Analysis
-
max time kernel
15s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 22:44
Behavioral task
behavioral1
Sample
Electron V3/ElectronV3.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
Electron V3/ElectronV3.exe
Resource
win10v2004-20240426-en
General
-
Target
Electron V3/ElectronV3.exe
-
Size
25.7MB
-
MD5
97a09b65238989fbadc8a34843b11778
-
SHA1
dcaef5679d51b328af787f98b7587f66c98c9604
-
SHA256
a24c902acaefc66b5aa02ec8c29503231bed5e2db0a05e5c3a9502df87c13c3b
-
SHA512
be2629d540002c10e1de9f91cb241d2565913c6fa0f7c1a4394b6992b56826f0501cc562d335ea854cc123c1f1a6ddc63c45f5a41716072df10d6c4f3bd05532
-
SSDEEP
393216:RD9et5y+9/pWFGRUnfXBsnYDrIW1TaDH:RD6y+9/pWRGH6q
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2756 ElectronV3.exe -
resource yara_rule behavioral1/files/0x0005000000019634-46.dat upx behavioral1/memory/2756-48-0x000007FEF5F30000-0x000007FEF6518000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1760 wrote to memory of 2756 1760 ElectronV3.exe 28 PID 1760 wrote to memory of 2756 1760 ElectronV3.exe 28 PID 1760 wrote to memory of 2756 1760 ElectronV3.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Electron V3\ElectronV3.exe"C:\Users\Admin\AppData\Local\Temp\Electron V3\ElectronV3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\Electron V3\ElectronV3.exe"C:\Users\Admin\AppData\Local\Temp\Electron V3\ElectronV3.exe"2⤵
- Loads dropped DLL
PID:2756
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5db09c9bbec6134db1766d369c339a0a1
SHA1c156d9f2d0e80b4cf41794cd9b8b1e8a352e0a0b
SHA256b1aac1e461174bbae952434e4dac092590d72b9832a04457c94bd9bb7ee8ad79
SHA512653a7fff6a2b6bffb9ea2c0b72ddb83c9c53d555e798eea47101b0d932358180a01af2b9dab9c27723057439c1eaffb8d84b9b41f6f9cd1c3c934f1794104d45