326e7a6d2ef4a3c189d75faf6b2ada8e49ab7154b17d1a9df0192b80d1c2bff4

Analysis

max time kernel
117s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12-08-2024 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9affc395665f6daff48eb4cbd2b68a0N.exe
Size

139KB
MD5

a9affc395665f6daff48eb4cbd2b68a0
SHA1

8617c5209b25578c93e99244126363cce8089a4b
SHA256

326e7a6d2ef4a3c189d75faf6b2ada8e49ab7154b17d1a9df0192b80d1c2bff4
SHA512

492bd2789b32438eb5e6cd1be5ef528d0a4f829e3a3801b518a8ee71ebe741ea1e55cccd985812236b26cc9e5413a21c7e37881e812cca28a3169f688d65d459
SSDEEP

3072:gOrsnR+7QHYce53+ZUSodEkyEMnO3bzIYYoZ3CYx:gsQ4rhaYEkyRGbzdh

Score

7^/10

discovery

Malware Config

Signatures

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/memory/996-1-0x0000000000390000-0x00000000003B8000-memory.dmp	net_reactor

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a9affc395665f6daff48eb4cbd2b68a0N.exe

C:\Users\Admin\AppData\Local\Temp\a9affc395665f6daff48eb4cbd2b68a0N.exe
"C:\Users\Admin\AppData\Local\Temp\a9affc395665f6daff48eb4cbd2b68a0N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/996-0-0x000000007495E000-0x000000007495F000-memory.dmp

Filesize
4KB

Download
memory/996-1-0x0000000000390000-0x00000000003B8000-memory.dmp

Filesize
160KB

Download
memory/996-2-0x0000000074950000-0x0000000075100000-memory.dmp

Filesize
7.7MB

Download
memory/996-3-0x000000007495E000-0x000000007495F000-memory.dmp

Filesize
4KB

Download
memory/996-4-0x0000000074950000-0x0000000075100000-memory.dmp

Filesize
7.7MB

Download