Analysis
-
max time kernel
122s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28-10-2024 19:35
Behavioral task
behavioral1
Sample
ElectronV3.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ElectronV3.zip
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
ElectronV3/ElectronV3.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
ElectronV3/ElectronV3.exe
Resource
win10v2004-20241007-en
General
-
Target
ElectronV3/ElectronV3.exe
-
Size
37.8MB
-
MD5
1b7aed3da008408d116fe4cc4a4f2c1f
-
SHA1
b93a3c16961251da8b1a02a42dd4150547923043
-
SHA256
583082503369d4f22277889a3cf2cf0f7444896049d11389372fb1edc4d596c7
-
SHA512
77ee5c88e1da17d5d2a8496f494d33165e1685f2db6965c7886ff3374a3ab83716bb89b242c9b5d2186e7450ee816bf97f43e12e248b513cccca30889a7cc1fa
-
SSDEEP
786432:5mG/Q46tKTcvjFERlU9jZ96nEScQMnycTbl8KH+4N2997K4rv3Fqbj:YrK4e8NHnyClHNc9GUqbj
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2572 ElectronV3.exe -
resource yara_rule behavioral3/files/0x000500000001a448-47.dat upx behavioral3/memory/2572-49-0x000007FEF59B0000-0x000007FEF5E15000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3048 wrote to memory of 2572 3048 ElectronV3.exe 30 PID 3048 wrote to memory of 2572 3048 ElectronV3.exe 30 PID 3048 wrote to memory of 2572 3048 ElectronV3.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\ElectronV3\ElectronV3.exe"C:\Users\Admin\AppData\Local\Temp\ElectronV3\ElectronV3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\ElectronV3\ElectronV3.exe"C:\Users\Admin\AppData\Local\Temp\ElectronV3\ElectronV3.exe"2⤵
- Loads dropped DLL
PID:2572
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD590d5b8ba675bbb23f01048712813c746
SHA1f2906160f9fc2fa719fea7d37e145156742ea8a7
SHA2563a7d497d779ff13082835834a1512b0c11185dd499ab86be830858e7f8aaeb3e
SHA512872c2bf56c3fe180d9b4fb835a92e1dc188822e9d9183aab34b305408bb82fba1ead04711e8ad2bef1534e86cd49f2445d728851206d7899c1a7a83e5a62058e