Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3dotNET_Rea...t.html
windows11-21h2-x64
1dotNET_Rea...LP.exe
windows11-21h2-x64
4dotNET_Rea...C3.dll
windows11-21h2-x64
3dotNET_Rea...in.dll
windows11-21h2-x64
1dotNET_Rea...in.dll
windows11-21h2-x64
1dotNET_Rea...ge.dll
windows11-21h2-x64
1dotNET_Rea...ge.dll
windows11-21h2-x64
1dotNET_Rea...ge.dll
windows11-21h2-x64
1dotNET_Rea...ge.dll
windows11-21h2-x64
1dotNET_Rea...in.dll
windows11-21h2-x64
1dotNET_Rea...cc.dll
windows11-21h2-x64
1dotNET_Rea...le.exe
windows11-21h2-x64
10dotNET_Rea...or.exe
windows11-21h2-x64
10dotNET_Rea...64.dll
windows11-21h2-x64
1dotNET_Rea...86.dll
windows11-21h2-x64
3Analysis
-
max time kernel
90s -
max time network
96s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
19/04/2024, 14:52
Static task
static1
Behavioral task
behavioral1
Sample
dotNET_Reactor/Help/License Agreement.html
Resource
win11-20240412-en
Behavioral task
behavioral2
Sample
dotNET_Reactor/Help/REACTOR_HELP.exe
Resource
win11-20240412-en
Behavioral task
behavioral3
Sample
dotNET_Reactor/NCC3.dll
Resource
win11-20240412-en
Behavioral task
behavioral4
Sample
dotNET_Reactor/VS08ReactorAddin.dll
Resource
win11-20240412-en
Behavioral task
behavioral5
Sample
dotNET_Reactor/VS13ReactorAddin.dll
Resource
win11-20240412-en
Behavioral task
behavioral6
Sample
dotNET_Reactor/VSPackage/15/dotNETReactorVSPackage.dll
Resource
win11-20240412-en
Behavioral task
behavioral7
Sample
dotNET_Reactor/VSPackage/16/dotNETReactorVSPackage.dll
Resource
win11-20240412-en
Behavioral task
behavioral8
Sample
dotNET_Reactor/VSPackage/17/dotNETReactorVSPackage.dll
Resource
win11-20240412-en
Behavioral task
behavioral9
Sample
dotNET_Reactor/VSPackage/dotNET Reactor VSPackage.dll
Resource
win11-20240412-en
Behavioral task
behavioral10
Sample
dotNET_Reactor/VSReactorAddin.dll
Resource
win11-20240412-en
Behavioral task
behavioral11
Sample
dotNET_Reactor/VSReactorAddin_Mycc.dll
Resource
win11-20240412-en
Behavioral task
behavioral12
Sample
dotNET_Reactor/dotNET_Reactor.Console.exe
Resource
win11-20240412-en
Behavioral task
behavioral13
Sample
dotNET_Reactor/dotNET_Reactor.exe
Resource
win11-20240412-en
Behavioral task
behavioral14
Sample
dotNET_Reactor/runtimes/brolib_x64.dll
Resource
win11-20240412-en
Behavioral task
behavioral15
Sample
dotNET_Reactor/runtimes/brolib_x86.dll
Resource
win11-20240412-en
General
-
Target
dotNET_Reactor/NCC3.dll
-
Size
72KB
-
MD5
aa84f91edd922e7b3bb979e663c94f1a
-
SHA1
da46b9962a6c6cceef38c3e11b8b5bc9c1b536fa
-
SHA256
38274608d5a4b53ec22f8099f798ba46ce0ed41db65a33dfb3853f0dbf849f6f
-
SHA512
88392fc77a0300ece306908867be38011530d9eefdf003452ba86d82f2fa4a61c2b27a199f376ac307c095beaa4f52cefcab59c8b28fa187c0bca13f55f2d98b
-
SSDEEP
1536:a44UF/3qab79HtYDAD5MPEBq9iNv6qfSOBHfVW:a44G3fRMPiuuv6qqOBHfVW
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2296 1476 WerFault.exe 79 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2848 wrote to memory of 1476 2848 rundll32.exe 79 PID 2848 wrote to memory of 1476 2848 rundll32.exe 79 PID 2848 wrote to memory of 1476 2848 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dotNET_Reactor\NCC3.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dotNET_Reactor\NCC3.dll,#12⤵PID:1476
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 4523⤵
- Program crash
PID:2296
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1476 -ip 14761⤵PID:744