9e459f0e7279c11fe25ea5b97737beefb6708dd844d9e5e29d0e089c7943f99e

Resubmissions

24/03/2025, 02:10

250324-cl4dlstths 10

24/03/2025, 02:02

250324-cgb4kaxks8 10

Analysis

max time kernel
118s
max time network
135s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
24/03/2025, 02:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

REPO_ElEnemigos.rar
Size

387.1MB
MD5

8eb5c7ef9a8a34b5e33f9c97a724d7cf
SHA1

877927612c0b5eb2921bc52fb467011479bd3571
SHA256

9e459f0e7279c11fe25ea5b97737beefb6708dd844d9e5e29d0e089c7943f99e
SHA512

05056f2968565507a9688163e943547f7ca48beb0133749235c388feae781e66c9cd99e7d9b046d07052023327808d3b93fbd737ab5664bf2d623de7fd93323f
SSDEEP

6291456:Xw1OJp69lW75YCC3/HSq6vOwBXIZVMY8TB8mkzCKRMamFEJGxz:gIJp2A1YCIJKXgVD8TkzCxFCS

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2552	REPO.exe

Loads dropped DLL 19 IoCs

pid	Process
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
2552	REPO.exe
2552	REPO.exe
2552	REPO.exe
2552	REPO.exe
1196	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2880	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2880	7zFM.exe
Token: 35	2880	7zFM.exe
Token: SeSecurityPrivilege	2880	7zFM.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2880	7zFM.exe
2880	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\REPO_ElEnemigos.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2880

C:\Users\Admin\Desktop\REPO_ElEnemigos\REPO.exe
"C:\Users\Admin\Desktop\REPO_ElEnemigos\REPO.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\REPO_ElEnemigos\MonoBleedingEdge\etc\mono\4.5\Browsers\Compat.browser

Filesize
1KB

MD5
0d831c1264b5b32a39fa347de368fe48

SHA1
187dff516f9448e63ea5078190b3347922c4b3eb

SHA256
8a1082057ac5681dcd4e9c227ed7fb8eb42ac1618963b5de3b65739dd77e2741

SHA512
4b7549eda1f8ed2c4533d056b62ca5030445393f9c6003e5ee47301ff7f44b4bd5022b74d54f571aa890b6e4593c6eded1a881500ac5ba2a720dc0ff280300af

Download Submit
C:\Users\Admin\Desktop\REPO_ElEnemigos\MonoBleedingEdge\etc\mono\4.5\DefaultWsdlHelpGenerator.aspx

Filesize
59KB

MD5
f7be9f1841ff92f9d4040aed832e0c79

SHA1
b3e4b508aab3cf201c06892713b43ddb0c43b7ae

SHA256
751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a

SHA512
380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5

Download Submit
C:\Users\Admin\Desktop\REPO_ElEnemigos\WINMM.dll

Filesize
512KB

MD5
e59aac558d9f9c5d1312ac24d09c51d5

SHA1
2f11c4b00f5f92d4466348f9501aa657c9bf6fa7

SHA256
ba37009eef6c041bc6d0a271c13679fb9e14a005bd7e038cee596cd4064cf8b3

SHA512
1c3b357074d62d5ca11c92d71ffdacb4a7e3d6fb17cbd4b489e5bea0032cea43650a6809388e98e4b98256b477c6b5dbd8fd2c7f4e3e08af00ef68e0ed4406d0

Download Submit
C:\Users\Admin\Desktop\REPO_ElEnemigos\dlllist.txt

Filesize
139B

MD5
7dd443df8404c42b7db22908ad5132b9

SHA1
302f827ca20c8b4c7d71a466907c2421661429e1

SHA256
4b93c54c0d588197645352d11ebc066f6f8150a2826ed04c1525ae865ce00153

SHA512
a5be18614385400aadc57c2bd09760ac58a367b3bd1643b2e4aaa2db5426e5fe806a5428568fadc896243f65f7391c12f71b83475ed6db9ad175de6c3ab9f530

Download Submit
\Users\Admin\Desktop\REPO_ElEnemigos\REPO.exe

Filesize
651KB

MD5
37e2e7e012343ccef500133286fcbf27

SHA1
4b7e66039d04b14ddcfb580a6e6a395ea52222be

SHA256
1643ff9ed131adde7a22363f26d36308b4b4fb8f9ba61e5afce3b6803c5cb302

SHA512
418dcb69e506f42248c00459eb3fa5a576006fead83cb5372e5710a8e95265654c316bbb314e4b8afa69e393a7cdf01219b7e17095d1990ab418f0aed68c687e

Download Submit
\Users\Admin\Desktop\REPO_ElEnemigos\SteamOverlay64.dll

Filesize
114KB

MD5
0a5429b888c75f6525e1100e32dd2b69

SHA1
8ae224580aa0838a7b1570c79d4d8f27a1b46d19

SHA256
f784b4b85b627c7ea541bd2a90c9fc6e9736a0731707c31265aa86fe684dc2df

SHA512
5f77ac9619ccb5baebabb2e406ce265148ad18c6e1162c7d4c3a5656f38abedf90f756a829da856312689a738a3258382f37a279843bf7db0c14ac953c6992ef

Download Submit
\Users\Admin\Desktop\REPO_ElEnemigos\UnityCrashHandler64.exe

Filesize
1.1MB

MD5
9fbd5305c2c2fc8458c9774d3dd815e4

SHA1
4bb449696116301c686f51135699302d62770a0c

SHA256
670e0fe0d0b8e5d42109b0b4dec606c6f8252b8c98af807e36b40117c07f269f

SHA512
2ea7aecd995bbb102d03766ffc4a5419a784fc69cdee263afebcde70d2db795f88b9c39f591c0b1fcee7ab52334766b50e8827204b39b9f9cc497dc6f854684e

Download Submit
\Users\Admin\Desktop\REPO_ElEnemigos\UnityPlayer.dll

Filesize
29.5MB

MD5
b33d91200048e718c7207367f49d60fe

SHA1
cc95b2632f33ec9a533852df3402c58ef3faf0c1

SHA256
4b34672318371b54be9d89c9482a91ab3d26ae5d209935b8ad5919e00ec4f1d9

SHA512
edc94d2deab48e3aa57566904ebafc7082d63f14901c36067783deb10538e74124cdbadc72d40ec3c9db09c9e1cd27b18bdfd1969545e2607d34d5d12ec1d220

Download Submit
\Users\Admin\Desktop\REPO_ElEnemigos\winhttp.dll

Filesize
25KB

MD5
b2a4d0cb04bf8f5a27ccab237ecc2586

SHA1
c305de177f4193558d2a9a7a8cddff21a0db7f8e

SHA256
d3b62f4c9c3e2196ef82603c52d6b98c043a0d6c125c081fd33d7ca3798b41b8

SHA512
1b2e91ae3a636746aab68cbaccd0c4fba98cf434ad710d2fb9c0985b458fbb3724dc73ae209e2a7db1d48555bd7733c721775e5b0d3d901e80f0d7eba7e7d8f9

Download Submit