Analysis
- max time kernel
898s - max time network
428s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
20/04/2026, 15:33
General
- Target Patch.exe
- Size 373KB
- Sample260420-szev6set4m
- SHA256 b5dc1b008a4837859cc7b5e1e4a3017429aa975355abd84755fb193dbe0d1b9f
Malware Config
Signatures
- .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- SmartAssembly .NET packer 64 IoCs
Detects SmartAssembly .NET packer.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Patch.exe"C:\Users\Admin\AppData\Local\Temp\Patch.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/848-0-0x0000000004BE0000-0x0000000004BF0000-memory.dmp
memory/848-1-0x0000000004BF0000-0x0000000004C68000-memory.dmp
memory/848-2-0x0000000004BE0000-0x0000000004BF0000-memory.dmp
memory/848-3-0x0000000004C70000-0x0000000005216000-memory.dmp
memory/848-4-0x0000000005220000-0x0000000005296000-memory.dmp
memory/848-5-0x0000000004BE0000-0x0000000004BF0000-memory.dmp
memory/848-19-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-53-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-55-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-51-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-61-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-77-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-131-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-129-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-127-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-125-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-123-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-121-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-119-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-117-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-115-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-111-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-109-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-108-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-105-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-101-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-99-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-97-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-95-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-93-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-91-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-89-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-87-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-85-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-84-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-81-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-79-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-75-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-73-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-71-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-69-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-67-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-65-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-63-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-59-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-57-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-113-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-103-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-47-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-45-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-43-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-41-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-40-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-37-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-35-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-33-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-31-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-29-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-27-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-25-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-23-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-17-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-15-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-49-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-13-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-11-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-9-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-7-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-21-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-6-0x0000000005220000-0x0000000005290000-memory.dmp
memory/848-2132-0x0000000005410000-0x00000000054A2000-memory.dmp
memory/848-2133-0x0000000005600000-0x000000000560A000-memory.dmp
memory/848-2134-0x0000000005610000-0x0000000005624000-memory.dmp
memory/848-2135-0x0000000004BE0000-0x0000000004BF0000-memory.dmp
memory/848-2136-0x0000000004BE0000-0x0000000004BF0000-memory.dmp
memory/848-2137-0x0000000004BE0000-0x0000000004BF0000-memory.dmp
memory/848-2138-0x0000000004BE0000-0x0000000004BF0000-memory.dmp