Analysis
- max time kernel
12s - platform
windows10-1703_x64 - resource
win10-20240404-fr - resource tags
- submitted
08/06/2024, 09:22
General
- Target Euro Truck Simulator 2 v1.16.x.x - v1.50.x.x Plus +15 Trainer.exe
- Size 1.4MB
- Sample240608-lb1dmsaf7t
- SHA256 a9381acdda22cc627242244cebe8a4a68ed2c43d9da804271efd62ed8bb2a0f1
Score
7/10
Malware Config
Signatures
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Euro Truck Simulator 2 v1.16.x.x - v1.50.x.x Plus +15 Trainer.exe"C:\Users\Admin\AppData\Local\Temp\Euro Truck Simulator 2 v1.16.x.x - v1.50.x.x Plus +15 Trainer.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1688-0-0x00007FFF69763000-0x00007FFF69764000-memory.dmp
memory/1688-1-0x0000014174330000-0x000001417447E000-memory.dmp
memory/1688-2-0x00007FFF69760000-0x00007FFF6A14C000-memory.dmp
memory/1688-3-0x00007FFF69760000-0x00007FFF6A14C000-memory.dmp
memory/1688-4-0x0000014174640000-0x0000014174714000-memory.dmp
memory/1688-5-0x00007FFF69760000-0x00007FFF6A14C000-memory.dmp
memory/1688-6-0x00007FFF69760000-0x00007FFF6A14C000-memory.dmp
memory/1688-7-0x00007FFF69760000-0x00007FFF6A14C000-memory.dmp