414d6d04818f03a3c45a8f4300fbae1ce5a5cee9beb8ce90417ea9d09314cc74

General

Target

file.exe
Size

2.5MB
MD5

fc774a4455b8929454e016518dfd234c
SHA1

4cb70043727b501919aad98a8e006b09ee37bba9
SHA256

414d6d04818f03a3c45a8f4300fbae1ce5a5cee9beb8ce90417ea9d09314cc74
SHA512

4e8e25638fd4848580077ed2f1d3cfe9e3acb88e97b6cc3bee4c3a997aa2cc04bc98a8784fe567ca0d7f30c51803f5d0b7bd056dc7173ee4afa847fa248b79e8
SSDEEP

49152:VkQTA0rFERkvK8YL17QGu4Etaaajq+UFn5LV/WFXFN17Zfd91:VaaEKcxQGYKjNuFwhFnH91

Score

7^/10

Malware Config

Signatures

.NET Reactor proctector 22 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral1/memory/3040-0-0x00000000050D0000-0x0000000005334000-memory.dmp	net_reactor
behavioral1/memory/3040-5-0x0000000004E70000-0x00000000050D2000-memory.dmp	net_reactor
behavioral1/memory/3040-6-0x0000000004E70000-0x00000000050CD000-memory.dmp	net_reactor
behavioral1/memory/3040-7-0x0000000004E70000-0x00000000050CD000-memory.dmp	net_reactor
behavioral1/memory/3040-9-0x0000000004E70000-0x00000000050CD000-memory.dmp	net_reactor
behavioral1/memory/3040-13-0x0000000004E70000-0x00000000050CD000-memory.dmp	net_reactor
behavioral1/memory/3040-21-0x0000000004E70000-0x00000000050CD000-memory.dmp	net_reactor
behavioral1/memory/3040-23-0x0000000004E70000-0x00000000050CD000-memory.dmp	net_reactor
behavioral1/memory/3040-27-0x0000000004E70000-0x00000000050CD000-memory.dmp	net_reactor
behavioral1/memory/3040-31-0x0000000004E70000-0x00000000050CD000-memory.dmp	net_reactor
behavioral1/memory/3040-29-0x0000000004E70000-0x00000000050CD000-memory.dmp	net_reactor
behavioral1/memory/3040-33-0x0000000004E70000-0x00000000050CD000-memory.dmp	net_reactor
behavioral1/memory/3040-25-0x0000000004E70000-0x00000000050CD000-memory.dmp	net_reactor
behavioral1/memory/3040-35-0x0000000004E70000-0x00000000050CD000-memory.dmp	net_reactor
behavioral1/memory/3040-39-0x0000000004E70000-0x00000000050CD000-memory.dmp	net_reactor
behavioral1/memory/3040-41-0x0000000004E70000-0x00000000050CD000-memory.dmp	net_reactor
behavioral1/memory/3040-37-0x0000000004E70000-0x00000000050CD000-memory.dmp	net_reactor
behavioral1/memory/3040-19-0x0000000004E70000-0x00000000050CD000-memory.dmp	net_reactor
behavioral1/memory/3040-17-0x0000000004E70000-0x00000000050CD000-memory.dmp	net_reactor
behavioral1/memory/3040-15-0x0000000004E70000-0x00000000050CD000-memory.dmp	net_reactor
behavioral1/memory/3040-11-0x0000000004E70000-0x00000000050CD000-memory.dmp	net_reactor
behavioral1/memory/3040-47-0x0000000004E30000-0x0000000004E70000-memory.dmp	net_reactor

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2792 3040 WerFault.exe file.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

file.exe

description pid process

Token: SeDebugPrivilege 3040 file.exe

pid	pid_target	process	target process
2792	3040	WerFault.exe	file.exe

description	pid	process
Token: SeDebugPrivilege	3040	file.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

file.exe

description	pid	process	target process
PID 3040 wrote to memory of 2792	3040	file.exe	WerFault.exe
PID 3040 wrote to memory of 2792	3040	file.exe	WerFault.exe
PID 3040 wrote to memory of 2792	3040	file.exe	WerFault.exe
PID 3040 wrote to memory of 2792	3040	file.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 624
2⤵
- Program crash
PID:2792

