Analysis
- max time kernel
298s - max time network
271s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
27/05/2026, 04:27
General
- Target slutware-latest.setup.exe
- Size 224.9MB
- Sample260527-e3bq2ae17n
- SHA256 20d54b8ede434d118d2dc5e6b09b86afddcebcfc626f00ec1dd9e075000367e7
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 10 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 7 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\slutware-latest.setup.exe"C:\Users\Admin\AppData\Local\Temp\slutware-latest.setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe"C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Slutware\app-0.1.1\Squirrel.exe"C:\Users\Admin\AppData\Local\Slutware\app-0.1.1\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Slutware\app-0.1.1\Slutware.exe"C:\Users\Admin\AppData\Local\Slutware\app-0.1.1\Slutware.exe" --squirrel-install 0.1.13⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Slutware\app-0.1.1\Slutware.exeC:\Users\Admin\AppData\Local\Slutware\app-0.1.1\Slutware.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Slutware /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Slutware\Crashpad --url=https://f.a.k/e --annotation=_productName=Slutware --annotation=_version=0.1.1 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=25.9.8 --initial-client-data=0x518,0x51c,0x520,0x510,0x524,0x7ff7e291d208,0x7ff7e291d218,0x7ff7e291d2284⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Slutware\Update.exeC:\Users\Admin\AppData\Local\Slutware\Update.exe --createShortcut=Slutware.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Slutware\app-0.1.1\Slutware.exe"C:\Users\Admin\AppData\Local\Slutware\app-0.1.1\Slutware.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Slutware" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1876 --field-trial-handle=1880,i,3642196267800161346,16198950332465102988,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\reg.exeC:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid5⤵
-
-
-
C:\Users\Admin\AppData\Local\Slutware\app-0.1.1\Slutware.exe"C:\Users\Admin\AppData\Local\Slutware\app-0.1.1\Slutware.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Slutware" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2144 --field-trial-handle=1880,i,3642196267800161346,16198950332465102988,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Slutware.exe
chrome_100_percent.pak
chrome_200_percent.pak
d3dcompiler_47.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
en-US.pak
resources.pak
squirrel.exe
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
RELEASES
Update.exe
background.gif
setupIcon.ico
c3b14168-ae33-4a45-a52e-9136595847d8.tmp.node
default.dic
memory/720-111-0x0000000000760000-0x0000000001076000-memory.dmp
memory/4048-152-0x00000000016E0000-0x0000000001700000-memory.dmp
memory/4580-134-0x00000000218B0000-0x00000000218E8000-memory.dmp
memory/4580-135-0x0000000021880000-0x000000002188E000-memory.dmp
memory/4580-8-0x0000000000500000-0x00000000006D6000-memory.dmp