Analysis
- max time kernel
149s - max time network
155s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
17/05/2026, 01:14
General
- Target Slots and Daggers/Slots and Daggers.exe
- Size 652KB
- Sample260517-bl13tabw3v
- SHA256 c8d0e9baa66665bb75e5b92e9d4ca0d5f586670ccaba340c980cd0f9e4db7f9a
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Slots and Daggers\Slots and Daggers.exe"C:\Users\Admin\AppData\Local\Temp\Slots and Daggers\Slots and Daggers.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Slots and Daggers\UnityCrashHandler64.exe"C:\Users\Admin\AppData\Local\Temp\Slots and Daggers\UnityCrashHandler64.exe" --attach 4876 24083253207042⤵
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004D01⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
settings.settings.tmp
memory/4876-7-0x0000023223700000-0x0000023223710000-memory.dmp
memory/4876-48-0x0000023223770000-0x0000023223780000-memory.dmp
memory/4876-3-0x0000023200F00000-0x0000023200F10000-memory.dmp
memory/4876-4-0x0000023200F30000-0x0000023200F40000-memory.dmp
memory/4876-14-0x0000023200EF0000-0x0000023200F00000-memory.dmp
memory/4876-6-0x00000232236F0000-0x0000023223700000-memory.dmp
memory/4876-1-0x00000230BCED0000-0x00000230BCEE0000-memory.dmp
memory/4876-8-0x0000023223710000-0x0000023223720000-memory.dmp
memory/4876-9-0x0000023223770000-0x0000023223780000-memory.dmp
memory/4876-12-0x0000023263780000-0x0000023263790000-memory.dmp
memory/4876-11-0x00000230BCED0000-0x00000230BCEE0000-memory.dmp
memory/4876-10-0x00000230BCF60000-0x00000230BCF70000-memory.dmp
memory/4876-2-0x0000023200EF0000-0x0000023200F00000-memory.dmp
memory/4876-13-0x00000232637E0000-0x00000232637F0000-memory.dmp
memory/4876-5-0x0000023200F80000-0x0000023200F90000-memory.dmp
memory/4876-17-0x0000023263800000-0x0000023263810000-memory.dmp
memory/4876-16-0x0000023200F00000-0x0000023200F10000-memory.dmp
memory/4876-18-0x0000023200F30000-0x0000023200F40000-memory.dmp
memory/4876-19-0x0000023200F80000-0x0000023200F90000-memory.dmp
memory/4876-21-0x00000232236F0000-0x0000023223700000-memory.dmp
memory/4876-0-0x00000230BCF60000-0x00000230BCF70000-memory.dmp
memory/4876-46-0x0000023223700000-0x0000023223710000-memory.dmp
memory/4876-47-0x0000023223710000-0x0000023223720000-memory.dmp
memory/4876-15-0x00000232637F0000-0x0000023263800000-memory.dmp
memory/4876-49-0x0000023263780000-0x0000023263790000-memory.dmp
memory/4876-50-0x00000232637E0000-0x00000232637F0000-memory.dmp
memory/4876-51-0x00000232637F0000-0x0000023263800000-memory.dmp
memory/4876-52-0x0000023263800000-0x0000023263810000-memory.dmp