Analysis
- max time kernel
298s - max time network
204s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
07/05/2026, 14:55
General
- Target Quote.exe
- Size 994KB
- Sample260507-sam59ae17t
- SHA256 d6c0fd882dfcb8e38dee803c61ad7106c3f164c24d22d8eff1686ad6e4a7e11b
Malware Config
Signatures
- .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 30 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quote.exe"C:\Users\Admin\AppData\Local\Temp\Quote.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 38 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Chrome" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Chrome.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 383⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Chrome" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Chrome.exe"3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 43 > nul && copy "C:\Users\Admin\AppData\Local\Temp\Quote.exe" "C:\Users\Admin\AppData\Roaming\Chrome.exe" && ping 127.0.0.1 -n 43 > nul && "C:\Users\Admin\AppData\Roaming\Chrome.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 433⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 433⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Chrome.exe"C:\Users\Admin\AppData\Roaming\Chrome.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
Chrome.exe
memory/764-567-0x0000000007360000-0x0000000007378000-memory.dmp
memory/764-568-0x00000000074E0000-0x00000000074E6000-memory.dmp
memory/2956-0-0x00000000008E0000-0x00000000009DE000-memory.dmp
memory/2956-1-0x0000000005A60000-0x0000000006006000-memory.dmp
memory/2956-2-0x0000000005550000-0x00000000055E2000-memory.dmp
memory/2956-3-0x00000000055F0000-0x000000000568C000-memory.dmp
memory/2956-4-0x00000000054E0000-0x000000000551E000-memory.dmp
memory/2956-6-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-22-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-88-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-130-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-128-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-126-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-278-0x0000000005530000-0x0000000005531000-memory.dmp
memory/2956-279-0x00000000056D0000-0x00000000056DA000-memory.dmp
memory/2956-277-0x00000000054C0000-0x00000000054D0000-memory.dmp
memory/2956-280-0x00000000054C0000-0x00000000054D0000-memory.dmp
memory/2956-124-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-122-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-120-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-118-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-116-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-114-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-112-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-110-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-108-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-106-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-104-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-102-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-100-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-98-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-96-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-94-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-92-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-68-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-86-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-84-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-82-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-80-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-78-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-76-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-74-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-72-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-66-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-65-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-62-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-60-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-58-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-56-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-54-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-50-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-48-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-44-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-42-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-38-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-36-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-35-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-32-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-30-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-28-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-26-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-24-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-20-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-18-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-14-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-12-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-90-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-70-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-52-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-46-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-40-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-8-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-5-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-16-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-10-0x00000000054E0000-0x000000000551B000-memory.dmp
memory/2956-282-0x00000000054C0000-0x00000000054D0000-memory.dmp
memory/2956-283-0x00000000054C0000-0x00000000054D0000-memory.dmp