Analysis
- max time kernel
148s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
29/04/2026, 18:09
General
- Target _e2ef9fc25cfdcdc83f38509054ae292a3550db176566c446e5f6225be8e93f38.exe
- Size 1.7MB
- Sample260429-wrm4cset2z
- SHA256 e2ef9fc25cfdcdc83f38509054ae292a3550db176566c446e5f6225be8e93f38
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Executes dropped EXE 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 29 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\_e2ef9fc25cfdcdc83f38509054ae292a3550db176566c446e5f6225be8e93f38.exe"C:\Users\Admin\AppData\Local\Temp\_e2ef9fc25cfdcdc83f38509054ae292a3550db176566c446e5f6225be8e93f38.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c ping 127.0.0.1 -n 13 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Data encoder.exe,"2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 133⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Data encoder.exe,"3⤵
- Modifies WinLogon for persistence
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c ping 127.0.0.1 -n 23 > nul && copy "C:\Users\Admin\AppData\Local\Temp\_e2ef9fc25cfdcdc83f38509054ae292a3550db176566c446e5f6225be8e93f38.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Data encoder.exe" && ping 127.0.0.1 -n 23 > nul && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Data encoder.exe"2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 233⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 233⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Data encoder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Data encoder.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Data encoder.exe
memory/5156-57-0x0000000000A10000-0x0000000000A75000-memory.dmp
memory/5156-59-0x0000000000CD0000-0x0000000000F99000-memory.dmp
memory/5156-60-0x0000000001070000-0x0000000001100000-memory.dmp
memory/5156-61-0x0000000001110000-0x00000000011BC000-memory.dmp
memory/5156-62-0x00000000011C0000-0x000000000125E000-memory.dmp
memory/5156-63-0x0000000001660000-0x00000000016FB000-memory.dmp
memory/5156-64-0x00000000017A0000-0x00000000018CA000-memory.dmp
memory/5156-65-0x00000000018D0000-0x000000000197A000-memory.dmp
memory/5156-66-0x0000000001980000-0x00000000019D5000-memory.dmp
memory/5156-67-0x0000000001740000-0x0000000001752000-memory.dmp
memory/5156-68-0x00000000003C0000-0x00000000003CA000-memory.dmp
memory/5156-69-0x00000000019E0000-0x00000000024A1000-memory.dmp
memory/5156-71-0x0000000001780000-0x0000000001796000-memory.dmp
memory/5156-72-0x0000000002B80000-0x0000000002C3D000-memory.dmp
memory/5156-73-0x0000000002B20000-0x0000000002B42000-memory.dmp
memory/5156-74-0x0000000002C40000-0x0000000002C6B000-memory.dmp
memory/5156-75-0x0000000002CA0000-0x0000000002DAB000-memory.dmp
memory/5156-70-0x0000000002570000-0x0000000002711000-memory.dmp
memory/5156-58-0x0000000000C10000-0x0000000000CCE000-memory.dmp
memory/5156-56-0x0000000027C50000-0x0000000027C56000-memory.dmp
memory/5156-55-0x0000000027C10000-0x0000000027C28000-memory.dmp
memory/5508-49-0x0000000027560000-0x0000000027609000-memory.dmp
memory/5508-12-0x00000000022C0000-0x00000000023EA000-memory.dmp
memory/5508-42-0x0000000025440000-0x0000000025458000-memory.dmp
memory/5508-41-0x0000000025410000-0x0000000025437000-memory.dmp
memory/5508-40-0x00000000253F0000-0x000000002540F000-memory.dmp
memory/5508-39-0x0000000025340000-0x00000000253ED000-memory.dmp
memory/5508-38-0x0000000025310000-0x000000002533C000-memory.dmp
memory/5508-37-0x0000000024B80000-0x0000000025310000-memory.dmp
memory/5508-34-0x0000000023770000-0x0000000023885000-memory.dmp
memory/5508-32-0x0000000022DD0000-0x0000000022F79000-memory.dmp
memory/5508-31-0x00000000200A0000-0x00000000201EE000-memory.dmp
memory/5508-30-0x000000001FF10000-0x000000001FFAE000-memory.dmp
memory/5508-29-0x00000000054D0000-0x0000000005553000-memory.dmp
memory/5508-28-0x000000001FBB0000-0x000000001FF05000-memory.dmp
memory/5508-27-0x000000001FA80000-0x000000001FBAA000-memory.dmp
memory/5508-25-0x00000000039A0000-0x0000000003AA0000-memory.dmp
memory/5508-24-0x0000000003900000-0x000000000399D000-memory.dmp
memory/5508-23-0x00000000037F0000-0x00000000038FB000-memory.dmp
memory/5508-22-0x0000000003790000-0x00000000037BB000-memory.dmp
memory/5508-21-0x0000000003760000-0x0000000003782000-memory.dmp
memory/5508-20-0x00000000036A0000-0x000000000375D000-memory.dmp
memory/5508-19-0x0000000001D40000-0x0000000001D56000-memory.dmp
memory/5508-18-0x00000000034F0000-0x0000000003691000-memory.dmp
memory/5508-14-0x00000000024A0000-0x00000000024F5000-memory.dmp
memory/5508-13-0x00000000023F0000-0x000000000249A000-memory.dmp
memory/5508-43-0x0000000025530000-0x0000000025564000-memory.dmp
memory/5508-33-0x00000000234E0000-0x0000000023763000-memory.dmp
memory/5508-44-0x0000000020080000-0x000000002008C000-memory.dmp
memory/5508-45-0x0000000025570000-0x0000000025589000-memory.dmp
memory/5508-46-0x0000000025FE0000-0x0000000026090000-memory.dmp
memory/5508-47-0x00000000261E0000-0x00000000261E8000-memory.dmp
memory/5508-48-0x0000000026B20000-0x0000000026CD4000-memory.dmp
memory/5508-0-0x000000000312A000-0x000000000312B000-memory.dmp
memory/5508-36-0x0000000024440000-0x0000000024B7F000-memory.dmp
memory/5508-35-0x0000000023890000-0x000000002395D000-memory.dmp
memory/5508-17-0x0000000002960000-0x0000000003421000-memory.dmp
memory/5508-26-0x0000000003CA0000-0x0000000003CD0000-memory.dmp
memory/5508-15-0x0000000000FD0000-0x0000000000FE2000-memory.dmp
memory/5508-16-0x0000000000ED0000-0x0000000000EDA000-memory.dmp
memory/5508-7-0x0000000001820000-0x0000000001AE9000-memory.dmp
memory/5508-10-0x0000000001D80000-0x0000000001E1E000-memory.dmp
memory/5508-11-0x0000000002220000-0x00000000022BB000-memory.dmp
memory/5508-9-0x0000000001C50000-0x0000000001CFC000-memory.dmp
memory/5508-8-0x0000000001BC0000-0x0000000001C50000-memory.dmp
memory/5508-5-0x0000000000F20000-0x0000000000F85000-memory.dmp
memory/5508-6-0x0000000001600000-0x00000000016BE000-memory.dmp
memory/5508-3-0x0000000002960000-0x0000000003421000-memory.dmp
memory/5508-2-0x0000000025590000-0x00000000255C2000-memory.dmp
memory/5508-1-0x0000000000D00000-0x0000000000EB2000-memory.dmp