Analysis

  • max time kernel
    1s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-02-2024 08:33

General

  • Target

    tmp.exe

  • Size

    421KB

  • MD5

    10a331a12ca40f3293dfadfcecb8d071

  • SHA1

    ada41586d1366cf76c9a652a219a0e0562cc41af

  • SHA256

    b58eec6e5aabc701404d5b5556c86fff5cc103c69eeda00061e838c4f122288f

  • SHA512

    1a5b8e77ddbab97bb4c848adbcd7dbfb9ca84307d1844dba9572fcea48a2cbb091a3fc52663b87568416adf18a1338adc07aab0bd5f1ab36a03c8ff8a035d399

  • SSDEEP

    12288:jh1Fk70TnvjcL8o0S86aZ+ldnqA1W0PeF7H:5k70TrcJX32ih1Re7H

Score
7/10

Malware Config

Signatures

  • .NET Reactor proctector 2 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4656
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:3356
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe"
          3⤵
            PID:2296

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe
        Filesize

        4KB

        MD5

        a5ce3aba68bdb438e98b1d0c70a3d95c

        SHA1

        013f5aa9057bf0b3c0c24824de9d075434501354

        SHA256

        9b860be98a046ea97a7f67b006e0b1bc9ab7731dd2a0f3a9fd3d710f6c43278a

        SHA512

        7446f1256873b51a59b9d2d3498cef5a41dbce55864c2a5fb8cb7d25f7d6e6d8ea249d551a45b75d99b1ad0d6fb4b5e4544e5ca77bcd627717d6598b5f566a79

      • memory/2296-44-0x00007FF913660000-0x00007FF914121000-memory.dmp
        Filesize

        10.8MB

      • memory/2296-42-0x00007FF913660000-0x00007FF914121000-memory.dmp
        Filesize

        10.8MB

      • memory/2296-40-0x0000000000790000-0x0000000000798000-memory.dmp
        Filesize

        32KB

      • memory/3356-25-0x0000000007970000-0x00000000079C0000-memory.dmp
        Filesize

        320KB

      • memory/3356-21-0x0000000005930000-0x0000000005996000-memory.dmp
        Filesize

        408KB

      • memory/3356-9-0x0000000000400000-0x0000000000442000-memory.dmp
        Filesize

        264KB

      • memory/3356-41-0x0000000074830000-0x0000000074FE0000-memory.dmp
        Filesize

        7.7MB

      • memory/3356-27-0x0000000008530000-0x0000000008A5C000-memory.dmp
        Filesize

        5.2MB

      • memory/3356-14-0x00000000055B0000-0x00000000055C2000-memory.dmp
        Filesize

        72KB

      • memory/3356-17-0x00000000056E0000-0x00000000057EA000-memory.dmp
        Filesize

        1.0MB

      • memory/3356-19-0x0000000074830000-0x0000000074FE0000-memory.dmp
        Filesize

        7.7MB

      • memory/3356-20-0x0000000005650000-0x000000000569C000-memory.dmp
        Filesize

        304KB

      • memory/3356-18-0x0000000005610000-0x000000000564C000-memory.dmp
        Filesize

        240KB

      • memory/3356-16-0x00000000016E0000-0x00000000016F0000-memory.dmp
        Filesize

        64KB

      • memory/3356-13-0x0000000005B30000-0x0000000006148000-memory.dmp
        Filesize

        6.1MB

      • memory/3356-26-0x0000000007E30000-0x0000000007FF2000-memory.dmp
        Filesize

        1.8MB

      • memory/3356-24-0x00000000068F0000-0x000000000690E000-memory.dmp
        Filesize

        120KB

      • memory/3356-22-0x00000000064D0000-0x0000000006546000-memory.dmp
        Filesize

        472KB

      • memory/3356-23-0x00000000065F0000-0x0000000006682000-memory.dmp
        Filesize

        584KB

      • memory/4656-6-0x0000000002240000-0x0000000002250000-memory.dmp
        Filesize

        64KB

      • memory/4656-1-0x0000000074830000-0x0000000074FE0000-memory.dmp
        Filesize

        7.7MB

      • memory/4656-12-0x0000000074830000-0x0000000074FE0000-memory.dmp
        Filesize

        7.7MB

      • memory/4656-15-0x0000000002740000-0x0000000004740000-memory.dmp
        Filesize

        32.0MB

      • memory/4656-5-0x0000000005130000-0x0000000005182000-memory.dmp
        Filesize

        328KB

      • memory/4656-4-0x0000000004B80000-0x0000000005124000-memory.dmp
        Filesize

        5.6MB

      • memory/4656-0-0x0000000002510000-0x0000000002564000-memory.dmp
        Filesize

        336KB

      • memory/4656-2-0x0000000002240000-0x0000000002250000-memory.dmp
        Filesize

        64KB

      • memory/4656-43-0x0000000002740000-0x0000000004740000-memory.dmp
        Filesize

        32.0MB

      • memory/4656-3-0x0000000002240000-0x0000000002250000-memory.dmp
        Filesize

        64KB