Analysis
- max time kernel
148s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 17:23
General
- Target grade_Increment 2026.exe
- Size 3.5MB
- Sample261102-vx6l8axy6k
- SHA256 79d3a29f9a2bc8bf7c45cf13b98add264636c96c3b1b14c6a3238972391cfe5b
Malware Config
Signatures
- .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Suspicious use of SetThreadContext 1 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\grade_Increment 2026.exe"C:\Users\Admin\AppData\Local\Temp\grade_Increment 2026.exe"1⤵
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exe"C:\Windows\system32\tasklist.exe" /FI "IMAGENAME eq sandboxierpcss.exe" /FI "SESSION eq 1" /FO CSV /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/832-0-0x00007FFAFD92F000-0x00007FFAFD930000-memory.dmp
memory/832-1-0x0000026554550000-0x00000265548CC000-memory.dmp
memory/832-2-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp
memory/832-3-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp
memory/832-4-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp
memory/832-5-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp
memory/832-6-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp
memory/832-7-0x0000026572250000-0x00000265722B6000-memory.dmp
memory/832-129-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-133-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-131-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-127-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-125-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-123-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-119-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-115-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-111-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-109-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-107-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-103-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-101-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-99-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-95-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-93-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-91-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-87-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-85-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-83-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-79-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-77-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-73-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-71-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-67-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-65-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-59-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-63-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-57-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-53-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-49-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-47-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-43-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-41-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-39-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-37-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-35-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-33-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-31-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-29-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-27-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-25-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-23-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-21-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-19-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-17-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-15-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-13-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-11-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-9-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-8-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-121-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-117-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-113-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-105-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-97-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-89-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-81-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-75-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-69-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-61-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-56-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-51-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-45-0x0000026572250000-0x00000265722C4000-memory.dmp
memory/832-670-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp
memory/832-671-0x0000026572300000-0x0000026572322000-memory.dmp
memory/832-672-0x00000265567C0000-0x00000265567DA000-memory.dmp
memory/832-673-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp
memory/832-674-0x0000026572D30000-0x0000026572D5A000-memory.dmp
memory/832-803-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp
memory/832-804-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp
memory/832-805-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp
memory/832-806-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp