Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
05/02/2026, 15:56
General
- Target 7419b292f77e62623a70a50d129c225c4d26fb53282f573f4e7f57242bbf946f.exe
- Size 1.4MB
- Sample260205-tdf2sact8d
- SHA256 7419b292f77e62623a70a50d129c225c4d26fb53282f573f4e7f57242bbf946f
Malware Config
Signatures
- .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Executes dropped EXE 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 25 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 25 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7419b292f77e62623a70a50d129c225c4d26fb53282f573f4e7f57242bbf946f.exe"C:\Users\Admin\AppData\Local\Temp\7419b292f77e62623a70a50d129c225c4d26fb53282f573f4e7f57242bbf946f.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 8 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "max" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\max.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 83⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "max" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\max.exe"3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 17 > nul && copy "C:\Users\Admin\AppData\Local\Temp\7419b292f77e62623a70a50d129c225c4d26fb53282f573f4e7f57242bbf946f.exe" "C:\Users\Admin\AppData\Roaming\max.exe" && ping 127.0.0.1 -n 17 > nul && "C:\Users\Admin\AppData\Roaming\max.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 173⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 173⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\max.exe"C:\Users\Admin\AppData\Roaming\max.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\max.exe"C:\Users\Admin\AppData\Roaming\max.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\max.exe"C:\Users\Admin\AppData\Roaming\max.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 5245⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 5285⤵
- Program crash
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 232 -ip 2321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 232 -ip 2321⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
max.exe
memory/1692-992-0x00000000074A0000-0x00000000074B6000-memory.dmp
memory/1692-993-0x000000000A680000-0x000000000A686000-memory.dmp
memory/2648-0-0x00000000002E0000-0x000000000044E000-memory.dmp
memory/2648-1-0x00000000053A0000-0x0000000005946000-memory.dmp
memory/2648-2-0x0000000004DF0000-0x0000000004E82000-memory.dmp
memory/2648-3-0x0000000004E90000-0x0000000004F2C000-memory.dmp
memory/2648-4-0x0000000005070000-0x0000000005080000-memory.dmp
memory/2648-5-0x0000000004DA0000-0x0000000004DAA000-memory.dmp
memory/2648-6-0x0000000006C20000-0x0000000006C70000-memory.dmp
memory/2648-14-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-20-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-132-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-130-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-128-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-126-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-124-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-122-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-120-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-118-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-116-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-114-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-112-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-110-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-108-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-106-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-104-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-102-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-100-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-98-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-96-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-90-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-88-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-86-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-84-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-82-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-80-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-78-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-76-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-74-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-70-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-68-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-66-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-64-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-62-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-60-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-58-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-56-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-54-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-52-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-50-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-48-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-46-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-44-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-40-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-38-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-36-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-34-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-32-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-30-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-28-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-26-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-24-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-22-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-18-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-16-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-12-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-10-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-8-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-93-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-94-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-72-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-42-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-7-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2648-495-0x0000000006DD0000-0x0000000006DD1000-memory.dmp
memory/2648-496-0x0000000006E50000-0x0000000006E66000-memory.dmp
memory/2648-497-0x0000000005070000-0x0000000005080000-memory.dmp