Analysis
- max time kernel
148s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
03/06/2026, 23:03
General
- Target file.exe
- Size 1.1MB
- Sample260603-21yjcaft4y
- SHA256 c093e62de0d3698993542326b687de25ce961fa940d05b79809bef98651fef0f
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Drops startup file 2 IoCs
- Executes dropped EXE 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 23 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 10 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.exe,"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 103⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.exe,"3⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 10 > nul && copy "C:\Users\Admin\AppData\Local\Temp\file.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.exe" && ping 127.0.0.1 -n 10 > nul && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.exe"2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 103⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 103⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
start.exe.log
Tmp136F.tmp
start.exe
memory/2592-0-0x0000000000C30000-0x0000000000D50000-memory.dmp
memory/2592-1-0x0000000005E00000-0x00000000063A6000-memory.dmp
memory/2592-2-0x0000000005850000-0x00000000058E2000-memory.dmp
memory/2592-3-0x00000000058F0000-0x000000000598C000-memory.dmp
memory/2592-4-0x0000000005B30000-0x0000000005B40000-memory.dmp
memory/2592-5-0x00000000057E0000-0x00000000057EA000-memory.dmp
memory/2592-6-0x0000000005B40000-0x0000000005BA0000-memory.dmp
memory/2592-32-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-46-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-124-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-132-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-130-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-128-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-126-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-122-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-118-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-116-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-115-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-112-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-110-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-108-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-106-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-104-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-102-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-100-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-98-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-96-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-94-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-92-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-90-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-88-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-86-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-84-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-80-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-79-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-76-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-74-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-72-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-70-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-68-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-64-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-62-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-60-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-58-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-57-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-54-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-52-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-50-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-48-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-44-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-42-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-40-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-38-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-36-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-34-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-30-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-28-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-120-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-26-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-24-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-22-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-20-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-18-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-16-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-83-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-14-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-12-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-66-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-10-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-8-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-7-0x0000000005B40000-0x0000000005BA8000-memory.dmp
memory/2592-553-0x0000000005830000-0x0000000005831000-memory.dmp
memory/2592-554-0x0000000007680000-0x000000000769E000-memory.dmp
memory/2592-555-0x0000000005B30000-0x0000000005B40000-memory.dmp
memory/3536-1108-0x00000000077A0000-0x00000000077C0000-memory.dmp
memory/4512-1113-0x0000000000400000-0x0000000000454000-memory.dmp
memory/4512-1114-0x0000000002D60000-0x0000000002D78000-memory.dmp
memory/4512-1115-0x0000000005330000-0x000000000537C000-memory.dmp
memory/4512-1126-0x00000000055D0000-0x0000000005636000-memory.dmp