71dc6c4bacc694a2be6b6570e3370c2798189bb479574e11c93fc1f4a56a5581

Analysis

user interaction
yes
max time kernel
46s
max time network
24s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Rebellion2.exe
Size 1.2MB
Sample260912-2cgwpaba84
SHA256 71dc6c4bacc694a2be6b6570e3370c2798189bb479574e11c93fc1f4a56a5581
MD5 2d8cd9bb39ec2f610e8ecdda9961215f
SHA1 3582ac3d83e922de00d028704db463002a7a6c5c
SHA512 cd1baf3fcee27faa9d91bfe673b1c9156932a6e76b8b816d06abb16fcd84fb6b73c03aea7645c7608ecb8d136f63fde4e3b34674b96ee311f9ecf28c1e7f7abe
SSDEEP 24576:525kkKdcLt08/9urpsc05oMCfD6JyWPRG5T+0ICLn6cj+R35XPxXXGx+:06xcx0yWtMkmt0EQn6cYD
TLSH
T15345F119D7F405F9E1B7E178CD834A12EB767C4947A1E6CF03A4A9661F232A08E3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1680	Rebellion.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings	Rebellion2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Rebellion2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	Rebellion2.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	Rebellion2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	Rebellion2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	Rebellion2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	Rebellion2.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2644	NOTEPAD.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3300	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 1680	4268	Rebellion2.exe	87
PID 3300 wrote to memory of 2644	3300	OpenWith.exe	93

C:\Users\Admin\AppData\Local\Temp\Rebellion2.exe
"C:\Users\Admin\AppData\Local\Temp\Rebellion2.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Rebellion.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Rebellion.exe"
  2⤵
  - Executes dropped EXE
  PID:1680

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\RarSFX0\system32.py
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Rebellion.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Rebellion.exe
Size 1.8MB
SHA256 a63fdd229b897f7f8e05fa34ef783dd06ce7ab6add36f8354233cb21e4fb8013
MD5 4b83a5f6db9dd93493c4296224625d82
SHA1 3c699857a0c8b88cee187e557a4a600e0d9d176d
SHA512 a55e80c02a3f681ce94d8a49cded079bed7e17d4714459edfe4e9f96ea1df5130c20647547ebb8df4d8b35a777ef163d3dce99180616d234da45183023265b67
SSDEEP 24576:v1QYQB+t2EA2Rp4UeljY2sYDc8SMCXB1+mY67U4QHkDQwAOKnynwpoWGS:NQfBnEdRCjUYBIx1xv7WHkDQw7vnfWz
TLSH
T1C9957E16A3E000F8D5A7C17BCA8BB613E676704D17F166EF2BD44A952F63BE04A39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system32.py

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\system32.py
Size 30KB
SHA256 cc5ffe161ff7dd35ad2755db0bd5491637a863ad3a4714b83a4a1d6081dfc5a5
MD5 c8686dfa35c16d65bd9d106369e2b87d
SHA1 a3f370cc06f566f83557defcefe398e5b1e79cda
SHA512 2ce90f483a1fba95a294566adf6bd25b8cdffaf63aa7b810a3da7d2710f36c42a544da980199e0700462b69fcac528625b9cccc596aa9df268040cf6f3149d3e
SSDEEP 384:Un6liTcBz4qSf4H+SihBkLmhvfmGBKwKQHneOUO2p:U6gpfm+SihYmh5rKnO3s
TLSH
T1F6E2EA8668BF2825E743D5E5AC33D0435214BA272F01347D7BECA1A05F88636C6F5EAD
MD5 SHA1 SHA512 SSDEEP TLSH