Analysis
-
max time kernel
150s -
max time network
12s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
20-11-2020 15:38
Static task
static1
Behavioral task
behavioral1
Sample
renekton2GPJ..exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
renekton2GPJ..exe
Resource
win10v20201028
General
-
Target
renekton2GPJ..exe
-
Size
20KB
-
MD5
126bd8afd4b7c1ad5676e489e7463511
-
SHA1
f08b87f487d7ea75a97ac10a7d995b5e83187f72
-
SHA256
ca58619fd5de06d3b93040f7c7436887d73bfd11f5d8abc6abaa07fb35fbc454
-
SHA512
71a541dcf831a8d0b684356e777beb95dfe838d71c781b92c7128691cd5f9418c30340511891239500e60f2feeed3bb383adc0b212b97a37b40cff9af814bf06
Malware Config
Extracted
revengerat
Client
127.0.0.1:333
127.0.0.1:37337
RV_MUTEX
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
RevengeRat Executable 13 IoCs
Processes:
resource yara_rule behavioral1/memory/1208-3-0x0000000000406D2E-mapping.dmp revengerat behavioral1/memory/1208-2-0x0000000000400000-0x000000000040A000-memory.dmp revengerat behavioral1/memory/1208-4-0x0000000000400000-0x000000000040A000-memory.dmp revengerat behavioral1/memory/1208-5-0x0000000000400000-0x000000000040A000-memory.dmp revengerat \Users\Admin\AppData\Roaming\teamviewer.exe revengerat \Users\Admin\AppData\Roaming\teamviewer.exe revengerat C:\Users\Admin\AppData\Roaming\teamviewer.exe revengerat C:\Users\Admin\AppData\Roaming\teamviewer.exe revengerat behavioral1/memory/1508-25-0x0000000000406D2E-mapping.dmp revengerat behavioral1/memory/1508-26-0x0000000000400000-0x000000000040A000-memory.dmp revengerat behavioral1/memory/1508-27-0x0000000000400000-0x000000000040A000-memory.dmp revengerat C:\Users\Admin\AppData\Roaming\teamviewer.exe revengerat behavioral1/memory/1712-45-0x0000000000406D2E-mapping.dmp revengerat -
Executes dropped EXE 2 IoCs
Processes:
teamviewer.exeteamviewer.exepid process 368 teamviewer.exe 2000 teamviewer.exe -
Loads dropped DLL 2 IoCs
Processes:
RegSvcs.exepid process 1208 RegSvcs.exe 1208 RegSvcs.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
renekton2GPJ..exeRegSvcs.exeteamviewer.exeRegSvcs.exeteamviewer.exeRegSvcs.exedescription pid process target process PID 1644 set thread context of 1208 1644 renekton2GPJ..exe RegSvcs.exe PID 1208 set thread context of 1392 1208 RegSvcs.exe RegSvcs.exe PID 368 set thread context of 1508 368 teamviewer.exe RegSvcs.exe PID 1508 set thread context of 1020 1508 RegSvcs.exe RegSvcs.exe PID 2000 set thread context of 1712 2000 teamviewer.exe RegSvcs.exe PID 1712 set thread context of 2032 1712 RegSvcs.exe RegSvcs.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
renekton2GPJ..exeRegSvcs.exeteamviewer.exeRegSvcs.exeteamviewer.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1644 renekton2GPJ..exe Token: SeDebugPrivilege 1208 RegSvcs.exe Token: SeDebugPrivilege 368 teamviewer.exe Token: SeDebugPrivilege 1508 RegSvcs.exe Token: SeDebugPrivilege 2000 teamviewer.exe Token: SeDebugPrivilege 1712 RegSvcs.exe -
Suspicious use of WriteProcessMemory 80 IoCs
Processes:
