abed6f09999c18d12d84a49fb67b12cd4a2ca7a79fa365cecd9d955c3364ff5c

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/06/2024, 00:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abed6f09999c18d12d84a49fb67b12cd4a2ca7a79fa365cecd9d955c3364ff5c.exe
Size

5.1MB
MD5

80b4a765ed935f41c378ac4ae985f72b
SHA1

5d0e9d4e18da85ca394f7b698a57a4763bd97f82
SHA256

abed6f09999c18d12d84a49fb67b12cd4a2ca7a79fa365cecd9d955c3364ff5c
SHA512

07c00704e16b8361d82a2f3418aef1730474c69ceb5fb2542eaed24224b2d2fd214d8cc0f82b5546a09f9db53f75052c584c37008257a52ee3912aa59da193d1
SSDEEP

98304:WGCsyIF+m4RdaWl6eKuFrKQPUNYVsYnVK13z9OI:WGCjRY7eXc2No13zA

Score

7^/10

Malware Config

Signatures

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/2188-1-0x0000000000850000-0x0000000000D6A000-memory.dmp	net_reactor

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2188 set thread context of 2588	2188	abed6f09999c18d12d84a49fb67b12cd4a2ca7a79fa365cecd9d955c3364ff5c.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2188	abed6f09999c18d12d84a49fb67b12cd4a2ca7a79fa365cecd9d955c3364ff5c.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2588	2188	abed6f09999c18d12d84a49fb67b12cd4a2ca7a79fa365cecd9d955c3364ff5c.exe	28
PID 2188 wrote to memory of 2588	2188	abed6f09999c18d12d84a49fb67b12cd4a2ca7a79fa365cecd9d955c3364ff5c.exe	28
PID 2188 wrote to memory of 2588	2188	abed6f09999c18d12d84a49fb67b12cd4a2ca7a79fa365cecd9d955c3364ff5c.exe	28
PID 2188 wrote to memory of 2588	2188	abed6f09999c18d12d84a49fb67b12cd4a2ca7a79fa365cecd9d955c3364ff5c.exe	28
PID 2188 wrote to memory of 2588	2188	abed6f09999c18d12d84a49fb67b12cd4a2ca7a79fa365cecd9d955c3364ff5c.exe	28
PID 2188 wrote to memory of 2588	2188	abed6f09999c18d12d84a49fb67b12cd4a2ca7a79fa365cecd9d955c3364ff5c.exe	28
PID 2188 wrote to memory of 2588	2188	abed6f09999c18d12d84a49fb67b12cd4a2ca7a79fa365cecd9d955c3364ff5c.exe	28
PID 2188 wrote to memory of 2588	2188	abed6f09999c18d12d84a49fb67b12cd4a2ca7a79fa365cecd9d955c3364ff5c.exe	28
PID 2188 wrote to memory of 2588	2188	abed6f09999c18d12d84a49fb67b12cd4a2ca7a79fa365cecd9d955c3364ff5c.exe	28
PID 2188 wrote to memory of 2588	2188	abed6f09999c18d12d84a49fb67b12cd4a2ca7a79fa365cecd9d955c3364ff5c.exe	28
PID 2188 wrote to memory of 2588	2188	abed6f09999c18d12d84a49fb67b12cd4a2ca7a79fa365cecd9d955c3364ff5c.exe	28
PID 2188 wrote to memory of 2588	2188	abed6f09999c18d12d84a49fb67b12cd4a2ca7a79fa365cecd9d955c3364ff5c.exe	28
PID 2188 wrote to memory of 2588	2188	abed6f09999c18d12d84a49fb67b12cd4a2ca7a79fa365cecd9d955c3364ff5c.exe	28
PID 2188 wrote to memory of 2588	2188	abed6f09999c18d12d84a49fb67b12cd4a2ca7a79fa365cecd9d955c3364ff5c.exe	28

C:\Users\Admin\AppData\Local\Temp\abed6f09999c18d12d84a49fb67b12cd4a2ca7a79fa365cecd9d955c3364ff5c.exe
"C:\Users\Admin\AppData\Local\Temp\abed6f09999c18d12d84a49fb67b12cd4a2ca7a79fa365cecd9d955c3364ff5c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2188-27-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2188-25-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2188-23-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2188-0-0x00000000743FE000-0x00000000743FF000-memory.dmp

Filesize
4KB

Download
memory/2188-57-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2188-55-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2188-53-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2188-51-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2188-49-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2188-47-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2188-46-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2188-44-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2188-41-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2188-39-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2188-66-0x00000000743F0000-0x0000000074ADE000-memory.dmp

Filesize
6.9MB

Download
memory/2188-37-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2188-35-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2188-34-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2188-31-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2188-29-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2188-1-0x0000000000850000-0x0000000000D6A000-memory.dmp

Filesize
5.1MB

Download
memory/2188-81-0x00000000743F0000-0x0000000074ADE000-memory.dmp

Filesize
6.9MB

Download
memory/2188-2-0x00000000743F0000-0x0000000074ADE000-memory.dmp

Filesize
6.9MB

Download
memory/2188-21-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2188-19-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2188-17-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2188-15-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2188-12-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2188-9-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2188-65-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2188-63-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2188-61-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2188-60-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2188-7-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2188-6-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2188-13-0x0000000000450000-0x0000000000465000-memory.dmp

Filesize
84KB

Download
memory/2188-5-0x0000000000450000-0x000000000046C000-memory.dmp

Filesize
112KB

Download
memory/2188-4-0x0000000006AC0000-0x0000000006CEA000-memory.dmp

Filesize
2.2MB

Download
memory/2188-3-0x00000000051C0000-0x0000000005410000-memory.dmp

Filesize
2.3MB

Download
memory/2588-69-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/2588-70-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/2588-68-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download