv���cW < O�a�uOWBa^��%�;����j����i�l���vG�������}���a]��0L�F���3�ܪ��cM'q<��@5(3��#|��&\_)�W&>�L�w���m�aY�5Z���Γ�r����@�UD��!Ix���2g�<����2�t�D�ȭ�ڣ�`Uee�D n�7�͝<�'J��On������S�K�b>J���Z� �-���Ե!̮�Z��'�5ÄX?��?\Š-Z�J S�-(���w;& �~�yh����EBw�4�ؼ��1�ץ�D�-����|�r�2eb�S+�wCE��u�ΔrZ$�\��Ű���P�W/��Qml�?P<k��sU3�b���xG�i�� 5����$�z�����O�|8�x-Qw�<L:~�mrV��t�5�<lSXt��b)�纷� Ǽ���9���S�w��6/�j���'`s�j������vlw�/�� ���p�����q��h�L3��5�-�`"�����m�3u��6���+Lxik�n¶���=��F� �8T0��(qH���ܾ��R<nSv����ji�(g�{Nwq�A�~�w3�c��Φ!?[b��փ�._Q�4��5S*Y��=��N��0<����>x���X,��[�(�9AR3@V��ӫ�=4 Vĝh�e-?V��\�(�̞���mR^� ��#�gɒ�?]W�q�� mħ�s�����v �|[���iZn�� Ƨkq�c��F�l�h�͍��� 8�+ ��3�u�k�y߃��<s��#ǫ|s���`���N$��^�VwR��)k�^2����t'ۧ�F�}̃�G�4�{���x��q�v�2oN:'�+h�z����2.�o@F��^���b�η1G���ݲ.)5G5��u�d��� u�:���ʼ�ISg��,��O�����ǵ��+��9��Mi�]x�xY#ear~�*�R5d���q���#����46��d�$>h�3�68 �����8�I���-j�W�W�܌�2���cPj�V���"��?�GS�y��ոwv;�'1��C\I�_��� !���Z�P�=�O-N�S�WO) N���E����}O�U(�h�� �S����L��$�@��]CL@+mX�aU��"@fѝEL��y{�� �D�i8J����݇J'6��E���h2��Q?J/*�������O��8y�Y���x�i���J�z������!�8~6���r����.Z������ՠ��Eˍ���C������� ��|�o@�#������at����zx�%p�c�澄�>3����ao $����r�k��Қp����Ϡڥ!���k� `�����h� ���^z:����;M�aVԖ���!?G�N���쎦ث6a����w����M{֖�7����0����!.�o�U��;u�)[^��K� FΤ�F�>�r��F��oeQ�-��Q���ۅw��f� J�48�'���hMͻ����`i87�k.����馷��5'G�� �QgF����Cؘ{�Wi�\�ې�F�}_�'ϒ�ˣnjO��@�:�I&��]5OX2��8/��H�<�SV*��{&���3ŗ !CFv�9�&� �@�H��c�:���2���
Static task
static1
Behavioral task
behavioral1
Sample
VixenSlottedLoader.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
VixenSlottedLoader.exe
Resource
win10v2004-20240508-en
General
-
Target
VixenSlottedLoader.exe
-
Size
5.3MB
-
MD5
d64e82f17f0be22815f466a2e92c9920
-
SHA1
83e44f4511a2e951632cf2ac3a93b8f514d4c9c5
-
SHA256
5a9bbebe03edd32cc51a802a5a0009b877320b47200750e74faa3fdf65c9f049
-
SHA512
78d5517597c71e5367c28c9cfa65a1dcd2900edeb5a5e270c5c0a00e128d66e8bbe5e6ad159a99c11089f25e3108b6d46b4afb8b94634e42d3b5ae821db3aa26
-
SSDEEP
98304:Z40wPP1G3ZcebqL3eqqoR8Lz8yFg++eq2rTfRCEnSFj0yV:pItHSSvR8/5FBJVEEejj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource VixenSlottedLoader.exe
Files
-
VixenSlottedLoader.exe.exe windows:6 windows x64 arch:x64
45b5abfbf651ec19c444c95038d26074
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
dwmapi
DwmExtendFrameIntoClientArea
kernel32
QueryPerformanceCounter
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
OpenClipboard
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetStockObject
imm32
ImmReleaseContext
msvcp140
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
d3d9
Direct3DCreate9Ex
ntdll
RtlAdjustPrivilege
d3dx9_43
D3DXCreateTextureFromFileInMemory
vcruntime140
_CxxThrowException
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-stdio-l1-1-0
fseek
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
atan2
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 322KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 617KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.BE0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.BE1 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