Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
08-11-2020 14:26
Static task
static1
Behavioral task
behavioral1
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v20201028
General
-
Target
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
-
Size
17KB
-
MD5
aa0a434f00c138ef445bf89493a6d731
-
SHA1
2e798c079b179b736247cf20d1346657db9632c7
-
SHA256
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654
-
SHA512
e5b50ccd82c9cd5797dfc278dbd4bef6b4cb4468424962666d2618707a3c69e0154e8fb11846e0f529dd6e903fd9de2a2f4dd3b526821b10f08530371a0c6952
Malware Config
Extracted
revengerat
Victime
cocohack.dtdns.net:84
RV_MUTEX-OKuSAtYBxGgZHx
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
RevengeRat Executable 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Client.exe revengerat C:\Users\Admin\AppData\Roaming\Client.exe revengerat -
Executes dropped EXE 1 IoCs
Processes:
Client.exepid process 2656 Client.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Client.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client = "C:\\Users\\Admin\\AppData\\Roaming\\Client.exe" Client.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exeClient.exedescription pid process Token: SeDebugPrivilege 1192 948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe Token: SeDebugPrivilege 2656 Client.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exedescription pid process target process PID 1192 wrote to memory of 2656 1192 948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe Client.exe PID 1192 wrote to memory of 2656 1192 948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe Client.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe"C:\Users\Admin\AppData\Local\Temp\948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Client.exe"C:\Users\Admin\AppData\Roaming\Client.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Client.exeMD5
aa0a434f00c138ef445bf89493a6d731
SHA12e798c079b179b736247cf20d1346657db9632c7
SHA256948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654
SHA512e5b50ccd82c9cd5797dfc278dbd4bef6b4cb4468424962666d2618707a3c69e0154e8fb11846e0f529dd6e903fd9de2a2f4dd3b526821b10f08530371a0c6952
-
C:\Users\Admin\AppData\Roaming\Client.exeMD5
aa0a434f00c138ef445bf89493a6d731
SHA12e798c079b179b736247cf20d1346657db9632c7
SHA256948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654
SHA512e5b50ccd82c9cd5797dfc278dbd4bef6b4cb4468424962666d2618707a3c69e0154e8fb11846e0f529dd6e903fd9de2a2f4dd3b526821b10f08530371a0c6952
-
memory/1192-0-0x00007FFE6DF50000-0x00007FFE6E8F0000-memory.dmpFilesize
9.6MB
-
memory/2656-1-0x0000000000000000-mapping.dmp
-
memory/2656-4-0x00007FFE6DF50000-0x00007FFE6E8F0000-memory.dmpFilesize
9.6MB