Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
07/08/2024, 19:03
General
-
Target
Updater.exe
-
Size
3.5MB
-
MD5
65249c19d6b1e83f2932e16266b6beaa
-
SHA1
e0d8071db1898dcbf2e45a5a3431ab6c267edf78
-
SHA256
cd13dd81615c2f99febb8c236aca3fbe5cd64c1e78ceefd3997c42c1b74cf0dc
-
SHA512
0b6fb3daf9d3d0a925214dc824ccd57f8f3d3e6ee11b0e36ca075d56195564625496ca88f77502da83a27b70a9e2200f90aad1a0f5f1d698e884aae1d2f65290
-
SSDEEP
49152:FELlSldIsZp2Q+8vc7sAh1lo67f95n0XkW1YYxutwc/rOuHQZwcwF4JC:FE8ldVZpn+8vcAAdjj0X9sDuw3F5
Score
7/10
Malware Config
Signatures
-
.NET Reactor proctector 2 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Updater.exe"C:\Users\Admin\AppData\Local\Temp\Updater.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
128KB
-
Filesize
6.9MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
20KB
-
Filesize
20KB
-
Filesize
20KB
-
Filesize
20KB
-
Filesize
20KB
-
Filesize
1.1MB
-
Filesize
6.9MB
-
Filesize
6.9MB