4621fab7e79c7f65a52220c1cdb75aef0e2f5a6dfebf3f3380e075b49235d1be

Analysis

max time kernel
80s
max time network
35s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21-05-2023 20:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Folder/OnlineSet-up.exe
Size

685.3MB
MD5

3890f04895fa29ca24469e4c52e44b1f
SHA1

4c944be0bf5cecff8334d783a387de8043bde9be
SHA256

a1f4e4cd0c62e2cfa8ebdcb90800cdcd028b0302a60714ce8fb122e8d7d4a9fa
SHA512

68b53ea7c5312e14dcae727d14856360e07535a034ce0b899b0714efd1cc3d25d9c778718bddb81267a10a4283278b0a1793e973e4abd95acac2485d72364268
SSDEEP

393216:hrR+SknsQiN9pmGKLnqIgxBnpWmxuis8LrqSGl:VR+SknLepQTqIGnpWHisj

Score

7^/10

Malware Config

Signatures

.NET Reactor proctector 35 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral1/memory/1304-54-0x0000000000A60000-0x0000000003328000-memory.dmp	net_reactor
behavioral1/memory/1304-56-0x000000001DE30000-0x000000001DF86000-memory.dmp	net_reactor
behavioral1/memory/1304-58-0x000000001DE30000-0x000000001DF80000-memory.dmp	net_reactor
behavioral1/memory/1304-57-0x000000001DE30000-0x000000001DF80000-memory.dmp	net_reactor
behavioral1/memory/1304-60-0x000000001DE30000-0x000000001DF80000-memory.dmp	net_reactor
behavioral1/memory/1304-62-0x000000001DE30000-0x000000001DF80000-memory.dmp	net_reactor
behavioral1/memory/1304-64-0x000000001DE30000-0x000000001DF80000-memory.dmp	net_reactor
behavioral1/memory/1304-66-0x000000001DE30000-0x000000001DF80000-memory.dmp	net_reactor
behavioral1/memory/1304-68-0x000000001DE30000-0x000000001DF80000-memory.dmp	net_reactor
behavioral1/memory/1304-70-0x000000001DE30000-0x000000001DF80000-memory.dmp	net_reactor
behavioral1/memory/1304-72-0x000000001DE30000-0x000000001DF80000-memory.dmp	net_reactor
behavioral1/memory/1304-74-0x000000001DE30000-0x000000001DF80000-memory.dmp	net_reactor
behavioral1/memory/1304-76-0x000000001DE30000-0x000000001DF80000-memory.dmp	net_reactor
behavioral1/memory/1304-78-0x000000001DE30000-0x000000001DF80000-memory.dmp	net_reactor
behavioral1/memory/1304-80-0x000000001DE30000-0x000000001DF80000-memory.dmp	net_reactor
behavioral1/memory/1304-82-0x000000001DE30000-0x000000001DF80000-memory.dmp	net_reactor
behavioral1/memory/1304-84-0x000000001DE30000-0x000000001DF80000-memory.dmp	net_reactor
behavioral1/memory/1304-86-0x000000001DE30000-0x000000001DF80000-memory.dmp	net_reactor
behavioral1/memory/1304-88-0x000000001DE30000-0x000000001DF80000-memory.dmp	net_reactor
behavioral1/memory/1304-90-0x000000001DE30000-0x000000001DF80000-memory.dmp	net_reactor
behavioral1/memory/1304-92-0x000000001DE30000-0x000000001DF80000-memory.dmp	net_reactor
behavioral1/memory/1304-94-0x000000001DE30000-0x000000001DF80000-memory.dmp	net_reactor
behavioral1/memory/1304-96-0x000000001DE30000-0x000000001DF80000-memory.dmp	net_reactor
behavioral1/memory/1304-98-0x000000001DE30000-0x000000001DF80000-memory.dmp	net_reactor
behavioral1/memory/1304-100-0x000000001DE30000-0x000000001DF80000-memory.dmp	net_reactor
behavioral1/memory/1304-102-0x000000001DE30000-0x000000001DF80000-memory.dmp	net_reactor
behavioral1/memory/1304-104-0x000000001DE30000-0x000000001DF80000-memory.dmp	net_reactor
behavioral1/memory/1304-106-0x000000001DE30000-0x000000001DF80000-memory.dmp	net_reactor
behavioral1/memory/1304-108-0x000000001DE30000-0x000000001DF80000-memory.dmp	net_reactor
behavioral1/memory/1304-110-0x000000001DE30000-0x000000001DF80000-memory.dmp	net_reactor
behavioral1/memory/1304-112-0x000000001DE30000-0x000000001DF80000-memory.dmp	net_reactor
behavioral1/memory/1304-114-0x000000001DE30000-0x000000001DF80000-memory.dmp	net_reactor
behavioral1/memory/1304-116-0x000000001DE30000-0x000000001DF80000-memory.dmp	net_reactor
behavioral1/memory/1304-118-0x000000001DE30000-0x000000001DF80000-memory.dmp	net_reactor
behavioral1/memory/1304-120-0x000000001DE30000-0x000000001DF80000-memory.dmp	net_reactor

