Analysis
- user interaction
yes - max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
28/04/2026, 09:24
General
- Target Exambrowsersetup.exe
- Size 229KB
- Sample260428-lc6xtafx21
- SHA256 25816da6093c0101e7ceda9c79e8b4949eba518ebd5bafbbc019e608d464769c
Malware Config
Signatures
- .NET Reactor proctector 2 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies system certificate store 2 TTPs 6 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Exambrowsersetup.exe"C:\Users\Admin\AppData\Local\Temp\Exambrowsersetup.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c powershell -command "$shell = new-object -com shell.application; $zip = $shell.NameSpace('C:\ProgramData\exambrowsersetup\update.zip'); foreach ($item in $zip.items()) {$shell.Namespace('C:\ProgramData\exambrowsersetup\installer').CopyHere($item, 0x14)}"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "$shell = new-object -com shell.application; $zip = $shell.NameSpace('C:\ProgramData\exambrowsersetup\update.zip'); foreach ($item in $zip.items()) {$shell.Namespace('C:\ProgramData\exambrowsersetup\installer').CopyHere($item, 0x14)}"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\ProgramData\exambrowsersetup\installer\ExamBrowser.exe"C:\ProgramData\exambrowsersetup\installer\ExamBrowser.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\exambrowsersetup\installer\Application\runningexam.exe"C:\ProgramData\exambrowsersetup\installer\Application\runningexam.exe"3⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Newtonsoft.Json.dll
OSVersionInfo.dll
RestSharp.dll
RestSharp.xml
runningexam.exe
runningexam.exe.config
AForge.Video.DirectShow.dll
AForge.Video.DirectShow.xml
AForge.Video.dll
AForge.Video.xml
AForge.dll
AForge.xml
LibraryExam.dll
eb000.dat
License
index.d.ts
LICENSE
LICENSE
LICENSE
LICENSE
punycode.js
uri.all.min.d.ts
https.d.ts
CONTRIBUTING.md
ExamBrowser.exe
ExamBrowser.exe.config
log.txt
log.txt
setting_exambro.json
version.txt
__PSScriptPolicyTest_ye5qasxn.isx.ps1
memory/544-2380-0x000000001C760000-0x000000001C76C000-memory.dmp
memory/544-2376-0x000000001C390000-0x000000001C410000-memory.dmp
memory/544-2382-0x0000000020BA0000-0x0000000020BB6000-memory.dmp
memory/544-2385-0x0000000020C40000-0x0000000020CC0000-memory.dmp
memory/544-2392-0x0000000021410000-0x0000000021500000-memory.dmp
memory/544-2393-0x0000000021500000-0x000000002180E000-memory.dmp
memory/544-2403-0x0000000022070000-0x00000000220D2000-memory.dmp
memory/544-2416-0x000000001C9C0000-0x000000001C9CC000-memory.dmp
memory/2112-2374-0x000000001D170000-0x000000001D17C000-memory.dmp
memory/2112-2366-0x000000001E640000-0x000000001E66E000-memory.dmp
memory/2688-2356-0x0000021288B60000-0x0000021288B6C000-memory.dmp
memory/2688-1161-0x0000021288B60000-0x0000021288B6C000-memory.dmp
memory/2688-29-0x00000212A1280000-0x00000212A12A2000-memory.dmp
memory/2688-1681-0x0000021288BC0000-0x0000021288BD0000-memory.dmp
memory/2688-40-0x0000021288BC0000-0x0000021288BD0000-memory.dmp
memory/2688-41-0x0000021288BC0000-0x0000021288BD0000-memory.dmp
memory/2688-1682-0x0000021288BC0000-0x0000021288BD0000-memory.dmp
memory/4188-19-0x000000001E1C0000-0x000000001E1CC000-memory.dmp
memory/4188-2363-0x000000001E1C0000-0x000000001E1CC000-memory.dmp
memory/4188-36-0x00007FFF98B40000-0x00007FFF994E1000-memory.dmp
memory/4188-34-0x00007FFF98B40000-0x00007FFF994E1000-memory.dmp
memory/4188-33-0x00007FFF98B40000-0x00007FFF994E1000-memory.dmp
memory/4188-32-0x00007FFF98B40000-0x00007FFF994E1000-memory.dmp
memory/4188-38-0x00007FFF98B40000-0x00007FFF994E1000-memory.dmp
memory/4188-39-0x00007FFF98B40000-0x00007FFF994E1000-memory.dmp
memory/4188-42-0x00007FFF98B40000-0x00007FFF994E1000-memory.dmp
memory/4188-23-0x00007FFF98B40000-0x00007FFF994E1000-memory.dmp
memory/4188-21-0x00007FFF98B40000-0x00007FFF994E1000-memory.dmp
memory/4188-20-0x00007FFF98DF5000-0x00007FFF98DF6000-memory.dmp
memory/4188-0-0x00007FFF98DF5000-0x00007FFF98DF6000-memory.dmp
memory/4188-2357-0x0000000000A40000-0x0000000000A50000-memory.dmp
memory/4188-43-0x00007FFF98B40000-0x00007FFF994E1000-memory.dmp
memory/4188-18-0x00007FFF98B40000-0x00007FFF994E1000-memory.dmp
memory/4188-2364-0x00007FFF98B40000-0x00007FFF994E1000-memory.dmp
memory/4188-37-0x00007FFF98B40000-0x00007FFF994E1000-memory.dmp
memory/4188-17-0x00007FFF98B40000-0x00007FFF994E1000-memory.dmp
memory/4188-16-0x00007FFF98B40000-0x00007FFF994E1000-memory.dmp
memory/4188-15-0x00007FFF98B40000-0x00007FFF994E1000-memory.dmp
memory/4188-14-0x00007FFF98B40000-0x00007FFF994E1000-memory.dmp
memory/4188-13-0x00007FFF98B40000-0x00007FFF994E1000-memory.dmp
memory/4188-12-0x00007FFF98B40000-0x00007FFF994E1000-memory.dmp
memory/4188-11-0x00007FFF98B40000-0x00007FFF994E1000-memory.dmp
memory/4188-10-0x00007FFF98B40000-0x00007FFF994E1000-memory.dmp
memory/4188-9-0x00007FFF98B40000-0x00007FFF994E1000-memory.dmp
memory/4188-8-0x00007FFF98B40000-0x00007FFF994E1000-memory.dmp
memory/4188-7-0x00007FFF98B40000-0x00007FFF994E1000-memory.dmp
memory/4188-6-0x00007FFF98B40000-0x00007FFF994E1000-memory.dmp
memory/4188-5-0x0000000000AF0000-0x0000000000AF8000-memory.dmp
memory/4188-4-0x00007FFF98B40000-0x00007FFF994E1000-memory.dmp
memory/4188-3-0x000000001B090000-0x000000001B12C000-memory.dmp
memory/4188-1-0x00007FFF98B40000-0x00007FFF994E1000-memory.dmp
memory/4188-2-0x000000001B690000-0x000000001BB5E000-memory.dmp