Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
28/09/2024, 02:22
General
-
Target
1337v3 setup.exe
-
Size
3.4MB
-
MD5
4c75ef26b3ebdd27f01d5184f8b29558
-
SHA1
eef93934c7136b973f7339d8a61c36cd09c65b5d
-
SHA256
dc84efd6a2fb51aaa7e69a8674e4b2c60ceb48c3bff06a8e35777c6abb29569d
-
SHA512
8164093bc984b911dab71b7a8c0cd69c8f694bbaebf7bb78d29eb1c142eeb9e282a1f7f8ef768aa27f1905e686bcbc6fc796543078b5a3d0467e63b7f77591d8
-
SSDEEP
98304:9wRExOWP5ypYDj7nBOHMT2lG2NP8N52rYHu:37PT7nBOG2lG2NP8DO
Malware Config
Signatures
-
.NET Reactor proctector 34 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 9 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 19 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1337v3 setup.exe"C:\Users\Admin\AppData\Local\Temp\1337v3 setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-8TRP2.tmp\1337v3 setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-8TRP2.tmp\1337v3 setup.tmp" /SL5="$7024C,2641178,801792,C:\Users\Admin\AppData\Local\Temp\1337v3 setup.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\1337Spooferv3\1337spooferv3.exe"C:\Program Files (x86)\1337Spooferv3\1337spooferv3.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
701KB
MD5db9f1419f196d4c20e60a992e79ee331
SHA14c6754761dfb1c94eaaefca3056ae3ee0729d9ce
SHA256ce3abc58f54a17c27619832aa0edece56ad287b8777e7fd04686e1ccb04dec6b
SHA512bc03989c12bb11983e594cebd716b3a945d9995212780f7c7aa594507a5baaf43a96bbccdc3fc1188709d3dff23141e866c0e9c36f8663fc75e109661a65d0ba
-
Filesize
3.7MB
MD5de97f5f8b11269f60e9b0a0d66266a4c
SHA1ac01b2bf4238810c5db34b436f77de4c9182b1d7
SHA2567c6196edac2b156e5da4556f391d3486250960dab1d1ca093cd6cfdde59a3a84
SHA5129f196e961b8d4a1e4b3f2bf1ae4f2145978503f54460c28e95fd49b1998964f6d1c8fe8da3a6a48183d00c5645fbc28ba9d1dd1e875f008739085fb6e466ff87
-
Filesize
1.3MB
MD5750c58af2e56b6addecffcf152520ab8
SHA114995e7f1d12498606d9d209d78d55fe6fd87802
SHA25627c56a28cbde094157206da1bfcd7a395111ab97b8a5ff600b11c2175dcefb26
SHA5122179790e23f61b3dfea828457f8609279c70b1e071cddc73b1dbda02caa664e0aae2553fc24a4956f9e89c477d66b1a704bde26fa23bc6db26c19e18db00abb5
-
Filesize
3.1MB
MD5864eb8a38824e35b09700a9c8c7ac68a
SHA1984ac6070e9750f4b9a00872bd26cb1fba5ef374
SHA2564b73a053a2db29248a905a64797f67b2bfb784c2b0204af038c8e455f07d85c1
SHA51275c70636649b2525f36a4cf28063c66378e2782005c44cffb1ba2b91185028bafe6046e986f9bd06270ed846afa1417d6a657aef5dca70228e842831bb618383
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
856KB
-
Filesize
7.7MB
-
Filesize
828KB
-
Filesize
848KB
-
Filesize
7.7MB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
7.7MB
-
Filesize
828KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
584KB
-
Filesize
72KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
3.8MB
-
Filesize
7.7MB
-
Filesize
1.3MB
-
Filesize
80KB
-
Filesize
328KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
624KB
-
Filesize
7.7MB
-
Filesize
240KB
-
Filesize
672KB
-
Filesize
840KB
-
Filesize
4KB