90cd3c985ef79952b2fb86298035aeebdca818b35041120ddf0c67d48e0fe383

General

Target

b3fbe8e5905d8acc91308435aa04e6f2.exe
Size

3.7MB
MD5

b3fbe8e5905d8acc91308435aa04e6f2
SHA1

9e7de9a1f2005bffbd9a6949fb098752001600ab
SHA256

90cd3c985ef79952b2fb86298035aeebdca818b35041120ddf0c67d48e0fe383
SHA512

028950885237f1a02d018bfc9705136bb6a6ab3e57512deb05191fdae629f791793dd84c435bc2360b06d4d31fbfefac9ee864bfad4b7a8fb1bfde1d27132581
SSDEEP

49152:UX2JWJuWy4rOP78N2xTS/Q6TNMAeGG+wqkDdWcuZC9baVhLKIyOnxLy5/INYO:8AqA4bNMAeLVdWRC9bO2IyOnhJYO

Score

7^/10

spyware

Malware Config

Signatures

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/memory/3076-1-0x0000000000170000-0x000000000051E000-memory.dmp	net_reactor

Loads dropped DLL 1 IoCs

pid	Process
3076	b3fbe8e5905d8acc91308435aa04e6f2.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3076 set thread context of 1816	3076	b3fbe8e5905d8acc91308435aa04e6f2.exe	94

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1816	RegSvcs.exe
1816	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 1220	3076	b3fbe8e5905d8acc91308435aa04e6f2.exe	93
PID 3076 wrote to memory of 1220	3076	b3fbe8e5905d8acc91308435aa04e6f2.exe	93
PID 3076 wrote to memory of 1220	3076	b3fbe8e5905d8acc91308435aa04e6f2.exe	93
PID 3076 wrote to memory of 1816	3076	b3fbe8e5905d8acc91308435aa04e6f2.exe	94
PID 3076 wrote to memory of 1816	3076	b3fbe8e5905d8acc91308435aa04e6f2.exe	94
PID 3076 wrote to memory of 1816	3076	b3fbe8e5905d8acc91308435aa04e6f2.exe	94
PID 3076 wrote to memory of 1816	3076	b3fbe8e5905d8acc91308435aa04e6f2.exe	94
PID 3076 wrote to memory of 1816	3076	b3fbe8e5905d8acc91308435aa04e6f2.exe	94
PID 3076 wrote to memory of 1816	3076	b3fbe8e5905d8acc91308435aa04e6f2.exe	94
PID 3076 wrote to memory of 1816	3076	b3fbe8e5905d8acc91308435aa04e6f2.exe	94
PID 3076 wrote to memory of 1816	3076	b3fbe8e5905d8acc91308435aa04e6f2.exe	94
PID 3076 wrote to memory of 1816	3076	b3fbe8e5905d8acc91308435aa04e6f2.exe	94

C:\Users\Admin\AppData\Local\Temp\b3fbe8e5905d8acc91308435aa04e6f2.exe
"C:\Users\Admin\AppData\Local\Temp\b3fbe8e5905d8acc91308435aa04e6f2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  2⤵
  PID:1220
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

Filesize
742KB

MD5
544cd51a596619b78e9b54b70088307d

SHA1
4769ddd2dbc1dc44b758964ed0bd231b85880b65

SHA256
dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

SHA512
f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

Download Submit
memory/1816-30-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1816-29-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1816-27-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1816-25-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1816-24-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1816-23-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3076-16-0x00000000743E0000-0x0000000074B90000-memory.dmp

Filesize
7.7MB

Download
memory/3076-20-0x0000000005310000-0x0000000005320000-memory.dmp

Filesize
64KB

Download
memory/3076-13-0x0000000005310000-0x0000000005320000-memory.dmp

Filesize
64KB

Download
memory/3076-14-0x0000000005310000-0x0000000005320000-memory.dmp

Filesize
64KB

Download
memory/3076-15-0x00000000054F0000-0x0000000005500000-memory.dmp

Filesize
64KB

Download
memory/3076-0-0x00000000743E0000-0x0000000074B90000-memory.dmp

Filesize
7.7MB

Download
memory/3076-17-0x0000000006300000-0x0000000006400000-memory.dmp

Filesize
1024KB

Download
memory/3076-18-0x0000000005310000-0x0000000005320000-memory.dmp

Filesize
64KB

Download
memory/3076-19-0x0000000005310000-0x0000000005320000-memory.dmp

Filesize
64KB

Download
memory/3076-7-0x0000000005AF0000-0x0000000005C82000-memory.dmp

Filesize
1.6MB

Download
memory/3076-21-0x0000000006300000-0x0000000006400000-memory.dmp

Filesize
1024KB

Download
memory/3076-22-0x0000000006300000-0x0000000006400000-memory.dmp

Filesize
1024KB

Download
memory/3076-6-0x0000000005100000-0x000000000510A000-memory.dmp

Filesize
40KB

Download
memory/3076-5-0x0000000005310000-0x0000000005320000-memory.dmp

Filesize
64KB

Download
memory/3076-4-0x0000000005110000-0x00000000051AC000-memory.dmp

Filesize
624KB

Download
memory/3076-28-0x00000000743E0000-0x0000000074B90000-memory.dmp

Filesize
7.7MB

Download
memory/3076-3-0x0000000004F90000-0x0000000005022000-memory.dmp

Filesize
584KB

Download
memory/3076-2-0x0000000005540000-0x0000000005AE4000-memory.dmp

Filesize
5.6MB

Download
memory/3076-1-0x0000000000170000-0x000000000051E000-memory.dmp

Filesize
3.7MB

Download

Analysis

Sharing