Analysis
- max time kernel
149s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
31/08/2026, 12:12
General
- Target invoice and packing list.exe
- Size 1.0MB
- Sample260831-pdcbdatxds
- SHA256 fb0889110aec73085c455f345f4f920d68aec7ae70f84867c57c9ca0e49b9564
Malware Config
Signatures
- .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\invoice and packing list.exe"C:\Users\Admin\AppData\Local\Temp\invoice and packing list.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4648-0-0x0000000074E62000-0x0000000074E63000-memory.dmp
memory/4648-1-0x0000000000010000-0x000000000011C000-memory.dmp
memory/4648-2-0x0000000005140000-0x00000000056FA000-memory.dmp
memory/4648-3-0x0000000004AD0000-0x0000000004B62000-memory.dmp
memory/4648-4-0x0000000004C20000-0x0000000004CBC000-memory.dmp
memory/4648-5-0x0000000004B90000-0x0000000004BF8000-memory.dmp
memory/4648-6-0x0000000074E50000-0x000000007560C000-memory.dmp
memory/4648-112-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-104-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-96-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-92-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-90-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-73-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-66-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-60-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-48-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-40-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-34-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-28-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-23-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-18-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-16-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-7-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-118-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-133-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-122-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-130-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-128-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-126-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-116-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-114-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-110-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-108-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-106-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-102-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-100-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-98-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-94-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-88-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-86-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-84-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-82-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-80-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-78-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-76-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-74-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-70-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-68-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-64-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-62-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-58-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-56-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-54-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-52-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-50-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-46-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-44-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-42-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-38-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-36-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-32-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-30-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-26-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-24-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-21-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-14-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-12-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-10-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-8-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-124-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-120-0x0000000004B90000-0x0000000004BFB000-memory.dmp
memory/4648-551-0x0000000074E50000-0x000000007560C000-memory.dmp
memory/4648-552-0x0000000004E80000-0x0000000004E8A000-memory.dmp
memory/4648-553-0x0000000006250000-0x0000000006278000-memory.dmp
memory/4648-554-0x0000000074E50000-0x000000007560C000-memory.dmp
memory/4648-555-0x0000000074E62000-0x0000000074E63000-memory.dmp
memory/4648-556-0x0000000074E50000-0x000000007560C000-memory.dmp
memory/4648-557-0x0000000007A80000-0x0000000007AA8000-memory.dmp
memory/4648-682-0x0000000074E50000-0x000000007560C000-memory.dmp
memory/4648-683-0x0000000074E50000-0x000000007560C000-memory.dmp
memory/4648-688-0x0000000074E50000-0x000000007560C000-memory.dmp