Analysis
- max time kernel
150s - max time network
104s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
01/09/2026, 06:18
General
- Target invoice and packing list.exe
- Size 1.2MB
- Sample260901-g2v5dstdke
- SHA256 d2a4ad1db761a3776160317ba0325d100e65d2baea62d52effee899ab5d355a8
Malware Config
Signatures
- .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\invoice and packing list.exe"C:\Users\Admin\AppData\Local\Temp\invoice and packing list.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2400-0-0x0000000074E72000-0x0000000074E73000-memory.dmp
memory/2400-1-0x0000000000D10000-0x0000000000E46000-memory.dmp
memory/2400-2-0x0000000005FA0000-0x000000000655A000-memory.dmp
memory/2400-3-0x00000000059E0000-0x0000000005A72000-memory.dmp
memory/2400-4-0x0000000005A80000-0x0000000005B1C000-memory.dmp
memory/2400-5-0x0000000074E60000-0x000000007561C000-memory.dmp
memory/2400-6-0x0000000005960000-0x000000000596A000-memory.dmp
memory/2400-7-0x0000000005B20000-0x0000000005B88000-memory.dmp
memory/2400-45-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-51-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-117-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-133-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-131-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-129-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-127-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-125-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-123-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-121-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-119-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-115-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-111-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-109-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-76-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-107-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-105-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-103-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-101-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-100-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-95-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-93-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-91-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-89-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-87-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-552-0x0000000074E60000-0x000000007561C000-memory.dmp
memory/2400-85-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-83-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-554-0x0000000074E60000-0x000000007561C000-memory.dmp
memory/2400-553-0x0000000005F70000-0x0000000005F98000-memory.dmp
memory/2400-81-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-79-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-77-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-73-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-72-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-69-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-67-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-66-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-63-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-61-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-59-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-57-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-55-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-54-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-113-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-49-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-97-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-47-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-43-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-42-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-39-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-37-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-35-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-33-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-32-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-29-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-27-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-25-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-23-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-21-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-19-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-17-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-15-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-13-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-11-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-9-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-8-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2400-555-0x0000000074E72000-0x0000000074E73000-memory.dmp
memory/2400-556-0x0000000074E60000-0x000000007561C000-memory.dmp
memory/2400-557-0x0000000008A70000-0x0000000008A98000-memory.dmp
memory/2400-682-0x0000000074E60000-0x000000007561C000-memory.dmp
memory/2400-683-0x0000000074E60000-0x000000007561C000-memory.dmp
memory/2400-688-0x0000000074E60000-0x000000007561C000-memory.dmp