Resubmissions
01/11/2025, 17:32
251101-v4e3vaey7f1001/11/2025, 17:25
251101-vzl1laej5y1009/03/2025, 02:31
250309-cz3z1aw1gv09/03/2025, 02:31
250309-czqdxaw1fy25/12/2024, 11:40
241225-ns1f3ssmct1016/09/2024, 14:19
240916-rm5emascmp16/09/2024, 14:18
240916-rmcplsscjj01/08/2024, 04:21
240801-eyvcks1grk30/06/2024, 22:00
240630-1wpj7szfnn20/06/2024, 19:48
240620-yh42mavcpgAnalysis
- max time kernel
147s - max time network
97s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
01/06/2024, 22:28
General
- Target Court Project V1.1/iplookup.exe
- Size 2.1MB
- Sample240601-2d43lsgh7s
- SHA256 49945b5eb3f80e6bb9dba81c6c6f643245bb0831ce2f6e5abf4db12ab6709b76
Malware Config
Signatures
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Court Project V1.1\iplookup.exe"C:\Users\Admin\AppData\Local\Temp\Court Project V1.1\iplookup.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/872-0-0x0000000074C1E000-0x0000000074C1F000-memory.dmp
memory/872-1-0x0000000000550000-0x000000000076E000-memory.dmp
memory/872-2-0x00000000058A0000-0x0000000005E44000-memory.dmp
memory/872-3-0x00000000051F0000-0x0000000005282000-memory.dmp
memory/872-4-0x0000000074C10000-0x00000000753C0000-memory.dmp
memory/872-5-0x0000000074C10000-0x00000000753C0000-memory.dmp
memory/872-6-0x0000000005580000-0x000000000558A000-memory.dmp
memory/872-7-0x0000000074C10000-0x00000000753C0000-memory.dmp
memory/872-8-0x0000000074C1E000-0x0000000074C1F000-memory.dmp
memory/872-9-0x0000000074C10000-0x00000000753C0000-memory.dmp