Resubmissions
19-07-2024 11:42
240719-nvdebsseqe 715-07-2024 02:08
240715-ckmpgatall 712-07-2024 03:13
240712-dqsncawemk 710-07-2024 03:52
240710-efav8avfkr 710-07-2024 03:26
240710-dzd7bawbpf 728-06-2024 04:27
240628-e3a5haterr 724-06-2024 05:26
240624-f4thxa1gpp 723-06-2024 05:23
240623-f27yhs1dkd 723-06-2024 05:09
240623-fs92hs1brb 727-05-2024 02:32
240527-c1enssea94 7Analysis
-
max time kernel
1385s -
max time network
1174s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 21:07
Static task
static1
Behavioral task
behavioral1
Sample
iplookup.exe
Resource
win10v2004-20240508-en
General
-
Target
iplookup.exe
-
Size
2.1MB
-
MD5
cb4903c1c4f23b021905da634c002f04
-
SHA1
c2ccf3a1e5037c6e540b94a59e2c367ba8cd9090
-
SHA256
49945b5eb3f80e6bb9dba81c6c6f643245bb0831ce2f6e5abf4db12ab6709b76
-
SHA512
7f632331ba7f2fdd3c76f7f158a1cd6e79be796f2dc9f9149b7a071bb77b35fc4f0c6f189a8179eaf4947533513a3f926c879c50c8cf6cb13abdd424113f48fa
-
SSDEEP
49152:PFkR/VWoA1QfIBoq2Pkbu5Gk6hQW/3f2V1mPzidqz/CIaB2w:NkR/VMCGvj/vYkP9aB
Malware Config
Signatures
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Processes:
resource yara_rule behavioral1/memory/848-1-0x0000000000B50000-0x0000000000D6E000-memory.dmp net_reactor -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 34 ip-api.com 72 ip-api.com -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
iplookup.exedescription pid process Token: SeDebugPrivilege 848 iplookup.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/848-0-0x000000007527E000-0x000000007527F000-memory.dmpFilesize
4KB
-
memory/848-1-0x0000000000B50000-0x0000000000D6E000-memory.dmpFilesize
2.1MB
-
memory/848-2-0x0000000005E50000-0x00000000063F4000-memory.dmpFilesize
5.6MB
-
memory/848-3-0x00000000057D0000-0x0000000005862000-memory.dmpFilesize
584KB
-
memory/848-4-0x0000000075270000-0x0000000075A20000-memory.dmpFilesize
7.7MB
-
memory/848-5-0x0000000075270000-0x0000000075A20000-memory.dmpFilesize
7.7MB
-
memory/848-6-0x0000000005B60000-0x0000000005B6A000-memory.dmpFilesize
40KB
-
memory/848-7-0x0000000075270000-0x0000000075A20000-memory.dmpFilesize
7.7MB
-
memory/848-8-0x000000007527E000-0x000000007527F000-memory.dmpFilesize
4KB
-
memory/848-9-0x0000000075270000-0x0000000075A20000-memory.dmpFilesize
7.7MB
-
memory/848-10-0x0000000075270000-0x0000000075A20000-memory.dmpFilesize
7.7MB
-
memory/848-11-0x0000000075270000-0x0000000075A20000-memory.dmpFilesize
7.7MB
-
memory/848-12-0x0000000009BE0000-0x0000000009C02000-memory.dmpFilesize
136KB
-
memory/848-13-0x0000000009C10000-0x0000000009F64000-memory.dmpFilesize
3.3MB