Analysis
-
max time kernel
102s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
22/03/2025, 06:17
General
-
Target
db0b5b8185efd6ca7c3f569aec811ea6.exe
-
Size
5.6MB
-
MD5
db0b5b8185efd6ca7c3f569aec811ea6
-
SHA1
9b4c4966684020b351943b44bb3be066e23f2ccb
-
SHA256
d2b0f426014687a310ac74bfe78da227f506d163d6635527d115c0b96b5d0ab4
-
SHA512
891b19ba225e729d691906a5a3765c248a130c562cb587fe2fee507fd78a2f585e13d851ab23b32bbeed3f87d01cd2f2d50fde9ceaaffbc12f2de6e20f96408b
-
SSDEEP
98304:OvGBBkxCZS9bYZhID0qLNYfeW+4IkRpKMzVUp6QRDy:aGBBJDhID0qLNY64BR0MzVUp6QRDy
Malware Config
Signatures
-
.NET Reactor proctector 3 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\db0b5b8185efd6ca7c3f569aec811ea6.exe"C:\Users\Admin\AppData\Local\Temp\db0b5b8185efd6ca7c3f569aec811ea6.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /U "C:\Users\Admin\AppData\Roaming\LoaderV4\LoaderV4\1.0.0.0\RegsvcsRegasm X64.dll"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
207KB
MD506d5f500105e6dd6d423080dfbe915e4
SHA18bf682233a063fd93c9d5cc7bdfdc93a9e473beb
SHA256b27fa76d324d61489e0245a4373e2704627f8f006d6797cfbba70c5aa5fbdb47
SHA512b70ebb02d4a751adc82184fd97e337c371178f663e7e14197f97ea2954ffa766bf2bfe5dc5e999fbed6c885e9a8cd8d474cb082e3dd96bb7281f7a5c5441dd08
-
Filesize
8KB
-
Filesize
5.6MB
-
Filesize
1.5MB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
232KB
-
Filesize
232KB