Analysis
- user interaction
yes - max time kernel
149s - max time network
144s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
28/04/2026, 09:24
General
- Target Exambrowsersetup.exe
- Size 229KB
- Sample260428-lc6xtafx21
- SHA256 25816da6093c0101e7ceda9c79e8b4949eba518ebd5bafbbc019e608d464769c
Malware Config
Signatures
- .NET Reactor proctector 2 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Executes dropped EXE 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies system certificate store 2 TTPs 6 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Exambrowsersetup.exe"C:\Users\Admin\AppData\Local\Temp\Exambrowsersetup.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c powershell -command "$shell = new-object -com shell.application; $zip = $shell.NameSpace('C:\ProgramData\exambrowsersetup\update.zip'); foreach ($item in $zip.items()) {$shell.Namespace('C:\ProgramData\exambrowsersetup\installer').CopyHere($item, 0x14)}"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "$shell = new-object -com shell.application; $zip = $shell.NameSpace('C:\ProgramData\exambrowsersetup\update.zip'); foreach ($item in $zip.items()) {$shell.Namespace('C:\ProgramData\exambrowsersetup\installer').CopyHere($item, 0x14)}"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\ProgramData\exambrowsersetup\installer\ExamBrowser.exe"C:\ProgramData\exambrowsersetup\installer\ExamBrowser.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\exambrowsersetup\installer\Application\runningexam.exe"C:\ProgramData\exambrowsersetup\installer\Application\runningexam.exe"3⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Newtonsoft.Json.dll
OSVersionInfo.dll
RestSharp.dll
RestSharp.xml
runningexam.exe
runningexam.exe.config
AForge.Video.DirectShow.dll
AForge.Video.DirectShow.xml
AForge.Video.dll
AForge.Video.xml
AForge.dll
AForge.xml
LibraryExam.dll
eb000.dat
License
index.d.ts
LICENSE
LICENSE
LICENSE
LICENSE
punycode.js
uri.all.min.d.ts
https.d.ts
CONTRIBUTING.md
ExamBrowser.exe
ExamBrowser.exe.config
log.txt
log.txt
setting_exambro.json
version.txt
__PSScriptPolicyTest_3gmizhyl.xq1.ps1
memory/944-35-0x000002086EA90000-0x000002086EAB2000-memory.dmp
memory/944-37-0x000002086EA80000-0x000002086EA90000-memory.dmp
memory/944-29-0x000002086EA80000-0x000002086EA90000-memory.dmp
memory/944-1906-0x000002086EA80000-0x000002086EA90000-memory.dmp
memory/944-2352-0x000002086E850000-0x000002086E862000-memory.dmp
memory/944-2353-0x000002086EAC0000-0x000002086EB2F000-memory.dmp
memory/944-2351-0x000002086E350000-0x000002086E35C000-memory.dmp
memory/2024-2379-0x000000001CBA0000-0x000000001CBAC000-memory.dmp
memory/2024-2380-0x000000001F440000-0x000000001F4AF000-memory.dmp
memory/2024-2381-0x000000001CB80000-0x000000001CB89000-memory.dmp
memory/2024-2382-0x000000001F560000-0x000000001F572000-memory.dmp
memory/2024-2371-0x000000001F0A0000-0x000000001F0CE000-memory.dmp
memory/3960-2364-0x000000001D810000-0x000000001D81C000-memory.dmp
