13e4828dab5f4bb756b0344cf75aa170dfbb045e991a2ea02f040b1d2e32ef58

Analysis

Target

13e4828dab5f4bb756b0344cf75aa170dfbb045e991a2ea02f040b1d2e32ef58.exe
Size

15.5MB
MD5

94781760555781b76e9588585b4ee9dc
SHA1

af67e2dfdb2dc7f4478d2395808863108d079437
SHA256

13e4828dab5f4bb756b0344cf75aa170dfbb045e991a2ea02f040b1d2e32ef58
SHA512

ab8a110139cedf439630531b72da736f369b0379e53e89a2c78122ced7f27ed74e908a3317640272f0805c46a7b27aee2a59fe400dd53c1702ebdcfe4362b46a
SSDEEP

98304:JdLzoR0QyIxk2qv+MtK7i9C+88888888888SH:JdLzoR0sqv+MkO9

Score

7^/10

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/memory/708-6-0x00000252280B0000-0x00000252280D4000-memory.dmp	net_reactor

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
708	13e4828dab5f4bb756b0344cf75aa170dfbb045e991a2ea02f040b1d2e32ef58.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	708	13e4828dab5f4bb756b0344cf75aa170dfbb045e991a2ea02f040b1d2e32ef58.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 708 wrote to memory of 4792	708	13e4828dab5f4bb756b0344cf75aa170dfbb045e991a2ea02f040b1d2e32ef58.exe	82
PID 708 wrote to memory of 4792	708	13e4828dab5f4bb756b0344cf75aa170dfbb045e991a2ea02f040b1d2e32ef58.exe	82
PID 708 wrote to memory of 4792	708	13e4828dab5f4bb756b0344cf75aa170dfbb045e991a2ea02f040b1d2e32ef58.exe	82
PID 708 wrote to memory of 4792	708	13e4828dab5f4bb756b0344cf75aa170dfbb045e991a2ea02f040b1d2e32ef58.exe	82

C:\Users\Admin\AppData\Local\Temp\13e4828dab5f4bb756b0344cf75aa170dfbb045e991a2ea02f040b1d2e32ef58.exe
"C:\Users\Admin\AppData\Local\Temp\13e4828dab5f4bb756b0344cf75aa170dfbb045e991a2ea02f040b1d2e32ef58.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:708
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe"
  2⤵
  PID:4792

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/708-0-0x00007FFC60533000-0x00007FFC60535000-memory.dmp

Filesize
8KB

Download
memory/708-1-0x000002520CB30000-0x000002520DAB6000-memory.dmp

Filesize
15.5MB

Download
memory/708-2-0x00007FFC60530000-0x00007FFC60FF2000-memory.dmp

Filesize
10.8MB

Download
memory/708-5-0x00000252280D0000-0x00000252280E2000-memory.dmp

Filesize
72KB

Download
memory/708-6-0x00000252280B0000-0x00000252280D4000-memory.dmp

Filesize
144KB

Download
memory/708-8-0x00007FFC60530000-0x00007FFC60FF2000-memory.dmp

Filesize
10.8MB

Download
memory/708-10-0x00007FFC60530000-0x00007FFC60FF2000-memory.dmp

Filesize
10.8MB

Download
memory/4792-7-0x00007FFC10310000-0x00007FFC1032B000-memory.dmp

Filesize
108KB

Download
memory/4792-9-0x00007FFC80313000-0x00007FFC80314000-memory.dmp

Filesize
4KB

Download