renekton2GPJ..exeRegSvcs.exeteamviewer.exeRegSvcs.exetaskeng.exeteamviewer.exedescription pid process target process PID 1644 wrote to memory of 1208 1644 renekton2GPJ..exe RegSvcs.exe PID 1644 wrote to memory of 1208 1644 renekton2GPJ..exe RegSvcs.exe PID 1644 wrote to memory of 1208 1644 renekton2GPJ..exe RegSvcs.exe PID 1644 wrote to memory of 1208 1644 renekton2GPJ..exe RegSvcs.exe PID 1644 wrote to memory of 1208 1644 renekton2GPJ..exe RegSvcs.exe PID 1644 wrote to memory of 1208 1644 renekton2GPJ..exe RegSvcs.exe PID 1644 wrote to memory of 1208 1644 renekton2GPJ..exe RegSvcs.exe PID 1644 wrote to memory of 1208 1644 renekton2GPJ..exe RegSvcs.exe PID 1644 wrote to memory of 1208 1644 renekton2GPJ..exe RegSvcs.exe PID 1644 wrote to memory of 1208 1644 renekton2GPJ..exe RegSvcs.exe PID 1644 wrote to memory of 1208 1644 renekton2GPJ..exe RegSvcs.exe PID 1208 wrote to memory of 1392 1208 RegSvcs.exe RegSvcs.exe PID 1208 wrote to memory of 1392 1208 RegSvcs.exe RegSvcs.exe PID 1208 wrote to memory of 1392 1208 RegSvcs.exe RegSvcs.exe PID 1208 wrote to memory of 1392 1208 RegSvcs.exe RegSvcs.exe PID 1208 wrote to memory of 1392 1208 RegSvcs.exe RegSvcs.exe PID 1208 wrote to memory of 1392 1208 RegSvcs.exe RegSvcs.exe PID 1208 wrote to memory of 1392 1208 RegSvcs.exe RegSvcs.exe PID 1208 wrote to memory of 1392 1208 RegSvcs.exe RegSvcs.exe PID 1208 wrote to memory of 1392 1208 RegSvcs.exe RegSvcs.exe PID 1208 wrote to memory of 1392 1208 RegSvcs.exe RegSvcs.exe PID 1208 wrote to memory of 1392 1208 RegSvcs.exe RegSvcs.exe PID 1208 wrote to memory of 1392 1208 RegSvcs.exe RegSvcs.exe PID 1208 wrote to memory of 368 1208 RegSvcs.exe teamviewer.exe PID 1208 wrote to memory of 368 1208 RegSvcs.exe teamviewer.exe PID 1208 wrote to memory of 368 1208 RegSvcs.exe teamviewer.exe PID 1208 wrote to memory of 368 1208 RegSvcs.exe teamviewer.exe PID 368 wrote to memory of 1508 368 teamviewer.exe RegSvcs.exe PID 368 wrote to memory of 1508 368 teamviewer.exe RegSvcs.exe PID 368 wrote to memory of 1508 368 teamviewer.exe RegSvcs.exe PID 368 wrote to memory of 1508 368 teamviewer.exe RegSvcs.exe PID 368 wrote to memory of 1508 368 teamviewer.exe RegSvcs.exe PID 368 wrote to memory of 1508 368 teamviewer.exe RegSvcs.exe PID 368 wrote to memory of 1508 368 teamviewer.exe RegSvcs.exe PID 368 wrote to memory of 1508 368 teamviewer.exe RegSvcs.exe PID 368 wrote to memory of 1508 368 teamviewer.exe RegSvcs.exe PID 368 wrote to memory of 1508 368 teamviewer.exe RegSvcs.exe PID 368 wrote to memory of 1508 368 teamviewer.exe RegSvcs.exe PID 1508 wrote to memory of 1020 1508 RegSvcs.exe RegSvcs.exe PID 1508 wrote to memory of 1020 1508 RegSvcs.exe RegSvcs.exe PID 1508 wrote to memory of 1020 1508 RegSvcs.exe RegSvcs.exe PID 1508 wrote to memory of 1020 1508 RegSvcs.exe RegSvcs.exe PID 1508 wrote to memory of 1020 1508 RegSvcs.exe RegSvcs.exe PID 1508 wrote to memory of 1020 1508 RegSvcs.exe RegSvcs.exe PID 1508 wrote to memory of 1020 1508 RegSvcs.exe RegSvcs.exe PID 1508 wrote to memory of 1020 1508 RegSvcs.exe RegSvcs.exe PID 1508 wrote to memory of 1020 1508 RegSvcs.exe RegSvcs.exe PID 1508 wrote to memory of 1020 1508 RegSvcs.exe RegSvcs.exe PID 1508 wrote to memory of 1020 1508 RegSvcs.exe RegSvcs.exe PID 1508 wrote to memory of 1020 1508 RegSvcs.exe RegSvcs.exe PID 1508 wrote to memory of 1104 1508 RegSvcs.exe schtasks.exe PID 1508 wrote to