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3040-0-0x00000000050D0000-0x0000000005334000-memory.dmp

Filesize
2.4MB

Download
memory/3040-2-0x0000000004E30000-0x0000000004E70000-memory.dmp

Filesize
256KB

Download
memory/3040-1-0x0000000074BF0000-0x00000000752DE000-memory.dmp

Filesize
6.9MB

Download
memory/3040-3-0x0000000004E30000-0x0000000004E70000-memory.dmp

Filesize
256KB

Download
memory/3040-4-0x0000000004E30000-0x0000000004E70000-memory.dmp

Filesize
256KB

Download
memory/3040-5-0x0000000004E70000-0x00000000050D2000-memory.dmp

Filesize
2.4MB

Download
memory/3040-6-0x0000000004E70000-0x00000000050CD000-memory.dmp

Filesize
2.4MB

Download
memory/3040-7-0x0000000004E70000-0x00000000050CD000-memory.dmp

Filesize
2.4MB

Download
memory/3040-9-0x0000000004E70000-0x00000000050CD000-memory.dmp

Filesize
2.4MB

Download
memory/3040-13-0x0000000004E70000-0x00000000050CD000-memory.dmp

Filesize
2.4MB

Download
memory/3040-21-0x0000000004E70000-0x00000000050CD000-memory.dmp

Filesize
2.4MB

Download
memory/3040-23-0x0000000004E70000-0x00000000050CD000-memory.dmp

Filesize
2.4MB

Download
memory/3040-27-0x0000000004E70000-0x00000000050CD000-memory.dmp

Filesize
2.4MB

Download
memory/3040-31-0x0000000004E70000-0x00000000050CD000-memory.dmp

Filesize
2.4MB

Download
memory/3040-29-0x0000000004E70000-0x00000000050CD000-memory.dmp

Filesize
2.4MB

Download
memory/3040-33-0x0000000004E70000-0x00000000050CD000-memory.dmp

Filesize
2.4MB

Download
memory/3040-25-0x0000000004E70000-0x00000000050CD000-memory.dmp

Filesize
2.4MB

Download
memory/3040-35-0x0000000004E70000-0x00000000050CD000-memory.dmp

Filesize
2.4MB

Download
memory/3040-39-0x0000000004E70000-0x00000000050CD000-memory.dmp

Filesize
2.4MB

Download
memory/3040-41-0x0000000004E70000-0x00000000050CD000-memory.dmp

Filesize
2.4MB

Download
memory/3040-37-0x0000000004E70000-0x00000000050CD000-memory.dmp

Filesize
2.4MB

Download
memory/3040-19-0x0000000004E70000-0x00000000050CD000-memory.dmp

Filesize
2.4MB

Download
memory/3040-17-0x0000000004E70000-0x00000000050CD000-memory.dmp

Filesize
2.4MB

Download
memory/3040-15-0x0000000004E70000-0x00000000050CD000-memory.dmp

Filesize
2.4MB

Download
memory/3040-11-0x0000000004E70000-0x00000000050CD000-memory.dmp

Filesize
2.4MB

Download
memory/3040-44-0x0000000002810000-0x0000000004810000-memory.dmp

Filesize
32.0MB

Download
memory/3040-45-0x0000000074BF0000-0x00000000752DE000-memory.dmp

Filesize
6.9MB

Download
memory/3040-46-0x0000000004E30000-0x0000000004E70000-memory.dmp

Filesize
256KB

Download
memory/3040-47-0x0000000004E30000-0x0000000004E70000-memory.dmp

Filesize
256KB

Download
memory/3040-48-0x0000000004E30000-0x0000000004E70000-memory.dmp

Filesize
256KB

Download
memory/3040-49-0x0000000002810000-0x0000000004810000-memory.dmp

Filesize
32.0MB

Download

Analysis

Sharing