Analysis
- max time kernel
49s - max time network
34s - platform
windows7_x64 - resource
win7-20221111-en - resource tags
- submitted
29/01/2023, 17:32
General
- Target file.exe
- Size 3.5MB
- Sample230129-v397laff23
- SHA256 705b15734bf127d846734775e424cd6764c7e7ea12de6d74cd58298f450027bd
Malware Config
Signatures
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/752-84-0x000000000272B000-0x000000000274A000-memory.dmp
memory/752-83-0x0000000002724000-0x0000000002727000-memory.dmp
memory/752-82-0x000000000272B000-0x000000000274A000-memory.dmp
memory/752-81-0x000000001B740000-0x000000001BA3F000-memory.dmp
memory/752-79-0x000007FEEBCE0000-0x000007FEEC83D000-memory.dmp
memory/752-80-0x0000000002724000-0x0000000002727000-memory.dmp
memory/752-77-0x000007FEEC840000-0x000007FEED263000-memory.dmp
memory/752-75-0x000007FEFC071000-0x000007FEFC073000-memory.dmp
memory/1256-69-0x000007FEFDC40000-0x000007FEFDE43000-memory.dmp
memory/1256-63-0x000007FEFF4D0000-0x000007FEFF541000-memory.dmp
memory/1256-67-0x0000000000120000-0x0000000000163000-memory.dmp
memory/1256-66-0x000007FEF5F50000-0x000007FEF693C000-memory.dmp
memory/1256-68-0x000007FEFDF50000-0x000007FEFE07D000-memory.dmp
memory/1256-55-0x0000000000B00000-0x0000000000F6C000-memory.dmp
memory/1256-70-0x0000000000B00000-0x0000000000F6C000-memory.dmp
memory/1256-71-0x000007FEF6A50000-0x000007FEF6B7C000-memory.dmp
memory/1256-72-0x000007FEFCF80000-0x000007FEFCFA2000-memory.dmp
memory/1256-73-0x000007FEFCE30000-0x000007FEFCE47000-memory.dmp
memory/1256-64-0x000007FEF6B80000-0x000007FEF6C77000-memory.dmp
memory/1256-65-0x000007FEFF130000-0x000007FEFF20B000-memory.dmp
memory/1256-76-0x000007FEFE0A0000-0x000007FEFE177000-memory.dmp
memory/1256-78-0x0000000000120000-0x0000000000163000-memory.dmp
memory/1256-62-0x000007FEFD7C0000-0x000007FEFD82C000-memory.dmp
memory/1256-61-0x00000000775D0000-0x00000000776EF000-memory.dmp
memory/1256-60-0x000007FEFF550000-0x000007FEFF5EF000-memory.dmp
memory/1256-59-0x00000000776F0000-0x00000000777EA000-memory.dmp
memory/1256-58-0x000007FEFF0C0000-0x000007FEFF127000-memory.dmp
memory/1256-57-0x000007FEF6E50000-0x000007FEF6EEC000-memory.dmp
memory/1256-56-0x000007FEF6EF0000-0x000007FEF6F5F000-memory.dmp