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

OnlineSet-up.exe

pid process

1304 OnlineSet-up.exe
1304 OnlineSet-up.exe
1304 OnlineSet-up.exe
1304 OnlineSet-up.exe
1304 OnlineSet-up.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

OnlineSet-up.exe

description pid process

Token: SeDebugPrivilege 1304 OnlineSet-up.exe

pid	process
1304	OnlineSet-up.exe
1304	OnlineSet-up.exe
1304	OnlineSet-up.exe
1304	OnlineSet-up.exe
1304	OnlineSet-up.exe

description	pid	process
Token: SeDebugPrivilege	1304	OnlineSet-up.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

OnlineSet-up.exe

description	pid	process	target process
PID 1304 wrote to memory of 1792	1304	OnlineSet-up.exe	MSBuild.exe
PID 1304 wrote to memory of 1792	1304	OnlineSet-up.exe	MSBuild.exe
PID 1304 wrote to memory of 1792	1304	OnlineSet-up.exe	MSBuild.exe
PID 1304 wrote to memory of 1792	1304	OnlineSet-up.exe	MSBuild.exe
PID 1304 wrote to memory of 756	1304	OnlineSet-up.exe	MSBuild.exe
PID 1304 wrote to memory of 756	1304	OnlineSet-up.exe	MSBuild.exe
PID 1304 wrote to memory of 756	1304	OnlineSet-up.exe	MSBuild.exe
PID 1304 wrote to memory of 756	1304	OnlineSet-up.exe	MSBuild.exe
PID 1304 wrote to memory of 1948	1304	OnlineSet-up.exe	MSBuild.exe
PID 1304 wrote to memory of 1948	1304	OnlineSet-up.exe	MSBuild.exe
PID 1304 wrote to memory of 1948	1304	OnlineSet-up.exe	MSBuild.exe
PID 1304 wrote to memory of 1948	1304	OnlineSet-up.exe	MSBuild.exe
PID 1304 wrote to memory of 676	1304	OnlineSet-up.exe	MSBuild.exe
PID 1304 wrote to memory of 676	1304	OnlineSet-up.exe	MSBuild.exe
PID 1304 wrote to memory of 676	1304	OnlineSet-up.exe	MSBuild.exe
PID 1304 wrote to memory of 676	1304	OnlineSet-up.exe	MSBuild.exe
PID 1304 wrote to memory of 1472	1304	OnlineSet-up.exe	MSBuild.exe
PID 1304 wrote to memory of 1472	1304	OnlineSet-up.exe	MSBuild.exe
PID 1304 wrote to memory of 1472	1304	OnlineSet-up.exe	MSBuild.exe
PID 1304 wrote to memory of 1472	1304	OnlineSet-up.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\Folder\OnlineSet-up.exe
"C:\Users\Admin\AppData\Local\Temp\Folder\OnlineSet-up.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1792
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:756
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1948
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:676
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1304-54-0x0000000000A60000-0x0000000003328000-memory.dmp

