c6136b1076ca0037bdc63aace068fd2aa40325cc5f450c19dc3b51d4fdf87948

Analysis

user interaction
yes
max time kernel
650s
max time network
457s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/10/2026, 18:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Orbis-RPF-Builder - v1.1.zip
Size 4.2MB
Sample261024-wsrg6swtat
SHA256 c6136b1076ca0037bdc63aace068fd2aa40325cc5f450c19dc3b51d4fdf87948
MD5 b6fd4597aea4d6995f45c07312443eab
SHA1 240db7ee847ccafa165b19ac055338bcf8d5b40b
SHA512 7a8eb7e989a37c2a4a3b647c245a500bb01141da44f5fe9fb073d74301a6362e24768b89daa7bfc93b519e8307e47b156ee23dfe1e3fb823d72c83595756580d
SSDEEP 98304:0FBE9AwOgXVMW60TZKcTbNMmLqdj2oov8nGMVDNYeIugKtWbpwaC1Iy:0xwOgsKg12ooEn5VqBsWbpwJCy
TLSH
T1451633067F84FEEA7A38816E9A049944FC77A68EE54D21121DD01C39BCAE3DD57BF420
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2192	cmd.exe
5004	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 3820	2192	cmd.exe	87
PID 5004 wrote to memory of 1620	5004	cmd.exe	95

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Orbis-RPF-Builder - v1.1.zip"
1⤵
PID:4464

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2408

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Orbis-RPF-Builder - v1.1\build.bat" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Users\Admin\Desktop\Orbis-RPF-Builder - v1.1\ragebuilder.exe
  "ragebuilder.exe" archive_builder.lua
  2⤵
  PID:3820

C:\Users\Admin\Desktop\Orbis-RPF-Builder - v1.1\ragebuilder.exe
"C:\Users\Admin\Desktop\Orbis-RPF-Builder - v1.1\ragebuilder.exe"
1⤵
PID:4528

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Orbis-RPF-Builder - v1.1\Instructions.txt
1⤵
PID:1328

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\Orbis-RPF-Builder - v1.1\build.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Users\Admin\Desktop\Orbis-RPF-Builder - v1.1\ragebuilder.exe
  "ragebuilder.exe" archive_builder.lua
  2⤵
  PID:1620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

buildlog.txt

Path C:\Users\Admin\AppData\Local\Temp\buildlog.txt
Size 476B
SHA256 4ba19e779fb73e8c2e944532b737a83502a30ff97a0253cec6c855924f986c56
MD5 afce871c7aea1dbb48e35305aa60e79c
SHA1 e5c9cbeb476006330b4f0ec1ffeff9850bfa8477
SHA512 eb739adeb7342bf681c83a238df397759738e0e9f7a92d122f254e634e6207a89e38ac18f82aabcebd29192315484be587933c7ae878fcc1fd96270c43748e72
TLSH
T1EAF02B3147EB853A4299046105793AE137170DE1CD7435651051C32E6AE97579187521
MD5 SHA1 SHA512 TLSH

Submit Download

buildlog.txt

Path C:\Users\Admin\AppData\Local\Temp\buildlog.txt
Size 1003B
SHA256 f643ee774efc93a0f2b15cd258daeff99de7c1650405214290421895bd55358b
MD5 c75123c859e80323134e955118f53093
SHA1 99f8676c7236b04997b0eecbbcdb8e82bba677e2
SHA512 3fd3ca3339da80fb0c9ee89b87fdda4c49f2e16bff9985c7e21eb2042b50a42f01ac694f6fcde0fff2e70abe7641bcceabf9a5312baf84fd424cd4d43efd4f2e
TLSH
T116112B354FEE897F005605E18A7665A0E7225984A5600FD990F0C30E957CB9F5A7ED28
MD5 SHA1 SHA512 TLSH

Submit Download

errorlog.txt

Path C:\Users\Admin\AppData\Local\Temp\errorlog.txt
Size 91B
SHA256 02520ed6a7140bd51a89e6d87a1bf1bd21472554c136322de99b190e27c523f5
MD5 cc0b7bc3c56815b5f8cf7d06ea3c9082
SHA1 436d4e23ae7a9afcbeee3e2733d69dae50361858
SHA512 540949690b0e00f71bb86a371234f4741fc6ba8d2608208f93d6c4effb1b439b5d72a9c465d67b5ec8a540ee84371c1207856b3b37cc3c86c47a41aa8488b818
TLSH
T1A4B0122043F4D009009100EC8830B4E74B0A20F0D83187B63885C70014CD5531B24290
MD5 SHA1 SHA512 TLSH

Submit Download

Archive.rpf

Path C:\Users\Admin\Desktop\Orbis-RPF-Builder - v1.1\Archive.rpf
Size 22KB
SHA256 2a756390bf64d6ea623b32385b56541669634db31b3528da5f1f7551b2eacdcd
MD5 1b82bcb9a27aab145e11c79ee8600120
SHA1 faf0a582c88fb77d49a19b443bed5b2d6bf213bb
SHA512 88f334dc0b8972ab9566f4580ee18636f96d1375cec8eb5d14cb7c0b57ecf0386255c11ad17099c8f18452e8a0a129b7724680af3648de962fb727e933561ae0
SSDEEP 384:78zJ4h43LVSY+8SCxTFSfOsPEyOwUQPHuCU9x8xE2py/sTMjpXTStJTYA4fdNT:78zJ4h4708S9OsLrG4xE2pRe9SkA4F5
TLSH
T18DA2F1D0497525096EF0C8E2BE453FC7AB57A4DA404E8FB463D2BF0630E50F0982652C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1620-10-0x0000000002D00000-0x0000000002EA6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads