3c857a57c9b0ab8ec947a3447f6a292a8bd3784e27af1c08d6c8f7f466e0b566 | Triage

Analysis

max time kernel
127s
max time network
240s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
14/11/2023, 15:57

Sharing

Report Analysis Logs

General

Target

11101102.exe
Size

632KB
MD5

b3d0e94a9d5cbde563e322802bb7e9ac
SHA1

f407fcc5874b658c1d2c7e43b86932d94929e99b
SHA256

3c857a57c9b0ab8ec947a3447f6a292a8bd3784e27af1c08d6c8f7f466e0b566
SHA512

18ae89f23fbec9038d07f6c9c26fa62d7dc0a2e253170bc87cb75d25d80b37cf1fdb03d3404cb94d8f4c27676c76ea1c3013f154e305e52589e30ef86822748a
SSDEEP

12288:ye2YgSBXDTyuiEqZS5CG+xkZT2uCt6SPolSK57Ja:h2YBzTfMZSgGQkh2f6KKJJ

Score

7^/10

Malware Config

Signatures

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral3/memory/4252-0-0x00000000006A0000-0x0000000000742000-memory.dmp	net_reactor

C:\Users\Admin\AppData\Local\Temp\11101102.exe
"C:\Users\Admin\AppData\Local\Temp\11101102.exe"
1⤵
PID:4252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4252-0-0x00000000006A0000-0x0000000000742000-memory.dmp

Filesize
648KB

Download
memory/4252-2-0x00007FFCC5C60000-0x00007FFCC6721000-memory.dmp

Filesize
10.8MB

Download
memory/4252-3-0x00007FFCC5C60000-0x00007FFCC6721000-memory.dmp

Filesize
10.8MB

Download