Analysis
- max time kernel
149s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/09/2026, 01:34
General
- Target PO-PMMA ULTRA.pdf.exe
- Size 1.3MB
- Sample260924-by4pgabc97
- SHA256 18fa7cf3620a09dfea806bf2e80f13284f64f311f9f0a252f54923a84ce6057a
Malware Config
Signatures
- .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO-PMMA ULTRA.pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO-PMMA ULTRA.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\gazetteerage.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\gazetteerage.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
gazetteerage.exe
memory/4992-703-0x00000000007A0000-0x00000000007AC000-memory.dmp
memory/4992-704-0x0000000002A10000-0x0000000002A3A000-memory.dmp
memory/4992-705-0x0000000005130000-0x0000000005186000-memory.dmp
memory/4992-706-0x0000000073E20000-0x00000000745DC000-memory.dmp
memory/4992-707-0x0000000073E20000-0x00000000745DC000-memory.dmp
memory/5036-57-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-43-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-3-0x0000000005490000-0x0000000005522000-memory.dmp
memory/5036-4-0x00000000055D0000-0x000000000566C000-memory.dmp
memory/5036-5-0x0000000005410000-0x0000000005478000-memory.dmp
memory/5036-19-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-15-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-21-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-17-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-9-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-131-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-127-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-123-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-121-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-119-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-115-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-51-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-109-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-105-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-103-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-99-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-97-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-93-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-91-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-45-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-85-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-83-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-82-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-78-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-75-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-73-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-71-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-69-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-67-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-63-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-61-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-1-0x0000000000830000-0x0000000000984000-memory.dmp
memory/5036-53-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-111-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-2-0x0000000005A50000-0x000000000600A000-memory.dmp
memory/5036-89-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-49-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-39-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-37-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-35-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-33-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-31-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-11-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-129-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-125-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-117-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-113-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-107-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-101-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-96-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-87-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-79-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-65-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-59-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-6-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-55-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-47-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-41-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-29-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-27-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-26-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-24-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-13-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-7-0x0000000005410000-0x000000000547B000-memory.dmp
memory/5036-550-0x0000000074170000-0x000000007492C000-memory.dmp
memory/5036-551-0x0000000006010000-0x0000000006198000-memory.dmp
memory/5036-552-0x00000000056D0000-0x00000000056DA000-memory.dmp
memory/5036-553-0x0000000005A10000-0x0000000005A38000-memory.dmp
memory/5036-554-0x0000000074170000-0x000000007492C000-memory.dmp
memory/5036-0-0x0000000074182000-0x0000000074183000-memory.dmp
memory/5036-555-0x0000000074182000-0x0000000074183000-memory.dmp
memory/5036-556-0x0000000008720000-0x0000000008748000-memory.dmp
memory/5036-681-0x0000000074170000-0x000000007492C000-memory.dmp
memory/5036-682-0x0000000074170000-0x000000007492C000-memory.dmp
memory/5036-687-0x0000000074170000-0x000000007492C000-memory.dmp