511cfaacb35df2a07aca55efb2b27b6a557e210cb5ae1d31914336f39fc472e8

Resubmissions

14/03/2022, 13:56

14/03/2022, 12:11

Target
PO0530322.exe
Size 828KB
Sample220314-pcltesfag5
SHA256 511cfaacb35df2a07aca55efb2b27b6a557e210cb5ae1d31914336f39fc472e8
MD5 3571acd11c863c2ba7e140f2c953c631
SHA1 e39344f01dcabe5e456e6aee7d71a7e47107d431
SHA512 bba895b2292c841f4cc0b09117846f2118d659db6f193bf1c3cabcabb501c3395e699ae6e1ae1878d16d1058f9eb47abda827a574024afaa84d1c27e95caccee
MD5 SHA1 SHA512

Score

9^/10

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/1876-57-0x0000000000550000-0x0000000000568000-memory.dmp	net_reactor

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1876	PO0530322.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 1028	1876	PO0530322.exe	29
PID 1876 wrote to memory of 1028	1876	PO0530322.exe	29
PID 1876 wrote to memory of 1028	1876	PO0530322.exe	29
PID 1876 wrote to memory of 1028	1876	PO0530322.exe	29
PID 1876 wrote to memory of 1636	1876	PO0530322.exe	30
PID 1876 wrote to memory of 1636	1876	PO0530322.exe	30
PID 1876 wrote to memory of 1636	1876	PO0530322.exe	30
PID 1876 wrote to memory of 1636	1876	PO0530322.exe	30
PID 1876 wrote to memory of 1984	1876	PO0530322.exe	31
PID 1876 wrote to memory of 1984	1876	PO0530322.exe	31
PID 1876 wrote to memory of 1984	1876	PO0530322.exe	31
PID 1876 wrote to memory of 1984	1876	PO0530322.exe	31
PID 1876 wrote to memory of 620	1876	PO0530322.exe	32
PID 1876 wrote to memory of 620	1876	PO0530322.exe	32
PID 1876 wrote to memory of 620	1876	PO0530322.exe	32
PID 1876 wrote to memory of 620	1876	PO0530322.exe	32
PID 1876 wrote to memory of 804	1876	PO0530322.exe	33
PID 1876 wrote to memory of 804	1876	PO0530322.exe	33
PID 1876 wrote to memory of 804	1876	PO0530322.exe	33
PID 1876 wrote to memory of 804	1876	PO0530322.exe	33

C:\Users\Admin\AppData\Local\Temp\PO0530322.exe
"C:\Users\Admin\AppData\Local\Temp\PO0530322.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Users\Admin\AppData\Local\Temp\PO0530322.exe
  "C:\Users\Admin\AppData\Local\Temp\PO0530322.exe"
  2⤵
  PID:1028
- C:\Users\Admin\AppData\Local\Temp\PO0530322.exe
  "C:\Users\Admin\AppData\Local\Temp\PO0530322.exe"
  2⤵
  PID:1636
- C:\Users\Admin\AppData\Local\Temp\PO0530322.exe
  "C:\Users\Admin\AppData\Local\Temp\PO0530322.exe"
  2⤵
  PID:1984
- C:\Users\Admin\AppData\Local\Temp\PO0530322.exe
  "C:\Users\Admin\AppData\Local\Temp\PO0530322.exe"
  2⤵
  PID:620
- C:\Users\Admin\AppData\Local\Temp\PO0530322.exe
  "C:\Users\Admin\AppData\Local\Temp\PO0530322.exe"
  2⤵
  PID:804

memory/1876-54-0x00000000003A0000-0x0000000000474000-memory.dmp

Download

memory/1876-55-0x0000000074590000-0x0000000074C7E000-memory.dmp

Download

memory/1876-56-0x00000000043B0000-0x00000000043B1000-memory.dmp

Download

memory/1876-57-0x0000000000550000-0x0000000000568000-memory.dmp

Download

memory/1876-58-0x0000000007EF0000-0x0000000007F9E000-memory.dmp

Download

memory/1876-59-0x0000000004320000-0x0000000004350000-memory.dmp

Download