Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
06/07/2026, 09:04
General
- Target _b7a3fc527793301bd39eae5c5ae037730cc2132ccb8a59bf45d02f246bbaea19.exe
- Size 1.1MB
- Sample260706-k1rmcscy6x
- SHA256 b7a3fc527793301bd39eae5c5ae037730cc2132ccb8a59bf45d02f246bbaea19
Malware Config
Signatures
- .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 33 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\_b7a3fc527793301bd39eae5c5ae037730cc2132ccb8a59bf45d02f246bbaea19.exe"C:\Users\Admin\AppData\Local\Temp\_b7a3fc527793301bd39eae5c5ae037730cc2132ccb8a59bf45d02f246bbaea19.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 38 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "EXCEL" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\EXCEL.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 383⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "EXCEL" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\EXCEL.exe"3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 43 > nul && copy "C:\Users\Admin\AppData\Local\Temp\_b7a3fc527793301bd39eae5c5ae037730cc2132ccb8a59bf45d02f246bbaea19.exe" "C:\Users\Admin\AppData\Roaming\EXCEL.exe" && ping 127.0.0.1 -n 43 > nul && "C:\Users\Admin\AppData\Roaming\EXCEL.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 433⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 433⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\EXCEL.exe"C:\Users\Admin\AppData\Roaming\EXCEL.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
EXCEL.exe
memory/1132-559-0x0000000074500000-0x0000000074CBC000-memory.dmp
memory/1132-1104-0x0000000074500000-0x0000000074CBC000-memory.dmp
memory/2420-0-0x0000000074542000-0x0000000074543000-memory.dmp
memory/2420-1-0x0000000000B50000-0x0000000000C6C000-memory.dmp
memory/2420-2-0x0000000005C60000-0x000000000621A000-memory.dmp
memory/2420-3-0x0000000005780000-0x0000000005812000-memory.dmp
memory/2420-4-0x00000000058C0000-0x000000000595C000-memory.dmp
memory/2420-5-0x0000000005820000-0x000000000582A000-memory.dmp
memory/2420-6-0x0000000074530000-0x0000000074CEC000-memory.dmp
memory/2420-7-0x0000000005960000-0x00000000059B6000-memory.dmp
memory/2420-19-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-17-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-134-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-131-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-127-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-125-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-123-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-119-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-115-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-113-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-111-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-107-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-105-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-103-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-99-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-95-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-93-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-91-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-87-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-85-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-81-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-77-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-75-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-73-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-69-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-65-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-63-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-61-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-59-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-55-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-53-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-51-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-49-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-48-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-45-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-43-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-41-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-37-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-33-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-29-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-27-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-23-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-21-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-15-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-129-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-121-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-117-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-109-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-101-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-97-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-89-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-83-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-79-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-71-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-67-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-57-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-39-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-35-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-31-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-25-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-13-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-11-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-9-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-8-0x0000000005960000-0x00000000059D5000-memory.dmp
memory/2420-552-0x0000000074530000-0x0000000074CEC000-memory.dmp
memory/2420-553-0x0000000006C20000-0x0000000006C36000-memory.dmp
memory/2420-554-0x0000000074530000-0x0000000074CEC000-memory.dmp
memory/2420-555-0x0000000074542000-0x0000000074543000-memory.dmp
memory/2420-556-0x0000000074530000-0x0000000074CEC000-memory.dmp
memory/2420-557-0x0000000074530000-0x0000000074CEC000-memory.dmp