Resubmissions
01/11/2025, 17:32
251101-v4e3vaey7f1001/11/2025, 17:25
251101-vzl1laej5y1009/03/2025, 02:31
250309-cz3z1aw1gv09/03/2025, 02:31
250309-czqdxaw1fy25/12/2024, 11:40
241225-ns1f3ssmct1016/09/2024, 14:19
240916-rm5emascmp16/09/2024, 14:18
240916-rmcplsscjj01/08/2024, 04:21
240801-eyvcks1grk30/06/2024, 22:00
240630-1wpj7szfnn20/06/2024, 19:48
240620-yh42mavcpgAnalysis
- max time kernel
119s - max time network
124s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
- submitted
01/06/2024, 22:28
General
- Target Court Project V1.1/iplookup.exe
- Size 2.1MB
- Sample240601-2d43lsgh7s
- SHA256 49945b5eb3f80e6bb9dba81c6c6f643245bb0831ce2f6e5abf4db12ab6709b76
Score
7/10
Malware Config
Signatures
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Court Project V1.1\iplookup.exe"C:\Users\Admin\AppData\Local\Temp\Court Project V1.1\iplookup.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2348-0-0x0000000073F8E000-0x0000000073F8F000-memory.dmp
memory/2348-1-0x00000000011A0000-0x00000000013BE000-memory.dmp
memory/2348-2-0x0000000073F80000-0x000000007466E000-memory.dmp
memory/2348-3-0x0000000073F80000-0x000000007466E000-memory.dmp
memory/2348-4-0x0000000073F80000-0x000000007466E000-memory.dmp
memory/2348-5-0x0000000073F8E000-0x0000000073F8F000-memory.dmp
memory/2348-6-0x0000000073F80000-0x000000007466E000-memory.dmp