Analysis
- max time kernel
39s - max time network
28s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
30/06/2026, 12:30
General
- Target a1271b9b50b806efd698e97d443f341e4921a906ea48d22002ba84a91f89df6e.exe
- Size 1.1MB
- Sample260630-ppqcdafs2n
- SHA256 a1271b9b50b806efd698e97d443f341e4921a906ea48d22002ba84a91f89df6e
Malware Config
Signatures
- .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1271b9b50b806efd698e97d443f341e4921a906ea48d22002ba84a91f89df6e.exe"C:\Users\Admin\AppData\Local\Temp\a1271b9b50b806efd698e97d443f341e4921a906ea48d22002ba84a91f89df6e.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4652-0-0x00000000743A2000-0x00000000743A3000-memory.dmp
memory/4652-1-0x0000000000830000-0x000000000094E000-memory.dmp
memory/4652-2-0x0000000005AB0000-0x000000000606A000-memory.dmp
memory/4652-3-0x00000000054F0000-0x0000000005582000-memory.dmp
memory/4652-4-0x0000000005590000-0x000000000562C000-memory.dmp
memory/4652-5-0x0000000005460000-0x000000000546A000-memory.dmp
memory/4652-6-0x0000000074390000-0x0000000074B4C000-memory.dmp
memory/4652-7-0x0000000005630000-0x0000000005686000-memory.dmp
memory/4652-127-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-133-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-131-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-129-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-125-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-123-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-121-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-119-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-115-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-113-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-111-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-109-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-107-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-103-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-101-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-97-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-95-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-93-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-91-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-89-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-87-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-85-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-81-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-79-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-75-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-73-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-552-0x0000000074390000-0x0000000074B4C000-memory.dmp
memory/4652-71-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-67-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-65-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-63-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-61-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-57-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-55-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-53-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-51-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-49-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-45-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-43-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-41-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-39-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-35-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-33-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-31-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-30-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-25-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-23-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-21-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-19-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-16-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-13-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-11-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-9-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-8-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-117-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-106-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-99-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-83-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-77-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-69-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-59-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-47-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-37-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-27-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-17-0x0000000005630000-0x0000000005684000-memory.dmp
memory/4652-553-0x00000000059F0000-0x0000000005A04000-memory.dmp
memory/4652-554-0x0000000074390000-0x0000000074B4C000-memory.dmp
memory/4652-555-0x00000000743A2000-0x00000000743A3000-memory.dmp
memory/4652-556-0x0000000074390000-0x0000000074B4C000-memory.dmp
memory/4652-557-0x0000000008390000-0x00000000083A6000-memory.dmp
memory/4652-558-0x00000000083B0000-0x00000000083B6000-memory.dmp