Analysis
- max time kernel
105s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
07/07/2026, 22:49
General
- Target Stardock Products Patch v1.7.exe
- Size 39.6MB
- Sample260707-2rth2afv6x
- SHA256 4da49709f69708d05851276268398d62392a2a32dec46209678b1f36a7c2bd78
Malware Config
Signatures
- .NET Reactor proctector 7 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Stardock Products Patch v1.7.exe"C:\Users\Admin\AppData\Local\Temp\Stardock Products Patch v1.7.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5028-0-0x00000000747F2000-0x00000000747F3000-memory.dmp
memory/5028-1-0x00000000747E0000-0x0000000074F9C000-memory.dmp
memory/5028-2-0x0000000011D60000-0x0000000014520000-memory.dmp
memory/5028-3-0x00000000747E0000-0x0000000074F9C000-memory.dmp
memory/5028-4-0x000000000C350000-0x000000000C90A000-memory.dmp
memory/5028-5-0x00000000747E0000-0x0000000074F9C000-memory.dmp
memory/5028-6-0x0000000014520000-0x0000000016CDE000-memory.dmp
memory/5028-7-0x00000000747E0000-0x0000000074F9C000-memory.dmp
memory/5028-8-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-9-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-11-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-13-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-15-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-17-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-19-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-21-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-23-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-25-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-27-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-29-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-31-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-33-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-35-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-37-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-39-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-41-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-43-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-45-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-50-0x00000000747F2000-0x00000000747F3000-memory.dmp
memory/5028-47-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-49-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-52-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-56-0x00000000747E0000-0x0000000074F9C000-memory.dmp
memory/5028-54-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-57-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-60-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-62-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-63-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-65-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-68-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-69-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-71-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-73-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-75-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-77-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-79-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-81-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-83-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-85-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-87-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-89-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-91-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-93-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-95-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-97-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-99-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-101-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-103-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-105-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-107-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-109-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-111-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-113-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-115-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-117-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-119-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-121-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-123-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-125-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-128-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-129-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-131-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-133-0x0000000014520000-0x0000000016CD8000-memory.dmp
memory/5028-136-0x0000000014520000-0x0000000016CD8000-memory.dmp