Overview
overview
10Static
static
3ElectronV3.rar
windows7-x64
3ElectronV3.rar
windows10-2004-x64
3ElectronV3...V3.exe
windows7-x64
7ElectronV3...V3.exe
windows10-2004-x64
10Stub.pyc
windows7-x64
3Stub.pyc
windows10-2004-x64
3ElectronV3...ee.txt
windows7-x64
1ElectronV3...ee.txt
windows10-2004-x64
1ElectronV3...ld.txt
windows7-x64
1ElectronV3...ld.txt
windows10-2004-x64
1ElectronV3..._FE.iy
windows7-x64
3ElectronV3..._FE.iy
windows10-2004-x64
3Analysis
-
max time kernel
327s -
max time network
317s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
08-09-2024 17:34
Behavioral task
behavioral1
Sample
ElectronV3.rar
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
ElectronV3.rar
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
ElectronV3/ElectronV3.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
ElectronV3/ElectronV3.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Stub.pyc
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral6
Sample
Stub.pyc
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
ElectronV3/bin/agree.txt
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral8
Sample
ElectronV3/bin/agree.txt
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
ElectronV3/scripts/Inf Yield.txt
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral10
Sample
ElectronV3/scripts/Inf Yield.txt
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
ElectronV3/workspace/IY_FE.iy
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
ElectronV3/workspace/IY_FE.iy
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
ElectronV3.rar
-
Size
10.7MB
-
MD5
c1463644bba01e217bbba57710f8f1ef
-
SHA1
01a943f4fd4f3160539b9c6bfc0cf8058ed2bddb
-
SHA256
b47308aaff0247545dc8ea6fa5ff1dbf0548f805e51ad2aea09cb984d18a2a97
-
SHA512
9e0655139736340be005f61317adb3c554642ca21f65dc76ea4a4c17c0d185811e90662b6ae829793506dbc4a1e505cdee91ae587d4cd832c2cc4c4d0f16af48
-
SSDEEP
196608:CAjgBwK5L4WzXw2Nms0Qy74SMwrcFqTT1UX20Es2VUJz+KakUamVdQb6SbKrrocg:vjKd5lzA2enMwr0qTT1F0gVUgkUam7rM
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1560 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2160 rundll32.exe 1560 vlc.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 2752 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2752 AUDIODG.EXE Token: 33 2752 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2752 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe 2160 rundll32.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 1560 vlc.exe 1560 vlc.exe 1560 vlc.exe 1560 vlc.exe 1560 vlc.exe 1560 vlc.exe 1560 vlc.exe 1560 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1560 vlc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2412 wrote to memory of 2160 2412 cmd.exe 30 PID 2412 wrote to memory of 2160 2412 cmd.exe 30 PID 2412 wrote to memory of 2160 2412 cmd.exe 30 PID 2160 wrote to memory of 2216 2160 rundll32.exe 34 PID 2160 wrote to memory of 2216 2160 rundll32.exe 34 PID 2160 wrote to memory of 2216 2160 rundll32.exe 34 PID 2216 wrote to memory of 1560 2216 rundll32.exe 36 PID 2216 wrote to memory of 1560 2216 rundll32.exe 36 PID 2216 wrote to memory of 1560 2216 rundll32.exe 36
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ElectronV3.rar1⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ElectronV3.rar2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ElectronV3.rar3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\ElectronV3.rar"4⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1560
-
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2700
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0xc01⤵
- Suspicious use of AdjustPrivilegeToken
PID:2752