Analysis
- max time kernel
131s - max time network
136s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
07/06/2024, 18:36
General
- Target v2dc/data/dotNET_Reactor.exe
- Size 5.9MB
- Sample240607-w9d86sda34
- SHA256 78684aea83b1a5c402a87ba0ce2e7ad5b0338462cc804e97369203ce53d29834
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\v2dc\data\dotNET_Reactor.exe"C:\Users\Admin\AppData\Local\Temp\v2dc\data\dotNET_Reactor.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
ssapihook.dll
memory/4764-17-0x0000000000050000-0x0000000000051000-memory.dmp
memory/4764-20-0x0000000000080000-0x0000000000081000-memory.dmp
memory/4764-3-0x0000000004FD0000-0x0000000005062000-memory.dmp
memory/4764-4-0x0000000073580000-0x0000000073C6E000-memory.dmp
memory/4764-5-0x00000000051A0000-0x00000000051AA000-memory.dmp
memory/4764-6-0x0000000008C80000-0x0000000008C9E000-memory.dmp
memory/4764-7-0x0000000073580000-0x0000000073C6E000-memory.dmp
memory/4764-8-0x0000000008E00000-0x0000000008E28000-memory.dmp
memory/4764-1-0x0000000000160000-0x0000000000758000-memory.dmp
memory/4764-0-0x000000007358E000-0x000000007358F000-memory.dmp
memory/4764-2-0x00000000053E0000-0x00000000058DE000-memory.dmp
memory/4764-21-0x0000000000090000-0x0000000000091000-memory.dmp
memory/4764-18-0x0000000000060000-0x0000000000061000-memory.dmp
memory/4764-19-0x0000000000070000-0x0000000000071000-memory.dmp
memory/4764-16-0x0000000000040000-0x0000000000041000-memory.dmp
memory/4764-15-0x0000000000030000-0x0000000000031000-memory.dmp
memory/4764-14-0x0000000000020000-0x0000000000021000-memory.dmp
memory/4764-13-0x0000000000010000-0x0000000000011000-memory.dmp
memory/4764-22-0x0000000009A80000-0x0000000009F4A000-memory.dmp
memory/4764-25-0x0000000073580000-0x0000000073C6E000-memory.dmp
memory/4764-28-0x0000000073580000-0x0000000073C6E000-memory.dmp