memory/3960-0-0x00007FFBDEAA5000-0x00007FFBDEAA6000-memory.dmp
memory/3960-16-0x00007FFBDE7F0000-0x00007FFBDF191000-memory.dmp
memory/3960-15-0x00007FFBDE7F0000-0x00007FFBDF191000-memory.dmp
memory/3960-14-0x00007FFBDE7F0000-0x00007FFBDF191000-memory.dmp
memory/3960-13-0x00007FFBDE7F0000-0x00007FFBDF191000-memory.dmp
memory/3960-12-0x00007FFBDE7F0000-0x00007FFBDF191000-memory.dmp
memory/3960-18-0x00007FFBDE7F0000-0x00007FFBDF191000-memory.dmp
memory/3960-11-0x00007FFBDE7F0000-0x00007FFBDF191000-memory.dmp
memory/3960-10-0x00007FFBDE7F0000-0x00007FFBDF191000-memory.dmp
memory/3960-9-0x00007FFBDE7F0000-0x00007FFBDF191000-memory.dmp
memory/3960-19-0x000000001D810000-0x000000001D81C000-memory.dmp
memory/3960-21-0x000000001D800000-0x000000001D809000-memory.dmp
memory/3960-20-0x000000001EF10000-0x000000001EF7F000-memory.dmp
memory/3960-2354-0x0000000001460000-0x0000000001470000-memory.dmp
memory/3960-8-0x00007FFBDE7F0000-0x00007FFBDF191000-memory.dmp
memory/3960-7-0x00007FFBDE7F0000-0x00007FFBDF191000-memory.dmp
memory/3960-22-0x000000001EEF0000-0x000000001EF02000-memory.dmp
memory/3960-2366-0x000000001D800000-0x000000001D809000-memory.dmp
memory/3960-2365-0x000000001EF10000-0x000000001EF7F000-memory.dmp
memory/3960-2369-0x00007FFBDE7F0000-0x00007FFBDF191000-memory.dmp
memory/3960-2368-0x000000001D620000-0x000000001D752000-memory.dmp
memory/3960-23-0x00007FFBDEAA5000-0x00007FFBDEAA6000-memory.dmp
memory/3960-17-0x00007FFBDE7F0000-0x00007FFBDF191000-memory.dmp
memory/3960-6-0x00007FFBDE7F0000-0x00007FFBDF191000-memory.dmp
memory/3960-5-0x00000000013D0000-0x00000000013D8000-memory.dmp
memory/3960-4-0x00007FFBDE7F0000-0x00007FFBDF191000-memory.dmp
memory/3960-24-0x00007FFBDE7F0000-0x00007FFBDF191000-memory.dmp
memory/3960-25-0x00007FFBDE7F0000-0x00007FFBDF191000-memory.dmp
memory/3960-27-0x00007FFBDE7F0000-0x00007FFBDF191000-memory.dmp
memory/3960-28-0x00007FFBDE7F0000-0x00007FFBDF191000-memory.dmp
memory/3960-1-0x000000001BFF0000-0x000000001C4BE000-memory.dmp
memory/3960-2-0x00007FFBDE7F0000-0x00007FFBDF191000-memory.dmp
memory/3960-3-0x000000001C4C0000-0x000000001C55C000-memory.dmp
memory/4424-2413-0x0000000021D30000-0x0000000021D92000-memory.dmp
memory/4424-2390-0x00000000207B0000-0x00000000207C6000-memory.dmp
memory/4424-2384-0x000000001C750000-0x000000001C7D0000-memory.dmp
memory/4424-2393-0x0000000020850000-0x00000000208D0000-memory.dmp
memory/4424-2402-0x0000000021060000-0x0000000021150000-memory.dmp
memory/4424-2403-0x0000000021150000-0x0000000021460000-memory.dmp
memory/4424-2388-0x000000001CC80000-0x000000001CC8C000-memory.dmp
memory/4424-2426-0x000000001CE10000-0x000000001CE1C000-memory.dmp
memory/4424-2430-0x0000000023860000-0x0000000023992000-memory.dmp
memory/4424-2429-0x00000000208D0000-0x000000002093F000-memory.dmp
memory/4424-2428-0x00000000207F0000-0x00000000207F9000-memory.dmp
memory/4424-2427-0x00000000207D0000-0x00000000207E2000-memory.dmp
memory/4424-2484-0x00000000208D0000-0x000000002093F000-memory.dmp