Overview

overview

10

Static

static

8

Invoice.msi

windows7_x64

10

Invoice.msi

windows10_x64

10

Analysis

  • max time kernel
    69s
  • max time network
    141s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    02-12-2020 00:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Invoice.msi

  • Size

    288KB

  • MD5

    f959677f1823dff599d226429d95c0e6

  • SHA1

    02b546733236c788dec7c680ec38afa03dc5960d

  • SHA256

    8e57e91b007a4aea044f90adce393d0a78465d62df8f70a4022f5a4533c3fd65

  • SHA512

    7e3781b42b4d2f7533523c986d0778a53ea7e995fa794c5196d49fe2229892519472cff53f6787b7a8c7f307dde0c58bd2be167b90f3c5b59a369796c3ba8547

Score
10/10
revengeratnov333stealertrojan

Malware Config

Extracted

Family

revengerat

Botnet

Nov333

C2

80.82.68.21:3333

Mutex

RV_MUTEX-FtNHuiGGjjtnxDp

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat
  • Beds Protector Packer 1 IoCs

    Detects Beds Protector packer used to load .NET malware.

  • RevengeRat Executable 2 IoCs
    stealer
  • Executes dropped EXE 2 IoCs
  • Drops startup file 2 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 8 IoCs
  • Checks SCSI registry key(s) 3 TTPs 96 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious use of AdjustPrivilegeToken 59 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Invoice.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:732
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4072
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2276
    • C:\Windows\Installer\MSIDC1F.tmp
      "C:\Windows\Installer\MSIDC1F.tmp"
      2⤵
      • Executes dropped EXE
      • Drops startup file
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3736
      • C:\Windows\Installer\MSIDC1F.tmp
        "C:\Windows\Installer\MSIDC1F.tmp"
        3⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:2228
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:768
  • \??\c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
    1⤵
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:2304

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Installer\MSIDC1F.tmp
    MD5

    49d493901c396507a0d26065e4a75283

    SHA1

    0fa197bf3b50ca8a6b6be01283e6ba1eebcc7889

    SHA256

    c04888cf051d59540208dc4e13c7b32366f131d095e50bd97c2c8fbff91c07c3

    SHA512

    a72ed9410f8fcedd6ea63a5eab84174ad78a397155238651de35c0cd69060f1bc51219430955929753a3fe8347abc0ebdf544d55f452930deab7fa99ff2fc711

    Download Submit
  • C:\Windows\Installer\MSIDC1F.tmp
    MD5

    49d493901c396507a0d26065e4a75283

    SHA1

    0fa197bf3b50ca8a6b6be01283e6ba1eebcc7889

    SHA256

    c04888cf051d59540208dc4e13c7b32366f131d095e50bd97c2c8fbff91c07c3

    SHA512

    a72ed9410f8fcedd6ea63a5eab84174ad78a397155238651de35c0cd69060f1bc51219430955929753a3fe8347abc0ebdf544d55f452930deab7fa99ff2fc711

    Download Submit
  • C:\Windows\Installer\MSIDC1F.tmp
    MD5

    49d493901c396507a0d26065e4a75283

    SHA1

    0fa197bf3b50ca8a6b6be01283e6ba1eebcc7889

    SHA256

    c04888cf051d59540208dc4e13c7b32366f131d095e50bd97c2c8fbff91c07c3

    SHA512

    a72ed9410f8fcedd6ea63a5eab84174ad78a397155238651de35c0cd69060f1bc51219430955929753a3fe8347abc0ebdf544d55f452930deab7fa99ff2fc711

    Download Submit
  • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
    MD5

    50038df61b800d7a6fd20d884dfbf81d

    SHA1

    044cb28e565c14059563f01b37c1860bd6db2aed

    SHA256

    3d25a21fce86479ff292ae67a3c30cacc224be5db805723653a2ef78f2b3b010

    SHA512

    60bcaf5f198e45fc2d3816680c63c62a85bac2a3c6d708a5e71b250085c4310def3656817b589e344cb6aa54af8c9661026fc9b459f1b7de8c452372a0eae309

    Download Submit
  • \??\Volume{0e932f02-0000-0000-0000-500600000000}\System Volume Information\SPP\OnlineMetadataCache\{38936e64-4051-4736-a3e9-9f193a32890a}_OnDiskSnapshotProp
    MD5

    c634d6f4260f0966349dd31c5af4033c

    SHA1

    684212c0668c23f374f0cdf5a23ab93e86a8e515

    SHA256

    60ad798d368df583f643d2b67ba5ebf11c436b55573c2818a6952d18829e95cd

    SHA512

    7f5da7449aab6f3e4ecd64e5eadbaf7a337eb12da77baa59a5a59ffb5e1eb27809c8e21f9e49e87fa65db70896b2f339b58f45f8e538911ad9a8f52a2e22fcee

    Download Submit
  • memory/732-26-0x000002352A840000-0x000002352A844000-memory.dmp
    Filesize

    16KB

    Download
  • memory/2228-20-0x0000000073EE0000-0x00000000745CE000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/2228-18-0x0000000000405DDE-mapping.dmp
    Download
  • memory/2228-17-0x0000000000400000-0x0000000000408000-memory.dmp
    Filesize

    32KB

    Download
  • memory/2276-2-0x0000000000000000-mapping.dmp
    Download
  • memory/3736-11-0x0000000004AA0000-0x0000000004AA1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3736-12-0x0000000004C90000-0x0000000004CC5000-memory.dmp
    Filesize

    212KB

    Download
  • memory/3736-15-0x0000000007140000-0x0000000007141000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3736-16-0x00000000073E0000-0x00000000073E1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3736-10-0x0000000004B30000-0x0000000004B31000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3736-9-0x0000000004F90000-0x0000000004F91000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3736-7-0x00000000000E0000-0x00000000000E1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3736-6-0x0000000073EE0000-0x00000000745CE000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/3736-3-0x0000000000000000-mapping.dmp
    Download