Overview

overview

10

Static

static

10

R.E.P.O.rar

windows10-2004-x64

7

Analysis

  • max time kernel
    38s
  • max time network
    47s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/03/2025, 21:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    R.E.P.O.rar

  • Size

    356.1MB

  • MD5

    1ed3b3ec5c77e114debbfbf7c68bd5bc

  • SHA1

    baf86a09758bbc0dd9f172753a6442f235c71970

  • SHA256

    16945c0d4570faf7c226b80f895befefd1a1c230ebb155b3c8e288967cddee69

  • SHA512

    850a6382180498fa46a388661b9884842b1cf765cd650198cb8bfcdc1e7df2351c25c1ab5cc4833a30441c5a0bdd1431293643ebbaa02cd25a9258bc748ef74c

  • SSDEEP

    6291456:FXuPbVPk8vsh82HcvuQF46HdMm7FvwvQsEv3sMdszjhZMI3VPBwt8zx+/lFs+npr:6bZkYshrHIM0FMc3gZ13NytixN+nprFl

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\R.E.P.O.rar"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3144
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:544
    • C:\Users\Admin\Desktop\R.E.P.O\REPO.exe
      "C:\Users\Admin\Desktop\R.E.P.O\REPO.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3976
    • C:\Users\Admin\Desktop\R.E.P.O\REPO.exe
      "C:\Users\Admin\Desktop\R.E.P.O\REPO.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4476
    • C:\Users\Admin\Desktop\R.E.P.O\REPO.exe
      "C:\Users\Admin\Desktop\R.E.P.O\REPO.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3076

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\7zE84CEA478\R.E.P.O\MonoBleedingEdge\etc\mono\4.5\Browsers\Compat.browser
      Filesize

      1KB

      MD5

      0d831c1264b5b32a39fa347de368fe48

      SHA1

      187dff516f9448e63ea5078190b3347922c4b3eb

      SHA256

      8a1082057ac5681dcd4e9c227ed7fb8eb42ac1618963b5de3b65739dd77e2741

      SHA512

      4b7549eda1f8ed2c4533d056b62ca5030445393f9c6003e5ee47301ff7f44b4bd5022b74d54f571aa890b6e4593c6eded1a881500ac5ba2a720dc0ff280300af

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\7zE84CEA478\R.E.P.O\MonoBleedingEdge\etc\mono\4.5\DefaultWsdlHelpGenerator.aspx
      Filesize

      59KB

      MD5

      f7be9f1841ff92f9d4040aed832e0c79

      SHA1

      b3e4b508aab3cf201c06892713b43ddb0c43b7ae

      SHA256

      751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a

      SHA512

      380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5

      Download Submit

    • C:\Users\Admin\Desktop\R.E.P.O\REPO.exe
      Filesize

      651KB

      MD5

      37e2e7e012343ccef500133286fcbf27

      SHA1

      4b7e66039d04b14ddcfb580a6e6a395ea52222be

      SHA256

      1643ff9ed131adde7a22363f26d36308b4b4fb8f9ba61e5afce3b6803c5cb302

      SHA512

      418dcb69e506f42248c00459eb3fa5a576006fead83cb5372e5710a8e95265654c316bbb314e4b8afa69e393a7cdf01219b7e17095d1990ab418f0aed68c687e

      Download Submit

    • C:\Users\Admin\Desktop\R.E.P.O\SteamOverlay64.dll
      Filesize

      114KB

      MD5

      0a5429b888c75f6525e1100e32dd2b69

      SHA1

      8ae224580aa0838a7b1570c79d4d8f27a1b46d19

      SHA256

      f784b4b85b627c7ea541bd2a90c9fc6e9736a0731707c31265aa86fe684dc2df

      SHA512

      5f77ac9619ccb5baebabb2e406ce265148ad18c6e1162c7d4c3a5656f38abedf90f756a829da856312689a738a3258382f37a279843bf7db0c14ac953c6992ef

      Download Submit

    • C:\Users\Admin\Desktop\R.E.P.O\UnityPlayer.dll
      Filesize

      29.5MB

      MD5

      b33d91200048e718c7207367f49d60fe

      SHA1

      cc95b2632f33ec9a533852df3402c58ef3faf0c1

      SHA256

      4b34672318371b54be9d89c9482a91ab3d26ae5d209935b8ad5919e00ec4f1d9

      SHA512

      edc94d2deab48e3aa57566904ebafc7082d63f14901c36067783deb10538e74124cdbadc72d40ec3c9db09c9e1cd27b18bdfd1969545e2607d34d5d12ec1d220

      Download Submit

    • C:\Users\Admin\Desktop\R.E.P.O\WINMM.dll
      Filesize

      512KB

      MD5

      e59aac558d9f9c5d1312ac24d09c51d5

      SHA1

      2f11c4b00f5f92d4466348f9501aa657c9bf6fa7

      SHA256

      ba37009eef6c041bc6d0a271c13679fb9e14a005bd7e038cee596cd4064cf8b3

      SHA512

      1c3b357074d62d5ca11c92d71ffdacb4a7e3d6fb17cbd4b489e5bea0032cea43650a6809388e98e4b98256b477c6b5dbd8fd2c7f4e3e08af00ef68e0ed4406d0

      Download Submit

    • C:\Users\Admin\Desktop\R.E.P.O\dlllist.txt
      Filesize

      139B

      MD5

      7dd443df8404c42b7db22908ad5132b9

      SHA1

      302f827ca20c8b4c7d71a466907c2421661429e1

      SHA256

      4b93c54c0d588197645352d11ebc066f6f8150a2826ed04c1525ae865ce00153

      SHA512

      a5be18614385400aadc57c2bd09760ac58a367b3bd1643b2e4aaa2db5426e5fe806a5428568fadc896243f65f7391c12f71b83475ed6db9ad175de6c3ab9f530

      Download Submit