Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
24/09/2026, 01:34
General
- Target PO-PMMA ULTRA.pdf.exe
- Size 1.3MB
- Sample260924-by4pgabc97
- SHA256 18fa7cf3620a09dfea806bf2e80f13284f64f311f9f0a252f54923a84ce6057a
Malware Config
Signatures
- .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO-PMMA ULTRA.pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO-PMMA ULTRA.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\gazetteerage.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\gazetteerage.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
gazetteerage.exe
memory/5760-711-0x00000000004C0000-0x00000000004CC000-memory.dmp
memory/5760-712-0x0000000004C50000-0x0000000004C7A000-memory.dmp
memory/5760-713-0x0000000004CE0000-0x0000000004D36000-memory.dmp
memory/6128-0-0x0000000000970000-0x0000000000AC4000-memory.dmp
memory/6128-1-0x0000000005900000-0x0000000005EA4000-memory.dmp
memory/6128-2-0x0000000005350000-0x00000000053E2000-memory.dmp
memory/6128-3-0x00000000053F0000-0x000000000548C000-memory.dmp
memory/6128-4-0x0000000002E60000-0x0000000002EC8000-memory.dmp
memory/6128-78-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-60-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-122-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-88-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-86-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-84-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-82-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-80-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-76-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-74-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-72-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-70-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-68-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-66-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-64-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-62-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-58-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-56-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-54-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-52-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-50-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-42-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-40-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-38-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-36-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-34-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-32-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-30-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-28-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-26-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-22-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-20-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-18-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-17-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-12-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-10-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-5-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-6-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-48-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-46-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-44-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-24-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-14-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-8-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-130-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-128-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-126-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-124-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-552-0x0000000005550000-0x000000000555A000-memory.dmp
memory/6128-553-0x00000000058A0000-0x00000000058C8000-memory.dmp
memory/6128-554-0x00000000055A0000-0x00000000055B0000-memory.dmp
memory/6128-551-0x0000000005EB0000-0x0000000006036000-memory.dmp
memory/6128-550-0x00000000054A0000-0x00000000054A1000-memory.dmp
memory/6128-549-0x00000000055A0000-0x00000000055B0000-memory.dmp
memory/6128-120-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-118-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-116-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-114-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-112-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-110-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-108-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-106-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-104-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-102-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-100-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-98-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-96-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-94-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-92-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-90-0x0000000002E60000-0x0000000002ECB000-memory.dmp
memory/6128-555-0x00000000055A0000-0x00000000055B0000-memory.dmp
memory/6128-556-0x00000000055A0000-0x00000000055B0000-memory.dmp
memory/6128-557-0x0000000006C80000-0x0000000006CA8000-memory.dmp
memory/6128-682-0x0000000006CD0000-0x0000000006CD1000-memory.dmp