memory of 1104 1508 RegSvcs.exe schtasks.exe PID 1508 wrote to memory of 1104 1508 RegSvcs.exe schtasks.exe PID 1508 wrote to memory of 1104 1508 RegSvcs.exe schtasks.exe PID 884 wrote to memory of 2000 884 taskeng.exe teamviewer.exe PID 884 wrote to memory of 2000 884 taskeng.exe teamviewer.exe PID 884 wrote to memory of 2000 884 taskeng.exe teamviewer.exe PID 2000 wrote to memory of 1712 2000 teamviewer.exe RegSvcs.exe PID 2000 wrote to memory of 1712 2000 teamviewer.exe RegSvcs.exe PID 2000 wrote to memory of 1712 2000 teamviewer.exe RegSvcs.exe PID 2000 wrote to memory of 1712 2000 teamviewer.exe RegSvcs.exe PID 2000 wrote to memory of 1712 2000 teamviewer.exe RegSvcs.exe PID 2000 wrote to memory of 1712 2000 teamviewer.exe RegSvcs.exe PID 2000 wrote to memory of 1712 2000 teamviewer.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\renekton2GPJ..exe"C:\Users\Admin\AppData\Local\Temp\renekton2GPJ..exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\teamviewer.exe"C:\Users\Admin\AppData\Roaming\teamviewer.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"5⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "teamviewer" /tr "C:\Users\Admin\AppData\Roaming\teamviewer.exe"5⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {189B23BF-3BBB-4767-80D8-632D3D81DD72} S-1-5-21-3825035466-2522850611-591511364-1000:EIDQHRRL\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\teamviewer.exeC:\Users\Admin\AppData\Roaming\teamviewer.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\WGGjjtnx.txtMD5
1708261ead079f22b92958d5f1a0a327
SHA11777e7861423863325a313e0654d82e161439544
SHA2566c8cbff26aaf9e2cb9d9c633d0ef45cf8604456f5661720b8b5cbf3b115ed77c
SHA51276f044cee4a1b1090a769a993f859e1379c5f9508d35463dbfc598a78b3d318bc55f2e3160d3b8a2c13833e1b9eaea6974567081dc279af63f0bda993d1398d0
-
C:\Users\Admin\AppData\Local\Temp\WGGjjtnx.txtMD5
01c97a9ee076601d1c5420a013bf3230
SHA1125b4e7f4ea862a632a929ae6c95688f46ddb5d0
SHA2561eaede495cd8133b36ee2667cbd47b070aa59fd4fdb1e7e8b54f341f86193f94
SHA512730854ebb294edf1f10a20150962a6df58b9fdfef498f40aa3c4909b8ed54e3bf292cc2826dd3fc83cd792ffe005a50290af6d94e22b5fbeba10d6f674f17238
-
C:\Users\Admin\AppData\Local\Temp\WGGjjtnx.txtMD5
01c97a9ee076601d1c5420a013bf3230
SHA1125b4e7f4ea862a632a929ae6c95688f46ddb5d0
SHA2561eaede495cd8133b36ee2667cbd47b070aa59fd4fdb1e7e8b54f341f86193f94
SHA512730854ebb294edf1f10a20150962a6df58b9fdfef498f40aa3c4909b8ed54e3bf292cc2826dd3fc83cd792ffe005a50290af6d94e22b5fbeba10d6f674f17238
-
C:\Users\Admin\AppData\Roaming\teamviewer.exeMD5
126bd8afd4b7c1ad5676e489e7463511
SHA1f08b87f487d7ea75a97ac10a7d995b5e83187f72
SHA256ca58619fd5de06d3b93040f7c7436887d73bfd11f5d8abc6abaa07fb35fbc454
SHA51271a541dcf831a8d0b684356e777beb95dfe838d71c781b92c7128691cd5f9418c30340511891239500e60f2feeed3bb383adc0b212b97a37b40cff9af814bf06
-
C:\Users\Admin\AppData\Roaming\teamviewer.exeMD5
126bd8afd4b7c1ad5676e489e7463511
SHA1f08b87f487d7ea75a97ac10a7d995b5e83187f72
SHA256ca58619fd5de06d3b93040f7c7436887d73bfd11f5d8abc6abaa07fb35fbc454
SHA51271a541dcf831a8d0b684356e777beb95dfe838d71c781b92c7128691cd5f9418c30340511891239500e60f2feeed3bb383adc0b212b97a37b40cff9af814bf06
-
