Analysis
- max time kernel
148s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
11/05/2026, 06:46
General
- Target Copia de pago.exe
- Size 1.2MB
- Sample260511-hjs3ract3v
- SHA256 14fb9a33ac9ff99dfb0106400ea813b3cebeb4dfa601ddd6d5a0f19a5599fb02
Malware Config
Signatures
- .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Copia de pago.exe"C:\Users\Admin\AppData\Local\Temp\Copia de pago.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1064-0-0x0000000000E10000-0x0000000000F50000-memory.dmp
memory/1064-1-0x00000000060A0000-0x0000000006646000-memory.dmp
memory/1064-2-0x0000000005B90000-0x0000000005C22000-memory.dmp
memory/1064-3-0x0000000005C30000-0x0000000005CCC000-memory.dmp
memory/1064-4-0x0000000005B60000-0x0000000005B70000-memory.dmp
memory/1064-5-0x0000000005B40000-0x0000000005B4A000-memory.dmp
memory/1064-6-0x0000000005E50000-0x0000000005E8E000-memory.dmp
memory/1064-8-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-20-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-132-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-130-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-128-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-126-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-124-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-122-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-120-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-118-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-116-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-114-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-112-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-110-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-106-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-104-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-102-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-100-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-98-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-96-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-94-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-92-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-90-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-88-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-86-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-84-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-82-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-80-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-76-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-74-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-72-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-70-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-68-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-66-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-64-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-62-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-60-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-58-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-54-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-52-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-50-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-48-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-46-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-44-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-42-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-40-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-38-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-36-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-34-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-32-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-30-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-26-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-24-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-22-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-18-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-16-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-14-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-12-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-10-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-108-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-78-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-56-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-28-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-7-0x0000000005E50000-0x0000000005E9D000-memory.dmp
memory/1064-279-0x0000000005FC0000-0x0000000005FC1000-memory.dmp
memory/1064-280-0x0000000005B60000-0x0000000005B70000-memory.dmp
memory/1064-282-0x0000000005B60000-0x0000000005B70000-memory.dmp
memory/1064-283-0x0000000005B60000-0x0000000005B70000-memory.dmp
memory/1064-286-0x00000000082A0000-0x00000000082B8000-memory.dmp
memory/1064-287-0x000000000A920000-0x000000000A926000-memory.dmp