sliver | b6fb66b02b98a1e0e03541737e4cd10c01191f262bbda357cfabfb90379e9219

Analysis

max time kernel
100s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2025, 21:45

Target

2025-04-02_8e3283ca1f3db9b0ad1672b1cf711a5c_frostygoop_ghostlocker_knight_luca-stealer_retefe.exe
Size

22.0MB
MD5

8e3283ca1f3db9b0ad1672b1cf711a5c
SHA1

77daaf150062d86590ac03f129fb8964a193e0ba
SHA256

b6fb66b02b98a1e0e03541737e4cd10c01191f262bbda357cfabfb90379e9219
SHA512

f8a36cb11e0275dab462bbe85ec8dee5c45c255ab112c333183b95094fe1ea8960079277ee39ac59d2b63fb78721b27b7152a11cce4ffff5b566472cc561132f
SSDEEP

49152:pPmqbZ02RyjVjknFm7DhiqBUYTSFNE9A1JqH:pQyA7DmYGFiAP

Score

10^/10

Sliver RAT v2 1 IoCs

resource	yara_rule
behavioral1/memory/3128-1-0x0000025179570000-0x0000025179F03000-memory.dmp	SliverRAT_v2

Sliver family
sliver
SliverRAT
SliverRAT is an open source Adversary Emulation Framework.
trojan backdoor sliver

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 1532	3128	2025-04-02_8e3283ca1f3db9b0ad1672b1cf711a5c_frostygoop_ghostlocker_knight_luca-stealer_retefe.exe	87
PID 3128 wrote to memory of 1532	3128	2025-04-02_8e3283ca1f3db9b0ad1672b1cf711a5c_frostygoop_ghostlocker_knight_luca-stealer_retefe.exe	87

C:\Users\Admin\AppData\Local\Temp\2025-04-02_8e3283ca1f3db9b0ad1672b1cf711a5c_frostygoop_ghostlocker_knight_luca-stealer_retefe.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-02_8e3283ca1f3db9b0ad1672b1cf711a5c_frostygoop_ghostlocker_knight_luca-stealer_retefe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  PID:1532

memory/3128-0-0x00007FFD113F0000-0x00007FFD115E5000-memory.dmp

Filesize
2.0MB

Download
memory/3128-1-0x0000025179570000-0x0000025179F03000-memory.dmp

Filesize
9.6MB

Download