Analysis
- max time kernel
142s - max time network
111s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
27/05/2024, 17:28
General
- Target data/dotNET_Reactor.Console.exe
- Size 14KB
- Sample240527-v2fllacf56
- SHA256 e817802f166662a7df0b144571354d74b10e34d120f91ae9d84ca3ba925241c6
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\data\dotNET_Reactor.Console.exe"C:\Users\Admin\AppData\Local\Temp\data\dotNET_Reactor.Console.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\data\dotNET_Reactor.exe"C:\Users\Admin\AppData\Local\Temp\data\dotNET_Reactor.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
ssapihook.dll
memory/2332-15-0x0000000000010000-0x0000000000011000-memory.dmp
memory/2332-16-0x0000000000020000-0x0000000000021000-memory.dmp
memory/2332-3-0x0000000000170000-0x0000000000768000-memory.dmp
memory/2332-4-0x00000000056C0000-0x0000000005C64000-memory.dmp
memory/2332-5-0x0000000005060000-0x00000000050F2000-memory.dmp
memory/2332-6-0x0000000074670000-0x0000000074E20000-memory.dmp
memory/2332-31-0x0000000074670000-0x0000000074E20000-memory.dmp
memory/2332-8-0x00000000075D0000-0x00000000075F0000-memory.dmp
memory/2332-9-0x0000000074670000-0x0000000074E20000-memory.dmp
memory/2332-10-0x0000000007940000-0x0000000007968000-memory.dmp
memory/2332-2-0x000000007467E000-0x000000007467F000-memory.dmp
memory/2332-7-0x0000000005150000-0x000000000515A000-memory.dmp
memory/2332-20-0x0000000000060000-0x0000000000061000-memory.dmp
memory/2332-17-0x0000000000030000-0x0000000000031000-memory.dmp
memory/2332-18-0x0000000000040000-0x0000000000041000-memory.dmp
memory/2332-19-0x0000000000050000-0x0000000000051000-memory.dmp
memory/2332-30-0x000000007467E000-0x000000007467F000-memory.dmp
memory/2332-21-0x0000000000070000-0x0000000000071000-memory.dmp
memory/2332-22-0x0000000000080000-0x0000000000081000-memory.dmp
memory/2332-23-0x0000000000090000-0x0000000000091000-memory.dmp
memory/2332-24-0x0000000009B30000-0x0000000009FFC000-memory.dmp
memory/2332-27-0x0000000074670000-0x0000000074E20000-memory.dmp
memory/4148-1-0x00007FFEE91C3000-0x00007FFEE91C5000-memory.dmp
memory/4148-0-0x0000000000360000-0x000000000036A000-memory.dmp