Analysis
- max time kernel
131s - max time network
135s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
07/06/2024, 18:36
General
- Target v2dc/data/dotNET_Reactor.Console.exe
- Size 14KB
- Sample240607-w9d86sda34
- SHA256 e817802f166662a7df0b144571354d74b10e34d120f91ae9d84ca3ba925241c6
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\v2dc\data\dotNET_Reactor.Console.exe"C:\Users\Admin\AppData\Local\Temp\v2dc\data\dotNET_Reactor.Console.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\v2dc\data\dotNET_Reactor.exe"C:\Users\Admin\AppData\Local\Temp\v2dc\data\dotNET_Reactor.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
ssapihook.dll
memory/4400-1-0x00007FFC77063000-0x00007FFC77064000-memory.dmp
memory/4400-0-0x0000000000F30000-0x0000000000F3A000-memory.dmp
memory/4912-15-0x0000000000010000-0x0000000000011000-memory.dmp
memory/4912-17-0x0000000000030000-0x0000000000031000-memory.dmp
memory/4912-5-0x0000000005A30000-0x0000000005AC2000-memory.dmp
memory/4912-6-0x0000000073AA0000-0x000000007418E000-memory.dmp
memory/4912-7-0x0000000005C10000-0x0000000005C1A000-memory.dmp
memory/4912-8-0x00000000095A0000-0x00000000095BE000-memory.dmp
memory/4912-9-0x0000000073AA0000-0x000000007418E000-memory.dmp
memory/4912-10-0x0000000009720000-0x0000000009748000-memory.dmp
memory/4912-3-0x0000000000BC0000-0x00000000011B8000-memory.dmp
memory/4912-2-0x0000000073AAE000-0x0000000073AAF000-memory.dmp
memory/4912-16-0x0000000000020000-0x0000000000021000-memory.dmp
memory/4912-4-0x0000000005E20000-0x000000000631E000-memory.dmp
memory/4912-18-0x0000000000040000-0x0000000000041000-memory.dmp
memory/4912-19-0x0000000000050000-0x0000000000051000-memory.dmp
memory/4912-20-0x0000000000060000-0x0000000000061000-memory.dmp
memory/4912-21-0x0000000000070000-0x0000000000071000-memory.dmp
memory/4912-22-0x0000000000080000-0x0000000000081000-memory.dmp
memory/4912-23-0x0000000000090000-0x0000000000091000-memory.dmp
memory/4912-24-0x000000000A3A0000-0x000000000A86A000-memory.dmp
memory/4912-27-0x0000000073AA0000-0x000000007418E000-memory.dmp
memory/4912-30-0x0000000073AAE000-0x0000000073AAF000-memory.dmp
memory/4912-31-0x0000000073AA0000-0x000000007418E000-memory.dmp