Analysis
- max time kernel
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 11:14
General
- Target QUOTATION.exe
- Size 850KB
- Sample260604-nb29cacz9x
- SHA256 93ff044e9247c1136e328b8bd3d225513ab3b2975c8e0e03b8f2c52aec9f0be9
Malware Config
Signatures
- .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 23 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 38 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "excel" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\excel.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 383⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "excel" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\excel.exe"3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 47 > nul && copy "C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe" "C:\Users\Admin\AppData\Roaming\excel.exe" && ping 127.0.0.1 -n 47 > nul && "C:\Users\Admin\AppData\Roaming\excel.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 473⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 473⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\excel.exe"C:\Users\Admin\AppData\Roaming\excel.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
excel.exe
memory/1992-0-0x0000000000C10000-0x0000000000CEA000-memory.dmp
memory/1992-1-0x0000000005E50000-0x00000000063F6000-memory.dmp
memory/1992-2-0x0000000005780000-0x0000000005812000-memory.dmp
memory/1992-3-0x0000000005940000-0x00000000059DC000-memory.dmp
memory/1992-4-0x0000000005B80000-0x0000000005B90000-memory.dmp
memory/1992-5-0x0000000005830000-0x000000000583A000-memory.dmp
memory/1992-6-0x0000000005AD0000-0x0000000005B30000-memory.dmp
memory/1992-8-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-14-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-132-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-130-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-128-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-126-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-124-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-122-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-120-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-118-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-116-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-112-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-110-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-109-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-106-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-104-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-102-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-98-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-96-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-94-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-92-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-90-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-88-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-86-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-114-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-100-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-84-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-83-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-80-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-78-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-74-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-72-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-70-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-68-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-66-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-64-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-62-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-60-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-56-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-55-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-52-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-50-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-48-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-46-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-42-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-41-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-38-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-36-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-34-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-32-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-28-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-26-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-24-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-20-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-18-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-16-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-12-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-10-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-76-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-58-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-44-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-30-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-22-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-7-0x0000000005AD0000-0x0000000005B38000-memory.dmp
memory/1992-553-0x0000000005910000-0x0000000005911000-memory.dmp
memory/1992-554-0x0000000006440000-0x000000000645E000-memory.dmp
memory/1992-555-0x0000000005B80000-0x0000000005B90000-memory.dmp
memory/1992-556-0x0000000005B80000-0x0000000005B90000-memory.dmp
memory/1992-557-0x0000000005B80000-0x0000000005B90000-memory.dmp