Overview
overview
8Static
static
7RevBouncerV3.59.exe
windows7-x64
1RevBouncerV3.59.exe
windows10-2004-x64
1S3 unlocke...FS.exe
windows7-x64
1S3 unlocke...FS.exe
windows10-2004-x64
1S3 unlocke...os.exe
windows7-x64
8S3 unlocke...os.exe
windows10-2004-x64
3S3 unlocke...6R.exe
windows7-x64
1S3 unlocke...6R.exe
windows10-2004-x64
1S3 unlocke...ch.exe
windows7-x64
7S3 unlocke...ch.exe
windows10-2004-x64
7S3 unlocke...ch.exe
windows7-x64
1S3 unlocke...ch.exe
windows10-2004-x64
1Analysis
-
max time kernel
65s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/04/2024, 03:08
Behavioral task
behavioral1
Sample
RevBouncerV3.59.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
RevBouncerV3.59.exe
Resource
win10v2004-20240319-en
Behavioral task
behavioral3
Sample
S3 unlocker by NAB/LFS.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
S3 unlocker by NAB/LFS.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
S3 unlocker by NAB/ProStudios.exe
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
S3 unlocker by NAB/ProStudios.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
S3 unlocker by NAB/Pro_Tweaker_0.6R.exe
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
S3 unlocker by NAB/Pro_Tweaker_0.6R.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
S3 unlocker by NAB/ip-patch.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
S3 unlocker by NAB/ip-patch.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
S3 unlocker by NAB/no_track_patch.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
S3 unlocker by NAB/no_track_patch.exe
Resource
win10v2004-20240226-en
General
-
Target
RevBouncerV3.59.exe
-
Size
113KB
-
MD5
d2f929101c58f5fb9f5747b0abe0c29f
-
SHA1
b9ce34333902c9149f76203badbbdf34440e6eb8
-
SHA256
a0cd32a5602256cf0461c2422d3839be9154e39731929d61a448832630fed130
-
SHA512
70febea27981b3f7f2585443bf9ceb38138a223c14c8928cc18ea3ff8fadc9df8f43ac0f68b7f21b04056fc2639a8c2958d75c4b8964e42f4061640b3ac29bed
-
SSDEEP
1536:RuTT0l9H8XRa3DgYxi+GQFqKBeq78ErF7cZfFjc7WlmFlDPm2+LNNHfhbfa5hqJD:sO9HARa3c5CXFDPH+Dhbfa5hqCWKU
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 38 IoCs
pid Process 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe 1612 RevBouncerV3.59.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1612 RevBouncerV3.59.exe