Filesize
40.8MB

Download
memory/1304-55-0x000000001D380000-0x000000001D400000-memory.dmp

Filesize
512KB

Download
memory/1304-56-0x000000001DE30000-0x000000001DF86000-memory.dmp

Filesize
1.3MB

Download
memory/1304-58-0x000000001DE30000-0x000000001DF80000-memory.dmp

Filesize
1.3MB

Download
memory/1304-57-0x000000001DE30000-0x000000001DF80000-memory.dmp

Filesize
1.3MB

Download
memory/1304-60-0x000000001DE30000-0x000000001DF80000-memory.dmp

Filesize
1.3MB

Download
memory/1304-62-0x000000001DE30000-0x000000001DF80000-memory.dmp

Filesize
1.3MB

Download
memory/1304-64-0x000000001DE30000-0x000000001DF80000-memory.dmp

Filesize
1.3MB

Download
memory/1304-66-0x000000001DE30000-0x000000001DF80000-memory.dmp

Filesize
1.3MB

Download
memory/1304-68-0x000000001DE30000-0x000000001DF80000-memory.dmp

Filesize
1.3MB

Download
memory/1304-70-0x000000001DE30000-0x000000001DF80000-memory.dmp

Filesize
1.3MB

Download
memory/1304-72-0x000000001DE30000-0x000000001DF80000-memory.dmp

Filesize
1.3MB

Download
memory/1304-74-0x000000001DE30000-0x000000001DF80000-memory.dmp

Filesize
1.3MB

Download
memory/1304-76-0x000000001DE30000-0x000000001DF80000-memory.dmp

Filesize
1.3MB

Download
memory/1304-78-0x000000001DE30000-0x000000001DF80000-memory.dmp

Filesize
1.3MB

Download
memory/1304-80-0x000000001DE30000-0x000000001DF80000-memory.dmp

Filesize
1.3MB

Download
memory/1304-82-0x000000001DE30000-0x000000001DF80000-memory.dmp

Filesize
1.3MB

Download
memory/1304-84-0x000000001DE30000-0x000000001DF80000-memory.dmp

Filesize
1.3MB

Download
memory/1304-86-0x000000001DE30000-0x000000001DF80000-memory.dmp

Filesize
1.3MB

Download
memory/1304-88-0x000000001DE30000-0x000000001DF80000-memory.dmp

Filesize
1.3MB

Download
memory/1304-90-0x000000001DE30000-0x000000001DF80000-memory.dmp

Filesize
1.3MB

Download
memory/1304-92-0x000000001DE30000-0x000000001DF80000-memory.dmp

Filesize
1.3MB

Download
memory/1304-94-0x000000001DE30000-0x000000001DF80000-memory.dmp

Filesize
1.3MB

Download
memory/1304-96-0x000000001DE30000-0x000000001DF80000-memory.dmp

Filesize
1.3MB

Download
memory/1304-98-0x000000001DE30000-0x000000001DF80000-memory.dmp

Filesize
1.3MB

Download
memory/1304-100-0x000000001DE30000-0x000000001DF80000-memory.dmp

Filesize
1.3MB

Download
memory/1304-102-0x000000001DE30000-0x000000001DF80000-memory.dmp

Filesize
1.3MB

Download
memory/1304-104-0x000000001DE30000-0x000000001DF80000-memory.dmp

Filesize
1.3MB

Download
memory/1304-106-0x000000001DE30000-0x000000001DF80000-memory.dmp

Filesize
1.3MB

Download
memory/1304-108-0x000000001DE30000-0x000000001DF80000-memory.dmp

Filesize
1.3MB

Download
memory/1304-110-0x000000001DE30000-0x000000001DF80000-memory.dmp

Filesize
1.3MB

Download
memory/1304-112-0x000000001DE30000-0x000000001DF80000-memory.dmp

Filesize
1.3MB

Download
memory/1304-114-0x000000001DE30000-0x000000001DF80000-memory.dmp

Filesize
1.3MB

Download
memory/1304-116-0x000000001DE30000-0x000000001DF80000-memory.dmp

Filesize
1.3MB

Download
memory/1304-118-0x000000001DE30000-0x000000001DF80000-memory.dmp

Filesize
1.3MB

Download
memory/1304-120-0x000000001DE30000-0x000000001DF80000-memory.dmp

Filesize
1.3MB

Download
memory/1304-1674-0x000000001D380000-0x000000001D400000-memory.dmp

Filesize
512KB

Download