Analysis
- max time kernel
148s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
05/08/2026, 14:32
General
- Target Q88 with vessel's particulars.exe
- Size 1009KB
- Sample260805-rwf4dsbf48
- SHA256 151b01ecbb7aca8b8a3e82f2e74c4f496e95046b89601a2482e6dcb3d570d78c
Malware Config
Signatures
- .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 35 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Q88 with vessel's particulars.exe"C:\Users\Admin\AppData\Local\Temp\Q88 with vessel's particulars.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 29 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "pdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.exe"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 293⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "pdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.exe"3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 36 > nul && copy "C:\Users\Admin\AppData\Local\Temp\Q88 with vessel's particulars.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.exe" && ping 127.0.0.1 -n 36 > nul && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.exe"2⤵
- Creates a file in the Startup directory
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 363⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 363⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
pdf.exe
memory/1172-559-0x0000000074590000-0x0000000074D4C000-memory.dmp
memory/1172-560-0x0000000074590000-0x0000000074D4C000-memory.dmp
memory/1172-1105-0x0000000074590000-0x0000000074D4C000-memory.dmp
memory/1172-1106-0x0000000007100000-0x0000000007128000-memory.dmp
memory/4980-126-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-96-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-2-0x0000000005460000-0x0000000005A1A000-memory.dmp
memory/4980-3-0x0000000004D90000-0x0000000004E22000-memory.dmp
memory/4980-4-0x0000000004F40000-0x0000000004FDC000-memory.dmp
memory/4980-5-0x00000000745C0000-0x0000000074D7C000-memory.dmp
memory/4980-110-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-26-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-124-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-120-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-114-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-108-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-102-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-100-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-116-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-80-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-66-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-60-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-54-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-44-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-24-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-22-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-20-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-16-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-14-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-8-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-18-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-12-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-10-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-134-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-132-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-130-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-551-0x00000000745C0000-0x0000000074D7C000-memory.dmp
memory/4980-552-0x0000000005150000-0x000000000515A000-memory.dmp
memory/4980-128-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-0-0x00000000745D2000-0x00000000745D3000-memory.dmp
memory/4980-122-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-118-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-84-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-1-0x00000000002C0000-0x00000000003C2000-memory.dmp
memory/4980-6-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-106-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-104-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-98-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-112-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-94-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-92-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-90-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-88-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-87-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-82-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-78-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-76-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-74-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-72-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-70-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-68-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-64-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-62-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-58-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-56-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-52-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-50-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-48-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-46-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-42-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-40-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-38-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-37-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-34-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-32-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-30-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-28-0x0000000004EA0000-0x0000000004F08000-memory.dmp
memory/4980-553-0x0000000006440000-0x0000000006468000-memory.dmp
memory/4980-554-0x00000000745C0000-0x0000000074D7C000-memory.dmp
memory/4980-555-0x00000000745D2000-0x00000000745D3000-memory.dmp
memory/4980-556-0x00000000745C0000-0x0000000074D7C000-memory.dmp
memory/4980-557-0x00000000745C0000-0x0000000074D7C000-memory.dmp