Analysis
- max time kernel
149s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
11/05/2026, 06:46
General
- Target Copia de pago.exe
- Size 1.2MB
- Sample260511-hjs3ract3v
- SHA256 14fb9a33ac9ff99dfb0106400ea813b3cebeb4dfa601ddd6d5a0f19a5599fb02
Malware Config
Signatures
- .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Copia de pago.exe"C:\Users\Admin\AppData\Local\Temp\Copia de pago.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4504-0-0x00000000006E0000-0x0000000000820000-memory.dmp
memory/4504-1-0x00000000057D0000-0x0000000005D74000-memory.dmp
memory/4504-2-0x00000000052C0000-0x0000000005352000-memory.dmp
memory/4504-3-0x0000000005360000-0x00000000053FC000-memory.dmp
memory/4504-4-0x00000000054F0000-0x0000000005500000-memory.dmp
memory/4504-5-0x00000000052B0000-0x00000000052BA000-memory.dmp
memory/4504-6-0x0000000005580000-0x00000000055BE000-memory.dmp
memory/4504-8-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-20-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-132-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-128-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-126-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-279-0x0000000005620000-0x0000000005621000-memory.dmp
memory/4504-124-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-122-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-280-0x00000000054F0000-0x0000000005500000-memory.dmp
memory/4504-120-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-118-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-116-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-114-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-112-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-110-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-108-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-106-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-104-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-102-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-98-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-96-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-94-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-93-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-90-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-88-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-86-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-84-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-82-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-80-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-76-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-74-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-72-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-70-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-68-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-66-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-64-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-62-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-58-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-56-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-54-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-52-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-50-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-48-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-46-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-44-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-40-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-38-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-36-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-34-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-32-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-30-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-28-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-26-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-22-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-18-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-16-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-14-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-130-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-12-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-10-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-100-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-78-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-60-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-42-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-24-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-7-0x0000000005580000-0x00000000055CD000-memory.dmp
memory/4504-281-0x00000000054F0000-0x0000000005500000-memory.dmp
memory/4504-284-0x00000000054F0000-0x0000000005500000-memory.dmp
memory/4504-289-0x0000000006F70000-0x0000000006F88000-memory.dmp
memory/4504-290-0x00000000072A0000-0x00000000072A6000-memory.dmp