Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
03/02/2024, 03:36 UTC
Static task
static1
Behavioral task
behavioral1
Sample
MultiChecker by injuankanal.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
MultiChecker by injuankanal.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
MultiChecker by injuankanal.exe
-
Size
86.0MB
-
MD5
babe3da3eb741b6ed3ff61ff17e9b03a
-
SHA1
a71a4e3efe15498ab248eaddf09241bea80330a0
-
SHA256
f1b5484e2de6dd07f9d05819e5e969256cd18df1c96c794a9c0377c4ec177ffe
-
SHA512
1d1fe46ab9132a0ea92183de92d1e80b65cb06ed9bb4754b92b8ea8e98f7e3392cb74179d4125fcf9e0cf9fb1b3dd302115f155ef0973cbd9ec3d8e31da7cf14
-
SSDEEP
6144:lDKW1Fgbdl0TBBvjc/tebqa/95xaT390+8Jb1kek5H0usk7V1f7E:dh1Fk70TnvjcVNa15xaT39AbWeaUAD
Score
7/10
Malware Config
Signatures
-
.NET Reactor proctector 2 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule behavioral1/memory/2476-1-0x0000000002280000-0x00000000022C0000-memory.dmp net_reactor behavioral1/memory/2476-4-0x0000000002430000-0x000000000246E000-memory.dmp net_reactor -
Program crash 1 IoCs
pid pid_target Process procid_target 2756 2476 WerFault.exe 27 -
Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3032 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3032 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe 3032 taskmgr.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2476 wrote to memory of 2756 2476 MultiChecker by injuankanal.exe 29 PID 2476 wrote to memory of 2756 2476 MultiChecker by injuankanal.exe 29 PID 2476 wrote to memory of 2756 2476 MultiChecker by injuankanal.exe 29 PID 2476 wrote to memory of 2756 2476 MultiChecker by injuankanal.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\MultiChecker by injuankanal.exe"C:\Users\Admin\AppData\Local\Temp\MultiChecker by injuankanal.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 6002⤵
- Program crash
PID:2756
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3032