Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
29/04/2026, 18:09
General
- Target _e2ef9fc25cfdcdc83f38509054ae292a3550db176566c446e5f6225be8e93f38.exe
- Size 1.7MB
- Sample260429-wrm4cset2z
- SHA256 e2ef9fc25cfdcdc83f38509054ae292a3550db176566c446e5f6225be8e93f38
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Executes dropped EXE 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 25 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\_e2ef9fc25cfdcdc83f38509054ae292a3550db176566c446e5f6225be8e93f38.exe"C:\Users\Admin\AppData\Local\Temp\_e2ef9fc25cfdcdc83f38509054ae292a3550db176566c446e5f6225be8e93f38.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c ping 127.0.0.1 -n 14 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Data encoder.exe,"2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 143⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Data encoder.exe,"3⤵
- Modifies WinLogon for persistence
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c ping 127.0.0.1 -n 20 > nul && copy "C:\Users\Admin\AppData\Local\Temp\_e2ef9fc25cfdcdc83f38509054ae292a3550db176566c446e5f6225be8e93f38.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Data encoder.exe" && ping 127.0.0.1 -n 20 > nul && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Data encoder.exe"2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 203⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 203⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Data encoder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Data encoder.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Data encoder.exe
memory/4320-0-0x000000000340A000-0x000000000340B000-memory.dmp
memory/4320-1-0x0000000000E50000-0x0000000001002000-memory.dmp
memory/4320-2-0x0000000025AD0000-0x0000000025B02000-memory.dmp
memory/4320-3-0x0000000002C40000-0x0000000003702000-memory.dmp
memory/4320-5-0x0000000001100000-0x0000000001167000-memory.dmp
memory/4320-6-0x0000000001800000-0x00000000018BD000-memory.dmp
memory/4320-10-0x0000000002020000-0x00000000020C3000-memory.dmp
memory/4320-12-0x0000000002A10000-0x0000000002B30000-memory.dmp
memory/4320-16-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/4320-15-0x0000000001900000-0x0000000001918000-memory.dmp
memory/4320-19-0x0000000001920000-0x0000000001936000-memory.dmp
memory/4320-24-0x0000000003B10000-0x0000000003BAD000-memory.dmp
memory/4320-25-0x0000000003BB0000-0x0000000003CC1000-memory.dmp
memory/4320-27-0x000000001FD20000-0x000000001FEBA000-memory.dmp
memory/4320-26-0x0000000003ED0000-0x0000000003F01000-memory.dmp
memory/4320-23-0x00000000039F0000-0x0000000003B02000-memory.dmp
memory/4320-22-0x0000000002BE0000-0x0000000002C09000-memory.dmp
memory/4320-21-0x0000000001F30000-0x0000000001F56000-memory.dmp
memory/4320-20-0x0000000003920000-0x00000000039DD000-memory.dmp
memory/4320-18-0x0000000003770000-0x000000000391C000-memory.dmp
memory/4320-17-0x0000000002C40000-0x0000000003702000-memory.dmp
memory/4320-14-0x0000000002570000-0x00000000025CD000-memory.dmp
memory/4320-13-0x0000000002B30000-0x0000000002BDA000-memory.dmp
memory/4320-8-0x0000000001E90000-0x0000000001F21000-memory.dmp
memory/4320-11-0x00000000024D0000-0x000000000256E000-memory.dmp
memory/4320-7-0x0000000001A40000-0x0000000001DB4000-memory.dmp
memory/4320-9-0x0000000001F70000-0x000000000201E000-memory.dmp
memory/4320-30-0x0000000020240000-0x00000000202EC000-memory.dmp
memory/4320-29-0x0000000005630000-0x00000000056AF000-memory.dmp
memory/4320-33-0x00000000236C0000-0x000000002391F000-memory.dmp
memory/4320-34-0x0000000023A20000-0x0000000023B3E000-memory.dmp
memory/4320-31-0x00000000203D0000-0x000000002051F000-memory.dmp
memory/4320-32-0x0000000023100000-0x00000000232B3000-memory.dmp
memory/4320-37-0x00000000256A0000-0x0000000025806000-memory.dmp
memory/4320-50-0x0000000027B80000-0x0000000027C2F000-memory.dmp
memory/4320-36-0x0000000024E30000-0x0000000025697000-memory.dmp
memory/4320-49-0x0000000027420000-0x00000000274F6000-memory.dmp
memory/4320-48-0x0000000027070000-0x000000002721E000-memory.dmp
memory/4320-47-0x0000000026710000-0x0000000026718000-memory.dmp
memory/4320-46-0x0000000026520000-0x00000000265D2000-memory.dmp
memory/4320-45-0x0000000025AB0000-0x0000000025ACD000-memory.dmp
memory/4320-44-0x0000000025A70000-0x0000000025AAD000-memory.dmp
memory/4320-43-0x0000000025A00000-0x0000000025A0C000-memory.dmp
memory/4320-42-0x0000000025A30000-0x0000000025A65000-memory.dmp
memory/4320-41-0x00000000203A0000-0x00000000203B8000-memory.dmp
memory/4320-40-0x0000000025930000-0x0000000025957000-memory.dmp
memory/4320-39-0x0000000025900000-0x0000000025921000-memory.dmp
memory/4320-38-0x0000000025810000-0x00000000258FA000-memory.dmp
memory/4320-35-0x0000000024680000-0x0000000024E2E000-memory.dmp
memory/4320-28-0x000000001FEC0000-0x0000000020238000-memory.dmp
memory/4392-56-0x0000000028DF0000-0x0000000028E08000-memory.dmp
memory/4392-57-0x0000000028E30000-0x0000000028E36000-memory.dmp
memory/4392-58-0x0000000001800000-0x0000000001867000-memory.dmp
memory/4392-59-0x0000000001870000-0x000000000192D000-memory.dmp
memory/4392-75-0x0000000002CA0000-0x0000000002CC9000-memory.dmp
memory/4392-74-0x0000000002C70000-0x0000000002C96000-memory.dmp
memory/4392-70-0x0000000002D30000-0x00000000037F2000-memory.dmp
memory/4392-69-0x0000000002C00000-0x0000000002C0A000-memory.dmp
memory/4392-68-0x0000000001970000-0x0000000001988000-memory.dmp
memory/4392-67-0x00000000025D0000-0x000000000262D000-memory.dmp
memory/4392-66-0x0000000002B50000-0x0000000002BFA000-memory.dmp
memory/4392-65-0x0000000002630000-0x0000000002750000-memory.dmp
memory/4392-64-0x00000000024F0000-0x000000000258E000-memory.dmp
memory/4392-62-0x0000000001F90000-0x000000000203E000-memory.dmp
memory/4392-61-0x0000000001EE0000-0x0000000001F71000-memory.dmp
memory/4392-60-0x0000000001A90000-0x0000000001E04000-memory.dmp
memory/4392-73-0x0000000003A10000-0x0000000003ACD000-memory.dmp
memory/4392-72-0x0000000002C10000-0x0000000002C26000-memory.dmp
memory/4392-71-0x0000000003860000-0x0000000003A0C000-memory.dmp
memory/4392-63-0x0000000002040000-0x00000000020E3000-memory.dmp