627cf61a2ed02f2700095f62b8c6dabb11d7567ee6856b14f5fa3afc5394938d

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 01:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

627cf61a2ed02f2700095f62b8c6dabb11d7567ee6856b14f5fa3afc5394938d.exe
Size

353KB
MD5

38e028de34a06fe37e3b766bda4bbaaf
SHA1

bcd4c3b8e7dfeb57da564b2f09d2eae6fbd7c116
SHA256

627cf61a2ed02f2700095f62b8c6dabb11d7567ee6856b14f5fa3afc5394938d
SHA512

3cdda520e43426cd8d80891990a0b61533f6a4e226b5ae8f4573cc6fe8744d57dcd846f243138deec018900a46ff0ee20c42f10dd5109a6542a81c8182d875b7
SSDEEP

6144:HDKW1Lgbdl0TBBvjc/muoZ8+VBSLKOVYXbPlrwHuTUHiUbiqg:jh1Lk70TnvjcnolVBSLKrDl8HugZLg

Score

7^/10

discovery

Malware Config

Signatures

.NET Reactor proctector 35 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/592-1-0x0000000004660000-0x00000000046D6000-memory.dmp	net_reactor
behavioral1/memory/592-3-0x0000000004860000-0x00000000048D4000-memory.dmp	net_reactor
behavioral1/memory/592-6-0x0000000004860000-0x00000000048CE000-memory.dmp	net_reactor
behavioral1/memory/592-7-0x0000000004860000-0x00000000048CE000-memory.dmp	net_reactor
behavioral1/memory/592-9-0x0000000004860000-0x00000000048CE000-memory.dmp	net_reactor
behavioral1/memory/592-11-0x0000000004860000-0x00000000048CE000-memory.dmp	net_reactor
behavioral1/memory/592-21-0x0000000004860000-0x00000000048CE000-memory.dmp	net_reactor
behavioral1/memory/592-19-0x0000000004860000-0x00000000048CE000-memory.dmp	net_reactor
behavioral1/memory/592-27-0x0000000004860000-0x00000000048CE000-memory.dmp	net_reactor
behavioral1/memory/592-29-0x0000000004860000-0x00000000048CE000-memory.dmp	net_reactor
behavioral1/memory/592-31-0x0000000004860000-0x00000000048CE000-memory.dmp	net_reactor
behavioral1/memory/592-25-0x0000000004860000-0x00000000048CE000-memory.dmp	net_reactor
behavioral1/memory/592-41-0x0000000004860000-0x00000000048CE000-memory.dmp	net_reactor
behavioral1/memory/592-57-0x0000000004860000-0x00000000048CE000-memory.dmp	net_reactor
behavioral1/memory/592-67-0x0000000004860000-0x00000000048CE000-memory.dmp	net_reactor
behavioral1/memory/592-53-0x0000000004860000-0x00000000048CE000-memory.dmp	net_reactor
behavioral1/memory/592-51-0x0000000004860000-0x00000000048CE000-memory.dmp	net_reactor
behavioral1/memory/592-49-0x0000000004860000-0x00000000048CE000-memory.dmp	net_reactor
behavioral1/memory/592-47-0x0000000004860000-0x00000000048CE000-memory.dmp	net_reactor
behavioral1/memory/592-45-0x0000000004860000-0x00000000048CE000-memory.dmp	net_reactor
behavioral1/memory/592-43-0x0000000004860000-0x00000000048CE000-memory.dmp	net_reactor
behavioral1/memory/592-39-0x0000000004860000-0x00000000048CE000-memory.dmp	net_reactor
behavioral1/memory/592-37-0x0000000004860000-0x00000000048CE000-memory.dmp	net_reactor
behavioral1/memory/592-35-0x0000000004860000-0x00000000048CE000-memory.dmp	net_reactor
behavioral1/memory/592-33-0x0000000004860000-0x00000000048CE000-memory.dmp	net_reactor
behavioral1/memory/592-23-0x0000000004860000-0x00000000048CE000-memory.dmp	net_reactor
behavioral1/memory/592-17-0x0000000004860000-0x00000000048CE000-memory.dmp	net_reactor
behavioral1/memory/592-15-0x0000000004860000-0x00000000048CE000-memory.dmp	net_reactor
behavioral1/memory/592-13-0x0000000004860000-0x00000000048CE000-memory.dmp	net_reactor
behavioral1/memory/592-69-0x0000000004860000-0x00000000048CE000-memory.dmp	net_reactor
behavioral1/memory/592-65-0x0000000004860000-0x00000000048CE000-memory.dmp	net_reactor
behavioral1/memory/592-63-0x0000000004860000-0x00000000048CE000-memory.dmp	net_reactor
behavioral1/memory/592-61-0x0000000004860000-0x00000000048CE000-memory.dmp	net_reactor
behavioral1/memory/592-59-0x0000000004860000-0x00000000048CE000-memory.dmp	net_reactor
behavioral1/memory/592-55-0x0000000004860000-0x00000000048CE000-memory.dmp	net_reactor

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	627cf61a2ed02f2700095f62b8c6dabb11d7567ee6856b14f5fa3afc5394938d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	592	627cf61a2ed02f2700095f62b8c6dabb11d7567ee6856b14f5fa3afc5394938d.exe

