4742d7664c0c6fd1b1fddc60807f7b5ae8875d09d87ecf2907a0a980ecad0bae

Analysis

user interaction
yes
max time kernel
40s
max time network
40s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/10/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
selkie_core.exe
Size 2.4MB
Sample261006-xerrfssw9j
SHA256 4742d7664c0c6fd1b1fddc60807f7b5ae8875d09d87ecf2907a0a980ecad0bae
MD5 365e690724a577c6f284f19b37c264e5
SHA1 0589d5a455aff1392c2756c99e2146371e789ebc
SHA512 90cf6d0ea7f9a85981be96bb1363b94a22434421ce9b771ef08a394855e0671a7e4198c410f8753607d7241977690c189842f849347f2eca78469f83ed1ca399
SSDEEP 24576:uNxm0HaG1zz5pYQC1VF5rR1HP+vtwrIKPZT8mh0lhSMXlJ62HUsC79:uTPHaGtzNC1VFJHPWyI28TZ+l7
TLSH
T1C6C5AE16B2A501F9C07BC0B8CA579617F7B2744A03349AEF33E49A691F235E15E3BB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	selkie_core.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4688	msedgewebview2.exe
4688	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3496	selkie_core.exe
3496	selkie_core.exe
3496	selkie_core.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3496	selkie_core.exe
3496	selkie_core.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 4688	3496	selkie_core.exe	84
PID 4688 wrote to memory of 3664	4688	msedgewebview2.exe	85
PID 4688 wrote to memory of 3292	4688	msedgewebview2.exe	89
PID 4688 wrote to memory of 3292	4688	msedgewebview2.exe	89
PID 4688 wrote to memory of 3292	4688	msedgewebview2.exe	89
PID 4688 wrote to memory of 3804	4688	msedgewebview2.exe	90
PID 4688 wrote to memory of 208	4688	msedgewebview2.exe	91
PID 4688 wrote to memory of 208	4688	msedgewebview2.exe	91
PID 4688 wrote to memory of 1856	4688	msedgewebview2.exe	92
PID 4688 wrote to memory of 1856	4688	msedgewebview2.exe	92
PID 4688 wrote to memory of 1856	4688	msedgewebview2.exe	92
PID 4688 wrote to memory of 4292	4688	msedgewebview2.exe	93
PID 4688 wrote to memory of 4292	4688	msedgewebview2.exe	93
PID 4688 wrote to memory of 4292	4688	msedgewebview2.exe	93

C:\Users\Admin\AppData\Local\Temp\selkie_core.exe
"C:\Users\Admin\AppData\Local\Temp\selkie_core.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=selkie_core.exe --user-data-dir="C:\Users\Admin\AppData\Local\Selkie\WebView2\EBWebView" --noerrdialogs --mojo-named-platform-channel-pipe=3496.3272.723540413339981445
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Selkie\WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Selkie\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffbdfd0b078,0x7ffbdfd0b084,0x7ffbdfd0b090
    3⤵
    PID:3664
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Selkie\WebView2\EBWebView" --webview-exe-name=selkie_core.exe --embedded-browser-webview=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1688,i,1892763192753860097,17745429757521829855,262144 --variations-seed-version --mojo-platform-channel-handle=1704 /prefetch:2
    3⤵
    PID:3292
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Selkie\WebView2\EBWebView" --webview-exe-name=selkie_core.exe --embedded-browser-webview=1 --always-read-main-dll --field-trial-handle=1256,i,1892763192753860097,17745429757521829855,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:3
    3⤵
    PID:3804
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Selkie\WebView2\EBWebView" --webview-exe-name=selkie_core.exe --embedded-browser-webview=1 --always-read-main-dll --field-trial-handle=2356,i,1892763192753860097,17745429757521829855,262144 --variations-seed-version --mojo-platform-channel-handle=1672 /prefetch:8
    3⤵
    PID:208
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Selkie\WebView2\EBWebView" --webview-exe-name=selkie_core.exe --embedded-browser-webview=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3600,i,1892763192753860097,17745429757521829855,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    PID:1856
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Selkie\WebView2\EBWebView" --webview-exe-name=selkie_core.exe --embedded-browser-webview=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3964,i,1892763192753860097,17745429757521829855,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:1
    3⤵
    PID:4292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Selkie\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7ccb7868cfb2f08dbe3a6ab1796f40536ebe4672f8094ae554d2dc707a096a74
MD5 c961e091519b3307a4538006d08fb068
SHA1 8921e3b546fe21add8f556d67dfece935c2c8e80
SHA512 a95deb78678bc28156dc94e7016eb5a2a6a8b13e67bc806ed31319a880b25b610be58e0f86236837147ef760d8fa5b0f0b6431fe76d92b6e180fc3f6140124d1
TLSH
T17BD00414DD100404C00014354435C711D14044141113735004117F0415CD4050441501
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Selkie\WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

02cf4e1f0bd435f3372a27f2a24cef9a3f182e9d350e10355f6557c8e4b753a7.slk

Path C:\Users\Admin\AppData\Local\selkie\02cf4e1f0bd435f3372a27f2a24cef9a3f182e9d350e10355f6557c8e4b753a7.slk
Size 7KB
SHA256 2e76f4261e4fe23a890c190c48e2834d68fd52d7f4491b16e8ecf7b0e9b2d51a
MD5 3a95fca0c9149f17e0231cffc3c44fc9
SHA1 d731bcfdcc7275db78e69199c4857aa09427ddb6
SHA512 a5a5a89e8072b6c39cc253857ea8588c88ad81bc6788aea20feabc4e54a6546f60bf2cad5dd14d51720423e9c964d74ae284adf1185600149e92bfb3f356e3c4
SSDEEP 192:ERPWpuPRyfd3cNdbddzk1c0JWPXnLuY8u0MWYXPS5J/+mRh:EOuPo1M7BdzdW8W4CYwh
TLSH
T1DEF1AFD51C23272FB99B658E2024200A36DD7E538740ECCE09E7D5BDB5373948A76C8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0ec6f64c2398f69c376de04612489886a43edd9896d02a2b99377c5a6b48b713.slk

Path C:\Users\Admin\AppData\Local\selkie\0ec6f64c2398f69c376de04612489886a43edd9896d02a2b99377c5a6b48b713.slk
Size 200B
SHA256 ad5be2796e8d830114b95587b53b80ebaad37078bde05b1656fd864f2cfc0328
MD5 3eac773e805c7387005d388257e4bde9
SHA1 0a29a2b65c86d176f0f5c62fc728eb717e44b261
SHA512 66337349080bb1e71f80f48e2e87df19ede52f786a9bc2d09ece80b007fff2085ff79bdafd519020dca3baa0f94872833ab6f61891432f3a1dc9507809de0665
TLSH
T1C3D0C043F06CA6E0C1F1033069B0B0A828BB84B7FAB079134BC47D37C7820186E9D013
MD5 SHA1 SHA512 TLSH

Submit Download