Analysis

  • max time kernel
    41s
  • max time network
    48s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-11-2024 01:04

General

  • Target

    Quasar Golden Edition 1.4.1.0/Include/dotNET_Reactor.Console.exe

  • Size

    14KB

  • MD5

    0b4dbf61a98f3e34cdd3a1b08a6a4609

  • SHA1

    73587f1f5d040541b230513d22d696513dbd4cf9

  • SHA256

    e817802f166662a7df0b144571354d74b10e34d120f91ae9d84ca3ba925241c6

  • SHA512

    7cca370890e4e245c84507623531b5f54b76ced3e8c6b87cdfc47ed16560b6a0a5cf9e0556075cd0d9266908e445b854114edd69d50870839624589676c0e688

  • SSDEEP

    192:8jY53csvsqHwrHEdSAejbMfDn1Gp78dsKGXOdlWW1ksTkwy:8jEnskskQlm1GRJKGXOdlWW1XTR

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 20 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Quasar Golden Edition 1.4.1.0\Include\dotNET_Reactor.Console.exe
    "C:\Users\Admin\AppData\Local\Temp\Quasar Golden Edition 1.4.1.0\Include\dotNET_Reactor.Console.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3700
    • C:\Users\Admin\AppData\Local\Temp\Quasar Golden Edition 1.4.1.0\Include\dotNET_Reactor.exe
      "C:\Users\Admin\AppData\Local\Temp\Quasar Golden Edition 1.4.1.0\Include\dotNET_Reactor.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:3476

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\SkinSoft\dotNET_Reactor\x86\ssapihook.dll

    Filesize

    68KB

    MD5

    bc6887aa21e7794a2c27e3ffd3dc3ed0

    SHA1

    2b845941c93094d7203553582f69d0c61a9fcee4

    SHA256

    919130e16d33fd58d0370b06b7fb0fc253f5b571fc33ad5c21eb8dafe4760c94

    SHA512

    9e952ae72851ba081809ea5d7a86108b0355f0882bae912e0ecf931fde2e878994142b6c16094473305392981439e49d9a32aa6aaf94edd07238a0ecb787e834

  • memory/3476-17-0x0000000000020000-0x0000000000021000-memory.dmp

    Filesize

    4KB

  • memory/3476-5-0x0000000005E40000-0x0000000005ED2000-memory.dmp

    Filesize

    584KB

  • memory/3476-18-0x0000000000030000-0x0000000000031000-memory.dmp

    Filesize

    4KB

  • memory/3476-4-0x0000000006350000-0x00000000068F4000-memory.dmp

    Filesize

    5.6MB

  • memory/3476-19-0x0000000000040000-0x0000000000041000-memory.dmp

    Filesize

    4KB

  • memory/3476-6-0x0000000005F50000-0x0000000005FB6000-memory.dmp

    Filesize

    408KB

  • memory/3476-7-0x0000000075210000-0x00000000759C0000-memory.dmp

    Filesize

    7.7MB

  • memory/3476-8-0x0000000006DD0000-0x0000000006DDA000-memory.dmp

    Filesize

    40KB

  • memory/3476-9-0x0000000075210000-0x00000000759C0000-memory.dmp

    Filesize

    7.7MB

  • memory/3476-10-0x000000000A270000-0x000000000A290000-memory.dmp

    Filesize

    128KB

  • memory/3476-11-0x000000000A410000-0x000000000A438000-memory.dmp

    Filesize

    160KB

  • memory/3476-20-0x0000000000050000-0x0000000000051000-memory.dmp

    Filesize

    4KB

  • memory/3476-16-0x0000000000010000-0x0000000000011000-memory.dmp

    Filesize

    4KB

  • memory/3476-39-0x0000000075210000-0x00000000759C0000-memory.dmp

    Filesize

    7.7MB

  • memory/3476-3-0x0000000000E50000-0x0000000001422000-memory.dmp

    Filesize

    5.8MB

  • memory/3476-2-0x000000007521E000-0x000000007521F000-memory.dmp

    Filesize

    4KB

  • memory/3476-38-0x0000000075210000-0x00000000759C0000-memory.dmp

    Filesize

    7.7MB

  • memory/3476-21-0x0000000000060000-0x0000000000061000-memory.dmp

    Filesize

    4KB

  • memory/3476-22-0x0000000000070000-0x0000000000071000-memory.dmp

    Filesize

    4KB

  • memory/3476-23-0x0000000000080000-0x0000000000081000-memory.dmp

    Filesize

    4KB

  • memory/3476-24-0x0000000000090000-0x0000000000091000-memory.dmp

    Filesize

    4KB

  • memory/3476-25-0x000000000B040000-0x000000000B50C000-memory.dmp

    Filesize

    4.8MB

  • memory/3476-31-0x0000000075210000-0x00000000759C0000-memory.dmp

    Filesize

    7.7MB

  • memory/3476-37-0x0000000075210000-0x00000000759C0000-memory.dmp

    Filesize

    7.7MB

  • memory/3476-35-0x000000007521E000-0x000000007521F000-memory.dmp

    Filesize

    4KB

  • memory/3476-36-0x0000000075210000-0x00000000759C0000-memory.dmp

    Filesize

    7.7MB

  • memory/3700-34-0x00007FFA1ADC3000-0x00007FFA1ADC5000-memory.dmp

    Filesize

    8KB

  • memory/3700-1-0x0000000000450000-0x000000000045A000-memory.dmp

    Filesize

    40KB

  • memory/3700-0-0x00007FFA1ADC3000-0x00007FFA1ADC5000-memory.dmp

    Filesize

    8KB