Analysis
-
max time kernel
1s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
04-02-2024 08:33
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20231222-en
General
-
Target
tmp.exe
-
Size
421KB
-
MD5
10a331a12ca40f3293dfadfcecb8d071
-
SHA1
ada41586d1366cf76c9a652a219a0e0562cc41af
-
SHA256
b58eec6e5aabc701404d5b5556c86fff5cc103c69eeda00061e838c4f122288f
-
SHA512
1a5b8e77ddbab97bb4c848adbcd7dbfb9ca84307d1844dba9572fcea48a2cbb091a3fc52663b87568416adf18a1338adc07aab0bd5f1ab36a03c8ff8a035d399
-
SSDEEP
12288:jh1Fk70TnvjcL8o0S86aZ+ldnqA1W0PeF7H:5k70TrcJX32ih1Re7H
Malware Config
Signatures
-
.NET Reactor proctector 2 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Processes:
resource yara_rule behavioral2/memory/4656-0-0x0000000002510000-0x0000000002564000-memory.dmp net_reactor behavioral2/memory/4656-5-0x0000000005130000-0x0000000005182000-memory.dmp net_reactor -
Suspicious use of SetThreadContext 1 IoCs
Processes:
tmp.exedescription pid process target process PID 4656 set thread context of 3356 4656 tmp.exe RegAsm.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
tmp.exedescription pid process target process PID 4656 wrote to memory of 3356 4656 tmp.exe RegAsm.exe PID 4656 wrote to memory of 3356 4656 tmp.exe RegAsm.exe PID 4656 wrote to memory of 3356 4656 tmp.exe RegAsm.exe PID 4656 wrote to memory of 3356 4656 tmp.exe RegAsm.exe PID 4656 wrote to memory of 3356 4656 tmp.exe RegAsm.exe PID 4656 wrote to memory of 3356 4656 tmp.exe RegAsm.exe PID 4656 wrote to memory of 3356 4656 tmp.exe RegAsm.exe PID 4656 wrote to memory of 3356 4656 tmp.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exeFilesize
4KB
MD5a5ce3aba68bdb438e98b1d0c70a3d95c
SHA1013f5aa9057bf0b3c0c24824de9d075434501354
SHA2569b860be98a046ea97a7f67b006e0b1bc9ab7731dd2a0f3a9fd3d710f6c43278a
SHA5127446f1256873b51a59b9d2d3498cef5a41dbce55864c2a5fb8cb7d25f7d6e6d8ea249d551a45b75d99b1ad0d6fb4b5e4544e5ca77bcd627717d6598b5f566a79
-
memory/2296-44-0x00007FF913660000-0x00007FF914121000-memory.dmpFilesize
10.8MB
-
memory/2296-42-0x00007FF913660000-0x00007FF914121000-memory.dmpFilesize
10.8MB
-
memory/2296-40-0x0000000000790000-0x0000000000798000-memory.dmpFilesize
32KB
-
memory/3356-25-0x0000000007970000-0x00000000079C0000-memory.dmpFilesize
320KB
-
memory/3356-21-0x0000000005930000-0x0000000005996000-memory.dmpFilesize
408KB
-
memory/3356-9-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/3356-41-0x0000000074830000-0x0000000074FE0000-memory.dmpFilesize
7.7MB
-
memory/3356-27-0x0000000008530000-0x0000000008A5C000-memory.dmpFilesize
5.2MB
-
memory/3356-14-0x00000000055B0000-0x00000000055C2000-memory.dmpFilesize
72KB
-
memory/3356-17-0x00000000056E0000-0x00000000057EA000-memory.dmpFilesize
1.0MB
-
memory/3356-19-0x0000000074830000-0x0000000074FE0000-memory.dmpFilesize
7.7MB
-
memory/3356-20-0x0000000005650000-0x000000000569C000-memory.dmpFilesize
304KB
-
memory/3356-18-0x0000000005610000-0x000000000564C000-memory.dmpFilesize
240KB
-
memory/3356-16-0x00000000016E0000-0x00000000016F0000-memory.dmpFilesize
64KB
-
memory/3356-13-0x0000000005B30000-0x0000000006148000-memory.dmpFilesize
6.1MB
-
memory/3356-26-0x0000000007E30000-0x0000000007FF2000-memory.dmpFilesize
1.8MB
-
memory/3356-24-0x00000000068F0000-0x000000000690E000-memory.dmpFilesize
120KB
-
memory/3356-22-0x00000000064D0000-0x0000000006546000-memory.dmpFilesize
472KB
-
memory/3356-23-0x00000000065F0000-0x0000000006682000-memory.dmpFilesize
584KB
-
memory/4656-6-0x0000000002240000-0x0000000002250000-memory.dmpFilesize
64KB
-
memory/4656-1-0x0000000074830000-0x0000000074FE0000-memory.dmpFilesize
7.7MB
-
memory/4656-12-0x0000000074830000-0x0000000074FE0000-memory.dmpFilesize
7.7MB
-
memory/4656-15-0x0000000002740000-0x0000000004740000-memory.dmpFilesize
32.0MB
-
memory/4656-5-0x0000000005130000-0x0000000005182000-memory.dmpFilesize
328KB
-
memory/4656-4-0x0000000004B80000-0x0000000005124000-memory.dmpFilesize
5.6MB
-
memory/4656-0-0x0000000002510000-0x0000000002564000-memory.dmpFilesize
336KB
-
memory/4656-2-0x0000000002240000-0x0000000002250000-memory.dmpFilesize
64KB
-
memory/4656-43-0x0000000002740000-0x0000000004740000-memory.dmpFilesize
32.0MB
-
memory/4656-3-0x0000000002240000-0x0000000002250000-memory.dmpFilesize
64KB