Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
03/06/2026, 23:03
General
- Target file.exe
- Size 1.1MB
- Sample260603-21yjcaft4y
- SHA256 c093e62de0d3698993542326b687de25ce961fa940d05b79809bef98651fef0f
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Drops startup file 2 IoCs
- Executes dropped EXE 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 30 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 10 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.exe,"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 103⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.exe,"3⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 10 > nul && copy "C:\Users\Admin\AppData\Local\Temp\file.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.exe" && ping 127.0.0.1 -n 10 > nul && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.exe"2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 103⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 103⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
start.exe.log
Tmp259F.tmp
start.exe
memory/676-0-0x00000000006E0000-0x0000000000800000-memory.dmp
memory/676-1-0x00000000056F0000-0x0000000005C94000-memory.dmp
memory/676-2-0x00000000051E0000-0x0000000005272000-memory.dmp
memory/676-3-0x0000000005320000-0x00000000053BC000-memory.dmp
memory/676-4-0x0000000005520000-0x0000000005530000-memory.dmp
memory/676-5-0x0000000005280000-0x000000000528A000-memory.dmp
memory/676-6-0x0000000005530000-0x0000000005590000-memory.dmp
memory/676-28-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-30-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-133-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-130-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-128-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-126-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-124-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-122-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-120-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-118-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-116-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-112-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-110-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-108-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-104-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-102-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-100-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-98-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-96-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-94-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-92-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-90-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-88-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-86-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-84-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-82-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-80-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-78-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-74-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-72-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-70-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-68-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-66-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-64-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-62-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-60-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-56-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-54-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-52-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-50-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-48-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-46-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-44-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-42-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-40-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-38-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-36-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-34-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-32-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-553-0x00000000054D0000-0x00000000054D1000-memory.dmp
memory/676-26-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-24-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-22-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-20-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-114-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-106-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-18-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-16-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-14-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-76-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-12-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-10-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-8-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-58-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-7-0x0000000005530000-0x0000000005598000-memory.dmp
memory/676-554-0x00000000056D0000-0x00000000056EE000-memory.dmp
memory/676-555-0x0000000005520000-0x0000000005530000-memory.dmp
memory/4244-1114-0x0000000000400000-0x0000000000454000-memory.dmp
memory/4244-1115-0x0000000004F50000-0x0000000004F68000-memory.dmp
memory/4244-1116-0x0000000005000000-0x000000000504C000-memory.dmp
memory/4244-1129-0x0000000005360000-0x00000000053C6000-memory.dmp
memory/4516-1108-0x0000000007340000-0x0000000007360000-memory.dmp