Resubmissions
11/10/2025, 22:11
251011-14b9vavqt711/07/2024, 18:59
240711-xnfesasdkd711/11/2023, 23:53
231111-3xg8macg597Analysis
- max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20240709-en - resource tags
- submitted
11/07/2024, 18:59
General
- Target PEGASUS LIME HVNC.exe
- Size 81.4MB
- Sample240711-xnfesasdkd
- SHA256 c7f32879572208365bd1e05fbf4bd8d9160eef4149736e27fb85ae4844d06eaf
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PEGASUS LIME HVNC.exe"C:\Users\Admin\AppData\Local\Temp\PEGASUS LIME HVNC.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
rabu.dll
memory/2976-0-0x0000000074F0E000-0x0000000074F0F000-memory.dmp
memory/2976-1-0x0000000000630000-0x00000000057A2000-memory.dmp
memory/2976-2-0x000000000A6C0000-0x000000000AC66000-memory.dmp
memory/2976-3-0x000000000A1B0000-0x000000000A242000-memory.dmp
memory/2976-4-0x0000000074F00000-0x00000000756B1000-memory.dmp
memory/2976-5-0x000000000A120000-0x000000000A12A000-memory.dmp
memory/2976-15-0x000000000BD50000-0x000000000BF8A000-memory.dmp
memory/2976-38-0x000000000BD50000-0x000000000BF8A000-memory.dmp
memory/2976-42-0x000000000BD50000-0x000000000BF8A000-memory.dmp
memory/2976-48-0x000000000BD50000-0x000000000BF8A000-memory.dmp
memory/2976-60-0x000000000BD50000-0x000000000BF8A000-memory.dmp
memory/2976-76-0x000000000BD50000-0x000000000BF8A000-memory.dmp
memory/2976-74-0x000000000BD50000-0x000000000BF8A000-memory.dmp
memory/2976-72-0x000000000BD50000-0x000000000BF8A000-memory.dmp
memory/2976-70-0x000000000BD50000-0x000000000BF8A000-memory.dmp
memory/2976-68-0x000000000BD50000-0x000000000BF8A000-memory.dmp
memory/2976-66-0x000000000BD50000-0x000000000BF8A000-memory.dmp
memory/2976-64-0x000000000BD50000-0x000000000BF8A000-memory.dmp
memory/2976-62-0x000000000BD50000-0x000000000BF8A000-memory.dmp
memory/2976-58-0x000000000BD50000-0x000000000BF8A000-memory.dmp
memory/2976-56-0x000000000BD50000-0x000000000BF8A000-memory.dmp
memory/2976-54-0x000000000BD50000-0x000000000BF8A000-memory.dmp
memory/2976-52-0x000000000BD50000-0x000000000BF8A000-memory.dmp
memory/2976-50-0x000000000BD50000-0x000000000BF8A000-memory.dmp
memory/2976-46-0x000000000BD50000-0x000000000BF8A000-memory.dmp
memory/2976-44-0x000000000BD50000-0x000000000BF8A000-memory.dmp
memory/2976-40-0x000000000BD50000-0x000000000BF8A000-memory.dmp
memory/2976-36-0x000000000BD50000-0x000000000BF8A000-memory.dmp
memory/2976-34-0x000000000BD50000-0x000000000BF8A000-memory.dmp
memory/2976-32-0x000000000BD50000-0x000000000BF8A000-memory.dmp
memory/2976-30-0x000000000BD50000-0x000000000BF8A000-memory.dmp
memory/2976-28-0x000000000BD50000-0x000000000BF8A000-memory.dmp
memory/2976-24-0x000000000BD50000-0x000000000BF8A000-memory.dmp
memory/2976-22-0x000000000BD50000-0x000000000BF8A000-memory.dmp
memory/2976-18-0x000000000BD50000-0x000000000BF8A000-memory.dmp
memory/2976-16-0x000000000BD50000-0x000000000BF8A000-memory.dmp
memory/2976-14-0x0000000073900000-0x000000007398A000-memory.dmp
memory/2976-26-0x000000000BD50000-0x000000000BF8A000-memory.dmp
memory/2976-20-0x000000000BD50000-0x000000000BF8A000-memory.dmp
memory/2976-6-0x000000000BD50000-0x000000000BF8E000-memory.dmp
memory/2976-6564-0x0000000074F0E000-0x0000000074F0F000-memory.dmp
memory/2976-8691-0x0000000074F00000-0x00000000756B1000-memory.dmp
memory/2976-14037-0x000000000C180000-0x000000000C18C000-memory.dmp
memory/2976-14038-0x0000000074F00000-0x00000000756B1000-memory.dmp
memory/2976-14040-0x0000000074F00000-0x00000000756B1000-memory.dmp
memory/2976-14041-0x000000000CBC0000-0x000000000CD34000-memory.dmp
memory/2976-14043-0x000000000C950000-0x000000000C980000-memory.dmp
memory/2976-14042-0x000000000CD30000-0x000000000CE46000-memory.dmp
memory/2976-14044-0x0000000074F00000-0x00000000756B1000-memory.dmp
memory/2976-14045-0x000000000DA90000-0x000000000DB2C000-memory.dmp
memory/2976-14046-0x0000000074F00000-0x00000000756B1000-memory.dmp
memory/2976-14047-0x0000000074F00000-0x00000000756B1000-memory.dmp