ebf1f88870aadeb5f22a893b6670c6ac9aaccef37dad26317e000146e3cc8a41 | Triage

Submit
Reports

Overview

overview

Static

static

3

Rebel.7z

windows7-x64

3

Rebel.7z

windows10-2004-x64

3

Rebel/Bin/...or.exe

windows7-x64

5

Rebel/Bin/...or.exe

windows10-2004-x64

5

Rebel/Bin/Rebel.dll

windows7-x64

1

Rebel/Bin/Rebel.dll

windows10-2004-x64

1

Rebel/Fast...ox.dll

windows7-x64

1

Rebel/Fast...ox.dll

windows10-2004-x64

1

Rebel/Fast...ox.xml

windows7-x64

3

Rebel/Fast...ox.xml

windows10-2004-x64

1

Rebel/ReadMe.txt

windows7-x64

1

Rebel/ReadMe.txt

windows10-2004-x64

1

Rebel/Rebe...ed.exe

windows7-x64

Rebel/Rebe...ed.exe

windows10-2004-x64

Rebel/Syst...om.dll

windows7-x64

1

Rebel/Syst...om.dll

windows10-2004-x64

1

Rebel/Syst...om.xml

windows7-x64

3

Rebel/Syst...om.xml

windows10-2004-x64

1

Analysis

max time kernel
131s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-09-2024 19:40

Sharing

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

Rebel.7z

Resource

win7-20240903-en

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral2

Sample

Rebel.7z

Resource

win10v2004-20240802-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral3

Sample

Rebel/Bin/Injector.exe

Resource

win7-20240903-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral4

Sample

Rebel/Bin/Injector.exe

Resource

win10v2004-20240802-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral5

Sample

Rebel/Bin/Rebel.dll

Resource

win7-20240729-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral6

Sample

Rebel/Bin/Rebel.dll

Resource

win10v2004-20240802-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral7

Sample

Rebel/FastColoredTextBox.dll

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral8

Sample

Rebel/FastColoredTextBox.dll

Resource

win10v2004-20240802-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral9

Sample

Rebel/FastColoredTextBox.xml

Resource

win7-20240903-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral10

Sample

Rebel/FastColoredTextBox.xml

Resource

win10v2004-20240802-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral11

Sample

Rebel/ReadMe.txt

Resource

win7-20240903-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral12

Sample

Rebel/ReadMe.txt

Resource

win10v2004-20240802-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral13

Sample

Rebel/RebelCracked.exe

Resource

win7-20240708-en

asyncrat stormkitty default credential_access discovery persistence privilege_escalation rat spyware stealer

windows7-x64

19 signatures

150 seconds

Behavioral task

behavioral14

Sample

Rebel/RebelCracked.exe

Resource

win10v2004-20240802-en

asyncrat stormkitty default credential_access discovery persistence privilege_escalation rat spyware stealer

windows10-2004-x64

21 signatures

150 seconds

Behavioral task

behavioral15

Sample

Rebel/System.CodeDom.dll

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral16

Sample

Rebel/System.CodeDom.dll

Resource

win10v2004-20240802-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral17

Sample

Rebel/System.CodeDom.xml

Resource

win7-20240903-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral18

Sample

Rebel/System.CodeDom.xml

Resource

win10v2004-20240802-en

windows10-2004-x64

0 signatures

150 seconds

Report Analysis Logs

General

Target

Rebel/FastColoredTextBox.xml
Size

132KB
MD5

70d49dec6a333f1d94fb1e77c663525c
SHA1

184b544e672f4c4cb9ed9cf010da568eed16623d
SHA256

f3f2e537065317b6ce66dac64042e925bbcea65f00561f9860b7172c9ca07027
SHA512

b78a3c4418a7c5014eb16e72f2113f00353e9e566942f7160067c826c47f1ec2752ae7ede796fc159fb9bae499d347f822401fbc4446e2556cbd680cd595c2e2
SSDEEP

1536:45SVw7sekyF7o//t3zEzacGE5xa5lIV1/P5:45Sm7sekyxo//xzEz3GlM

Score

1^/10

Malware Config

Signatures

Processes

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Rebel\FastColoredTextBox.xml"
1⤵
PID:5728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4380,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
1⤵
PID:5200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5728-0-0x00007FF9AC690000-0x00007FF9AC6A0000-memory.dmp

Filesize
64KB

Download
memory/5728-1-0x00007FF9EC6AD000-0x00007FF9EC6AE000-memory.dmp

Filesize
4KB

Download
memory/5728-2-0x00007FF9EC610000-0x00007FF9EC805000-memory.dmp

Filesize
2.0MB

Download
memory/5728-3-0x00007FF9EC610000-0x00007FF9EC805000-memory.dmp

Filesize
2.0MB

Download

© 2018-2024

Terms | Privacy