Resubmissions
03/07/2024, 02:56
240703-dfad1sybkk 7Analysis
-
max time kernel
110s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/07/2024, 02:56
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Galaxy Swapper v2.exe
Resource
win7-20240220-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Galaxy Swapper v2.exe
Resource
win10v2004-20240508-en
3 signatures
150 seconds
General
-
Target
Galaxy Swapper v2.exe
-
Size
11.0MB
-
MD5
3f8047f9869475507e67ff25d0d996ab
-
SHA1
f7ae6034681c5f7e3397a92bedab84bb7dbfe3d0
-
SHA256
59ca3b7d1a0e4531b9fd618b870780f95811deac4b36580935fa88545e6f3f51
-
SHA512
55414d13f9c2f1b5b522fccdaa9096506d655026953dff43e90ac22a771ec426b9f4a079fc1975fb16d71b32cda0d2398eec8871570848209249fced6fa15b8a
-
SSDEEP
196608:3QA8cxhSfncS3J3w2gffH9tOb6ge2BZiHhWWiVbMOVvu8ovcLFwi4:358ESfTOtzGicWiVbMOVvuxvcL+i4
Score
7/10
Malware Config
Signatures
-
.NET Reactor proctector 62 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule behavioral2/memory/232-0-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-4-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-5-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-6-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-7-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-8-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-14-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-11-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-10-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-9-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-3-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-15-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-13-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-12-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-17-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-18-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-20-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-21-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-19-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-16-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-23-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-25-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-29-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-28-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-32-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-33-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-31-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-30-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-27-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-26-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-24-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-22-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-39-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-43-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-45-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-55-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-58-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-62-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-63-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-61-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-60-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-59-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-57-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-53-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-52-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-51-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-49-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-48-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-47-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-46-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-44-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-42-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-56-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-54-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-50-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-40-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-41-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-38-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-37-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-36-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-34-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor behavioral2/memory/232-35-0x00000217F4070000-0x00000217F47E0000-memory.dmp net_reactor -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 232 Galaxy Swapper v2.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 232 Galaxy Swapper v2.exe