Overview
overview
10Static
static
3Rebel.7z
windows7-x64
3Rebel.7z
windows10-2004-x64
3Rebel/Bin/...or.exe
windows7-x64
5Rebel/Bin/...or.exe
windows10-2004-x64
5Rebel/Bin/Rebel.dll
windows7-x64
1Rebel/Bin/Rebel.dll
windows10-2004-x64
1Rebel/Fast...ox.dll
windows7-x64
1Rebel/Fast...ox.dll
windows10-2004-x64
1Rebel/Fast...ox.xml
windows7-x64
3Rebel/Fast...ox.xml
windows10-2004-x64
1Rebel/ReadMe.txt
windows7-x64
1Rebel/ReadMe.txt
windows10-2004-x64
1Rebel/Rebe...ed.exe
windows7-x64
10Rebel/Rebe...ed.exe
windows10-2004-x64
10Rebel/Syst...om.dll
windows7-x64
1Rebel/Syst...om.dll
windows10-2004-x64
1Rebel/Syst...om.xml
windows7-x64
3Rebel/Syst...om.xml
windows10-2004-x64
1Analysis
-
max time kernel
124s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03-09-2024 19:40
Static task
static1
Behavioral task
behavioral1
Sample
Rebel.7z
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Rebel.7z
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Rebel/Bin/Injector.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Rebel/Bin/Injector.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Rebel/Bin/Rebel.dll
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
Rebel/Bin/Rebel.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Rebel/FastColoredTextBox.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Rebel/FastColoredTextBox.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Rebel/FastColoredTextBox.xml
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Rebel/FastColoredTextBox.xml
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Rebel/ReadMe.txt
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Rebel/ReadMe.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Rebel/RebelCracked.exe
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
Rebel/RebelCracked.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Rebel/System.CodeDom.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Rebel/System.CodeDom.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Rebel/System.CodeDom.xml
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
Rebel/System.CodeDom.xml
Resource
win10v2004-20240802-en
General
-
Target
Rebel/System.CodeDom.xml
-
Size
366KB
-
MD5
91af6294c77371e6773c35cfa7edd068
-
SHA1
0c24bfafb91ab69a3a7a4bfbd15a9c346341c487
-
SHA256
92287105a0987fc6ea2404e799da13f2d57b228a1fa3039a6d0cded00d4344c5
-
SHA512
bdfb5c13ee54b88d029bae6a65f932bcf27b1d71a5c373325b2e7484d21d49745c2f3983da85d50aeb6e31febbf0bfcb3cbe46415bae15877c20d54522b65904
-
SSDEEP
1536:l2e3vRrYxV4Tm0/Y/LFC9YmXVT2Y3mBhuzRKqn/gCOIFnffP6Ks5ATTglg2PLaAR:lK+c9
Malware Config
Signatures
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Rebel\System.CodeDom.xml"1⤵PID:5088
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4448,i,1330210614411927383,9239043499051775691,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:81⤵PID:4960