Analysis
- max time kernel
119s - max time network
126s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
- submitted
27/05/2024, 17:28
General
- Target data/dotNET_Reactor.Console.exe
- Size 14KB
- Sample240527-v2fllacf56
- SHA256 e817802f166662a7df0b144571354d74b10e34d120f91ae9d84ca3ba925241c6
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\data\dotNET_Reactor.Console.exe"C:\Users\Admin\AppData\Local\Temp\data\dotNET_Reactor.Console.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\data\dotNET_Reactor.exe"C:\Users\Admin\AppData\Local\Temp\data\dotNET_Reactor.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
ssapihook.dll
memory/1724-1-0x0000000001040000-0x000000000104A000-memory.dmp
memory/1724-24-0x000007FEF5783000-0x000007FEF5784000-memory.dmp
memory/1724-0-0x000007FEF5783000-0x000007FEF5784000-memory.dmp
memory/2920-12-0x0000000005930000-0x0000000005931000-memory.dmp
memory/2920-15-0x0000000005BB0000-0x0000000005BB1000-memory.dmp
memory/2920-6-0x0000000005B20000-0x0000000005B48000-memory.dmp
memory/2920-4-0x00000000743B0000-0x0000000074A9E000-memory.dmp
memory/2920-10-0x0000000005730000-0x0000000005731000-memory.dmp
memory/2920-11-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2920-3-0x0000000000E50000-0x0000000001448000-memory.dmp
memory/2920-13-0x0000000005B90000-0x0000000005B91000-memory.dmp
memory/2920-14-0x0000000005BA0000-0x0000000005BA1000-memory.dmp
memory/2920-5-0x00000000743B0000-0x0000000074A9E000-memory.dmp
memory/2920-16-0x0000000006530000-0x0000000006531000-memory.dmp
memory/2920-17-0x0000000006540000-0x0000000006541000-memory.dmp
memory/2920-18-0x0000000006550000-0x0000000006551000-memory.dmp
memory/2920-21-0x00000000743B0000-0x0000000074A9E000-memory.dmp
memory/2920-2-0x00000000743BE000-0x00000000743BF000-memory.dmp
memory/2920-25-0x00000000743BE000-0x00000000743BF000-memory.dmp
memory/2920-26-0x00000000743B0000-0x0000000074A9E000-memory.dmp