Resubmissions
11/10/2025, 22:11
251011-14b9vavqt711/07/2024, 18:59
240711-xnfesasdkd711/11/2023, 23:53
231111-3xg8macg597Analysis
- max time kernel
126s - max time network
136s - platform
windows10-1703_x64 - resource
win10-20240611-en - resource tags
- submitted
11/07/2024, 18:59
General
- Target PEGASUS LIME HVNC.exe
- Size 81.4MB
- Sample240711-xnfesasdkd
- SHA256 c7f32879572208365bd1e05fbf4bd8d9160eef4149736e27fb85ae4844d06eaf
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PEGASUS LIME HVNC.exe"C:\Users\Admin\AppData\Local\Temp\PEGASUS LIME HVNC.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
rabu.dll
memory/1448-0-0x0000000073C1E000-0x0000000073C1F000-memory.dmp
memory/1448-1-0x00000000002A0000-0x0000000005412000-memory.dmp
memory/1448-2-0x000000000A370000-0x000000000A86E000-memory.dmp
memory/1448-3-0x0000000009D20000-0x0000000009DB2000-memory.dmp
memory/1448-4-0x0000000073C10000-0x00000000742FE000-memory.dmp
memory/1448-5-0x0000000009C90000-0x0000000009C9A000-memory.dmp
memory/1448-6-0x000000000B7C0000-0x000000000B9FE000-memory.dmp
memory/1448-14-0x0000000072680000-0x0000000072700000-memory.dmp
memory/1448-52-0x000000000B7C0000-0x000000000B9FA000-memory.dmp
memory/1448-54-0x000000000B7C0000-0x000000000B9FA000-memory.dmp
memory/1448-66-0x000000000B7C0000-0x000000000B9FA000-memory.dmp
memory/1448-72-0x000000000B7C0000-0x000000000B9FA000-memory.dmp
memory/1448-76-0x000000000B7C0000-0x000000000B9FA000-memory.dmp
memory/1448-74-0x000000000B7C0000-0x000000000B9FA000-memory.dmp
memory/1448-70-0x000000000B7C0000-0x000000000B9FA000-memory.dmp
memory/1448-68-0x000000000B7C0000-0x000000000B9FA000-memory.dmp
memory/1448-64-0x000000000B7C0000-0x000000000B9FA000-memory.dmp
memory/1448-62-0x000000000B7C0000-0x000000000B9FA000-memory.dmp
memory/1448-60-0x000000000B7C0000-0x000000000B9FA000-memory.dmp
memory/1448-58-0x000000000B7C0000-0x000000000B9FA000-memory.dmp
memory/1448-56-0x000000000B7C0000-0x000000000B9FA000-memory.dmp
memory/1448-50-0x000000000B7C0000-0x000000000B9FA000-memory.dmp
memory/1448-48-0x000000000B7C0000-0x000000000B9FA000-memory.dmp
memory/1448-46-0x000000000B7C0000-0x000000000B9FA000-memory.dmp
memory/1448-44-0x000000000B7C0000-0x000000000B9FA000-memory.dmp
memory/1448-42-0x000000000B7C0000-0x000000000B9FA000-memory.dmp
memory/1448-40-0x000000000B7C0000-0x000000000B9FA000-memory.dmp
memory/1448-38-0x000000000B7C0000-0x000000000B9FA000-memory.dmp
memory/1448-36-0x000000000B7C0000-0x000000000B9FA000-memory.dmp
memory/1448-34-0x000000000B7C0000-0x000000000B9FA000-memory.dmp
memory/1448-32-0x000000000B7C0000-0x000000000B9FA000-memory.dmp
memory/1448-30-0x000000000B7C0000-0x000000000B9FA000-memory.dmp
memory/1448-28-0x000000000B7C0000-0x000000000B9FA000-memory.dmp
memory/1448-26-0x000000000B7C0000-0x000000000B9FA000-memory.dmp
memory/1448-24-0x000000000B7C0000-0x000000000B9FA000-memory.dmp
memory/1448-22-0x000000000B7C0000-0x000000000B9FA000-memory.dmp
memory/1448-20-0x000000000B7C0000-0x000000000B9FA000-memory.dmp
memory/1448-19-0x000000000B7C0000-0x000000000B9FA000-memory.dmp
memory/1448-16-0x000000000B7C0000-0x000000000B9FA000-memory.dmp
memory/1448-15-0x000000000B7C0000-0x000000000B9FA000-memory.dmp
memory/1448-14035-0x0000000005860000-0x000000000586C000-memory.dmp
memory/1448-14036-0x0000000073C10000-0x00000000742FE000-memory.dmp
memory/1448-14038-0x0000000073C10000-0x00000000742FE000-memory.dmp
memory/1448-14039-0x000000000CA50000-0x000000000CBC4000-memory.dmp
memory/1448-14040-0x000000000C610000-0x000000000C726000-memory.dmp
memory/1448-14041-0x000000000AA70000-0x000000000AAA0000-memory.dmp
memory/1448-14042-0x0000000073C10000-0x00000000742FE000-memory.dmp
memory/1448-14043-0x000000000D5E0000-0x000000000D67C000-memory.dmp
memory/1448-14044-0x0000000073C1E000-0x0000000073C1F000-memory.dmp