Resubmissions
11/10/2025, 22:11
251011-14b9vavqt711/07/2024, 18:59
240711-xnfesasdkd711/11/2023, 23:53
231111-3xg8macg597Analysis
- max time kernel
118s - max time network
121s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
11/07/2024, 18:59
General
- Target PEGASUS LIME HVNC.exe
- Size 81.4MB
- Sample240711-xnfesasdkd
- SHA256 c7f32879572208365bd1e05fbf4bd8d9160eef4149736e27fb85ae4844d06eaf
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PEGASUS LIME HVNC.exe"C:\Users\Admin\AppData\Local\Temp\PEGASUS LIME HVNC.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
rabu.dll
memory/3192-0-0x000000007531E000-0x000000007531F000-memory.dmp
memory/3192-1-0x0000000000080000-0x00000000051F2000-memory.dmp
memory/3192-2-0x000000000A1B0000-0x000000000A754000-memory.dmp
memory/3192-3-0x0000000009CA0000-0x0000000009D32000-memory.dmp
memory/3192-4-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/3192-5-0x0000000009BB0000-0x0000000009BBA000-memory.dmp
memory/3192-6-0x000000000B7F0000-0x000000000BA2E000-memory.dmp
memory/3192-32-0x000000000B7F0000-0x000000000BA2A000-memory.dmp
memory/3192-50-0x000000000B7F0000-0x000000000BA2A000-memory.dmp
memory/3192-44-0x000000000B7F0000-0x000000000BA2A000-memory.dmp
memory/3192-40-0x000000000B7F0000-0x000000000BA2A000-memory.dmp
memory/3192-38-0x000000000B7F0000-0x000000000BA2A000-memory.dmp
memory/3192-36-0x000000000B7F0000-0x000000000BA2A000-memory.dmp
memory/3192-34-0x000000000B7F0000-0x000000000BA2A000-memory.dmp
memory/3192-30-0x000000000B7F0000-0x000000000BA2A000-memory.dmp
memory/3192-28-0x000000000B7F0000-0x000000000BA2A000-memory.dmp
memory/3192-26-0x000000000B7F0000-0x000000000BA2A000-memory.dmp
memory/3192-24-0x000000000B7F0000-0x000000000BA2A000-memory.dmp
memory/3192-22-0x000000000B7F0000-0x000000000BA2A000-memory.dmp
memory/3192-20-0x000000000B7F0000-0x000000000BA2A000-memory.dmp
memory/3192-18-0x000000000B7F0000-0x000000000BA2A000-memory.dmp
memory/3192-16-0x000000000B7F0000-0x000000000BA2A000-memory.dmp
memory/3192-14-0x0000000073D20000-0x0000000073DA9000-memory.dmp
memory/3192-15-0x000000000B7F0000-0x000000000BA2A000-memory.dmp
memory/3192-72-0x000000000B7F0000-0x000000000BA2A000-memory.dmp
memory/3192-76-0x000000000B7F0000-0x000000000BA2A000-memory.dmp
memory/3192-74-0x000000000B7F0000-0x000000000BA2A000-memory.dmp
memory/3192-70-0x000000000B7F0000-0x000000000BA2A000-memory.dmp
memory/3192-68-0x000000000B7F0000-0x000000000BA2A000-memory.dmp
memory/3192-66-0x000000000B7F0000-0x000000000BA2A000-memory.dmp
memory/3192-64-0x000000000B7F0000-0x000000000BA2A000-memory.dmp
memory/3192-62-0x000000000B7F0000-0x000000000BA2A000-memory.dmp
memory/3192-60-0x000000000B7F0000-0x000000000BA2A000-memory.dmp
memory/3192-58-0x000000000B7F0000-0x000000000BA2A000-memory.dmp
memory/3192-56-0x000000000B7F0000-0x000000000BA2A000-memory.dmp
memory/3192-54-0x000000000B7F0000-0x000000000BA2A000-memory.dmp
memory/3192-52-0x000000000B7F0000-0x000000000BA2A000-memory.dmp
memory/3192-48-0x000000000B7F0000-0x000000000BA2A000-memory.dmp
memory/3192-46-0x000000000B7F0000-0x000000000BA2A000-memory.dmp
memory/3192-42-0x000000000B7F0000-0x000000000BA2A000-memory.dmp
memory/3192-14035-0x000000000C160000-0x000000000C16C000-memory.dmp
memory/3192-14036-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/3192-14038-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/3192-14039-0x000000000C570000-0x000000000C6E4000-memory.dmp
memory/3192-14040-0x000000000C6E0000-0x000000000C7F6000-memory.dmp
memory/3192-14041-0x000000000A990000-0x000000000A9C0000-memory.dmp
memory/3192-14042-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/3192-14043-0x000000000D3D0000-0x000000000D46C000-memory.dmp
memory/3192-14044-0x000000007531E000-0x000000007531F000-memory.dmp
memory/3192-14045-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/3192-14046-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/3192-14047-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/3192-14048-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/3192-14049-0x0000000075310000-0x0000000075AC0000-memory.dmp