49945b5eb3f80e6bb9dba81c6c6f643245bb0831ce2f6e5abf4db12ab6709b76

max time kernel
1486s
max time network
1499s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
27-05-2024 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

iplookup.exe
Size

2.1MB
MD5

cb4903c1c4f23b021905da634c002f04
SHA1

c2ccf3a1e5037c6e540b94a59e2c367ba8cd9090
SHA256

49945b5eb3f80e6bb9dba81c6c6f643245bb0831ce2f6e5abf4db12ab6709b76
SHA512

7f632331ba7f2fdd3c76f7f158a1cd6e79be796f2dc9f9149b7a071bb77b35fc4f0c6f189a8179eaf4947533513a3f926c879c50c8cf6cb13abdd424113f48fa
SSDEEP

49152:PFkR/VWoA1QfIBoq2Pkbu5Gk6hQW/3f2V1mPzidqz/CIaB2w:NkR/VMCGvj/vYkP9aB

Score

7^/10

Malware Config

Signatures

.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource yara_rule

behavioral1/memory/4852-1-0x00000000003E0000-0x00000000005FE000-memory.dmp net_reactor
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 ip-api.com
Modifies registry class 1 IoCs

Processes:

MiniSearchHost.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

iplookup.exe

description pid process

Token: SeDebugPrivilege 4852 iplookup.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

MiniSearchHost.exe

pid process

2204 MiniSearchHost.exe

resource	yara_rule
behavioral1/memory/4852-1-0x00000000003E0000-0x00000000005FE000-memory.dmp	net_reactor

flow	ioc
2	ip-api.com

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

description	pid	process
Token: SeDebugPrivilege	4852	iplookup.exe

pid	process
2204	MiniSearchHost.exe

C:\Users\Admin\AppData\Local\Temp\iplookup.exe
"C:\Users\Admin\AppData\Local\Temp\iplookup.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4852

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize
10KB

MD5
e91ba7113b9ee73bf73cfbf795374b4f

SHA1
beef122500329c4babf0903b183e7ecc933a234a

SHA256
71d02f8625c90f7c9499fcbc6f2335fbacf9a5fdc58b475e0ffde696de5a9c98

SHA512
7c7644a911b218d20300a51c288182312bf57e48c78faf1791c0f710451bd907721d64f3f6d26a0cac77fa7ed088b0bc084d272f4416299122adbec9896586e7

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize
10KB

MD5
2b4dd1474237a4dc70e20f421915ac73

SHA1
d584be2833b590e89e2de69626463c89f6637baf

SHA256
f3d1b90af58e98b943ee01c3ced5d13c6bdbc5f0c2eaeca9a204aff10c2d3b9d

SHA512
f7b5470b68bc07270f01cd0032b61e60803406bb5f1fc06093dde8fc00ea7c309a9d1c467853c7af5521adf8bacc2257649a4c65d97023357950353707f31c1e

Download Submit
memory/4852-6-0x0000000005200000-0x000000000520A000-memory.dmp

Filesize
40KB

Download
memory/4852-3-0x0000000005120000-0x00000000051B2000-memory.dmp

Filesize
584KB

Download
memory/4852-4-0x0000000074FB0000-0x0000000075761000-memory.dmp

Filesize
7.7MB

Download
memory/4852-5-0x0000000074FB0000-0x0000000075761000-memory.dmp

Filesize
7.7MB

Download
memory/4852-0-0x0000000074FBE000-0x0000000074FBF000-memory.dmp

Filesize
4KB

Download
memory/4852-7-0x0000000074FB0000-0x0000000075761000-memory.dmp

Filesize
7.7MB

Download
memory/4852-8-0x0000000074FBE000-0x0000000074FBF000-memory.dmp

Filesize
4KB

Download
memory/4852-9-0x0000000074FB0000-0x0000000075761000-memory.dmp

Filesize
7.7MB

Download
memory/4852-2-0x0000000005800000-0x0000000005DA6000-memory.dmp

Filesize
5.6MB

Download
memory/4852-1-0x00000000003E0000-0x00000000005FE000-memory.dmp

Filesize
2.1MB

Download
memory/4852-27-0x0000000009700000-0x0000000009722000-memory.dmp

Filesize
136KB

Download
memory/4852-28-0x0000000009730000-0x0000000009A87000-memory.dmp

Filesize
3.3MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads