Analysis
-
max time kernel
123s -
max time network
129s -
platform
windows10-1703_x64 -
resource
win10-20231215-en -
resource tags
arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system -
submitted
10-02-2024 11:39
Static task
static1
Behavioral task
behavioral1
Sample
ElectronR/Electron.exe
Resource
win10-20231215-en
Behavioral task
behavioral2
Sample
ElectronR/WpfAnimatedGif.dll
Resource
win10-20231220-en
Behavioral task
behavioral3
Sample
ElectronR/binkawin.dll
Resource
win10-20231215-en
Behavioral task
behavioral4
Sample
ElectronR/cef_extensions.js
Resource
win10-20231215-en
Behavioral task
behavioral5
Sample
ElectronR/metod 2/loader.exe
Resource
win10-20231215-en
General
-
Target
ElectronR/binkawin.dll
-
Size
55KB
-
MD5
d51b5b46735b25c2d8372608159ed1a9
-
SHA1
2c178740901103d66a59131e19548d84c44fa768
-
SHA256
dd68562b5e4686e1a07603057db7a12040821beadd81d142bfb6a57d2de45ddb
-
SHA512
7c9a856fea8f7d4bddfc2b67724b475f7561979fbcf088ef2ce839e7c10870920ab4ea6b7d29254ab9d585a917eff5481c73644290350265682c627ab8fa110b
-
SSDEEP
1536:Ed01XORcuxj9ijJ644BXOpmE88Y+xs9PuMLHXwbJoeQ3fr:S0tOJxj9GJ644l2m78pm5uMLHX
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
Processes:
taskmgr.exedescription ioc process File created C:\Windows\rescache\_merged\4183903823\810424605.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\3877292338.pri taskmgr.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2392 4644 WerFault.exe rundll32.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
taskmgr.exepid process 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 2592 taskmgr.exe Token: SeSystemProfilePrivilege 2592 taskmgr.exe Token: SeCreateGlobalPrivilege 2592 taskmgr.exe Token: 33 2592 taskmgr.exe Token: SeIncBasePriorityPrivilege 2592 taskmgr.exe -
Suspicious use of FindShellTrayWindow 42 IoCs
Processes:
taskmgr.exepid process 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe -
Suspicious use of SendNotifyMessage 42 IoCs
Processes:
taskmgr.exepid process 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3292 wrote to memory of 4644 3292 rundll32.exe rundll32.exe PID 3292 wrote to memory of 4644 3292 rundll32.exe rundll32.exe PID 3292 wrote to memory of 4644 3292 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ElectronR\binkawin.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ElectronR\binkawin.dll,#12⤵PID:4644
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 6163⤵
- Program crash
PID:2392
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2592