C:\Users\Admin\AppData\Roaming\teamviewer.exeMD5
126bd8afd4b7c1ad5676e489e7463511
SHA1f08b87f487d7ea75a97ac10a7d995b5e83187f72
SHA256ca58619fd5de06d3b93040f7c7436887d73bfd11f5d8abc6abaa07fb35fbc454
SHA51271a541dcf831a8d0b684356e777beb95dfe838d71c781b92c7128691cd5f9418c30340511891239500e60f2feeed3bb383adc0b212b97a37b40cff9af814bf06
-
\Users\Admin\AppData\Roaming\teamviewer.exeMD5
126bd8afd4b7c1ad5676e489e7463511
SHA1f08b87f487d7ea75a97ac10a7d995b5e83187f72
SHA256ca58619fd5de06d3b93040f7c7436887d73bfd11f5d8abc6abaa07fb35fbc454
SHA51271a541dcf831a8d0b684356e777beb95dfe838d71c781b92c7128691cd5f9418c30340511891239500e60f2feeed3bb383adc0b212b97a37b40cff9af814bf06
-
\Users\Admin\AppData\Roaming\teamviewer.exeMD5
126bd8afd4b7c1ad5676e489e7463511
SHA1f08b87f487d7ea75a97ac10a7d995b5e83187f72
SHA256ca58619fd5de06d3b93040f7c7436887d73bfd11f5d8abc6abaa07fb35fbc454
SHA51271a541dcf831a8d0b684356e777beb95dfe838d71c781b92c7128691cd5f9418c30340511891239500e60f2feeed3bb383adc0b212b97a37b40cff9af814bf06
-
memory/368-19-0x0000000000000000-mapping.dmp
-
memory/368-23-0x000007FEF5400000-0x000007FEF5D9D000-memory.dmpFilesize
9.6MB
-
memory/368-22-0x000007FEF5400000-0x000007FEF5D9D000-memory.dmpFilesize
9.6MB
-
memory/1020-38-0x0000000000320000-0x0000000000321000-memory.dmpFilesize
4KB
-
memory/1020-32-0x0000000000408356-mapping.dmp
-
memory/1020-36-0x0000000073850000-0x0000000073F3E000-memory.dmpFilesize
6.9MB
-
memory/1020-35-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/1020-34-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/1104-39-0x0000000000000000-mapping.dmp
-
memory/1208-2-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1208-5-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1208-4-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1208-3-0x0000000000406D2E-mapping.dmp
-
memory/1208-6-0x00000000745C0000-0x0000000074CAE000-memory.dmpFilesize
6.9MB
-
memory/1392-13-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/1392-16-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/1392-12-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/1392-9-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/1392-14-0x00000000745C0000-0x0000000074CAE000-memory.dmpFilesize
6.9MB
-
memory/1392-10-0x0000000000408356-mapping.dmp
-
memory/1508-25-0x0000000000406D2E-mapping.dmp
-
memory/1508-28-0x0000000073850000-0x0000000073F3E000-memory.dmpFilesize
6.9MB
-
memory/1508-27-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1508-26-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1644-0-0x000007FEF6120000-0x000007FEF6ABD000-memory.dmpFilesize
9.6MB
-
memory/1644-1-0x000007FEF6120000-0x000007FEF6ABD000-memory.dmpFilesize
9.6MB
-
memory/1712-45-0x0000000000406D2E-mapping.dmp
-
memory/1712-48-0x0000000073850000-0x0000000073F3E000-memory.dmpFilesize
6.9MB
-
memory/2000-40-0x0000000000000000-mapping.dmp
-
memory/2000-42-0x000007FEF4A60000-0x000007FEF53FD000-memory.dmpFilesize
9.6MB
-
memory/2000-43-0x000007FEF4A60000-0x000007FEF53FD000-memory.dmpFilesize
9.6MB
-
memory/2032-52-0x0000000000408356-mapping.dmp
-
memory/2032-56-0x0000000073850000-0x0000000073F3E000-memory.dmpFilesize
6.9MB
-
memory/2032-58-0x0000000000340000-0x0000000000341000-memory.dmpFilesize
4KB