C:\Users\Admin\AppData\Local\Temp\627cf61a2ed02f2700095f62b8c6dabb11d7567ee6856b14f5fa3afc5394938d.exe
"C:\Users\Admin\AppData\Local\Temp\627cf61a2ed02f2700095f62b8c6dabb11d7567ee6856b14f5fa3afc5394938d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/592-0-0x000000007403E000-0x000000007403F000-memory.dmp

Filesize
4KB

Download
memory/592-1-0x0000000004660000-0x00000000046D6000-memory.dmp

Filesize
472KB

Download
memory/592-2-0x0000000074030000-0x000000007471E000-memory.dmp

Filesize
6.9MB

Download
memory/592-3-0x0000000004860000-0x00000000048D4000-memory.dmp

Filesize
464KB

Download
memory/592-4-0x0000000074030000-0x000000007471E000-memory.dmp

Filesize
6.9MB

Download
memory/592-5-0x0000000074030000-0x000000007471E000-memory.dmp

Filesize
6.9MB

Download
memory/592-6-0x0000000004860000-0x00000000048CE000-memory.dmp

Filesize
440KB

Download
memory/592-7-0x0000000004860000-0x00000000048CE000-memory.dmp

Filesize
440KB

Download
memory/592-9-0x0000000004860000-0x00000000048CE000-memory.dmp

Filesize
440KB

Download
memory/592-11-0x0000000004860000-0x00000000048CE000-memory.dmp

Filesize
440KB

Download
memory/592-21-0x0000000004860000-0x00000000048CE000-memory.dmp

Filesize
440KB

Download
memory/592-19-0x0000000004860000-0x00000000048CE000-memory.dmp

Filesize
440KB

Download
memory/592-27-0x0000000004860000-0x00000000048CE000-memory.dmp

Filesize
440KB

Download
memory/592-29-0x0000000004860000-0x00000000048CE000-memory.dmp

Filesize
440KB

Download
memory/592-31-0x0000000004860000-0x00000000048CE000-memory.dmp

Filesize
440KB

Download
memory/592-25-0x0000000004860000-0x00000000048CE000-memory.dmp

Filesize
440KB

Download
memory/592-41-0x0000000004860000-0x00000000048CE000-memory.dmp

Filesize
440KB

Download
memory/592-57-0x0000000004860000-0x00000000048CE000-memory.dmp

Filesize
440KB

Download
memory/592-67-0x0000000004860000-0x00000000048CE000-memory.dmp

Filesize
440KB

Download
memory/592-53-0x0000000004860000-0x00000000048CE000-memory.dmp

Filesize
440KB

Download
memory/592-51-0x0000000004860000-0x00000000048CE000-memory.dmp

Filesize
440KB

Download
memory/592-49-0x0000000004860000-0x00000000048CE000-memory.dmp

Filesize
440KB

Download
memory/592-47-0x0000000004860000-0x00000000048CE000-memory.dmp

Filesize
440KB

Download
memory/592-45-0x0000000004860000-0x00000000048CE000-memory.dmp

Filesize
440KB

Download
memory/592-43-0x0000000004860000-0x00000000048CE000-memory.dmp

Filesize
440KB

Download
memory/592-39-0x0000000004860000-0x00000000048CE000-memory.dmp

Filesize
440KB

Download
memory/592-37-0x0000000004860000-0x00000000048CE000-memory.dmp

Filesize
440KB

Download
memory/592-35-0x0000000004860000-0x00000000048CE000-memory.dmp

Filesize
440KB

Download
memory/592-33-0x0000000004860000-0x00000000048CE000-memory.dmp

Filesize
440KB

Download
memory/592-23-0x0000000004860000-0x00000000048CE000-memory.dmp

Filesize
440KB

Download
memory/592-17-0x0000000004860000-0x00000000048CE000-memory.dmp

Filesize
440KB

Download
memory/592-15-0x0000000004860000-0x00000000048CE000-memory.dmp

Filesize
440KB

Download
memory/592-13-0x0000000004860000-0x00000000048CE000-memory.dmp

Filesize
440KB

Download
memory/592-109-0x0000000074030000-0x000000007471E000-memory.dmp

Filesize
6.9MB

Download
memory/592-69-0x0000000004860000-0x00000000048CE000-memory.dmp

Filesize
440KB

Download
memory/592-65-0x0000000004860000-0x00000000048CE000-memory.dmp

Filesize
440KB

Download
memory/592-63-0x0000000004860000-0x00000000048CE000-memory.dmp

Filesize
440KB

Download
memory/592-61-0x0000000004860000-0x00000000048CE000-memory.dmp

Filesize
440KB

Download
memory/592-59-0x0000000004860000-0x00000000048CE000-memory.dmp

Filesize
440KB

Download
memory/592-55-0x0000000004860000-0x00000000048CE000-memory.dmp

Filesize
440KB

Download
memory/592-2155-0x0000000005010000-0x000000000501A000-memory.dmp

Filesize
40KB

Download
memory/592-2156-0x0000000074030000-0x000000007471E000-memory.dmp

Filesize
6.9MB

Download
memory/592-2157-0x000000007403E000-0x000000007403F000-memory.dmp

Filesize
4KB

Download
memory/592-2158-0x0000000074030000-0x000000007471E000-memory.dmp

Filesize
6.9MB

Download