Analysis
-
max time kernel
135s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
26-03-2022 02:22
Static task
static1
Behavioral task
behavioral1
Sample
1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe
Resource
win10v2004-en-20220113
General
-
Target
1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe
-
Size
254KB
-
MD5
2e0028323603aa6918e38e0c92755825
-
SHA1
f477007ed48ad39afb53d5c82383bc99423fb2ef
-
SHA256
1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280
-
SHA512
2de163f12b6ae8ca02ece0b94c9dc9fa24f8d645f8ac2ebc054b6e141aa0204073f50cf357cdfb74979ed164f1a5af01262270bc7ba60486a69dc24005ed8df0
Malware Config
Extracted
revengerat
Nov
80.82.68.21:3333
RV_MUTEX-IgZblRvZwfRt
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
RevengeRat Executable 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4444-154-0x0000000000400000-0x0000000000408000-memory.dmp revengerat -
Drops startup file 1 IoCs
Processes:
1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exedescription pid process target process PID 4900 set thread context of 4444 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 408 timeout.exe -
Modifies registry class 1 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings powershell.exe -
Suspicious behavior: EnumeratesProcesses 57 IoCs
Processes:
1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exepowershell.exe1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exepid process 1936 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 1936 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 1936 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 1936 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 1936 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 1936 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 1936 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 1936 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 1936 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 1936 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 1936 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 1936 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 1936 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 1936 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 1936 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 1936 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 1936 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 1936 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 5060 powershell.exe 5060 powershell.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
WScript.exepid process 1448 WScript.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exepowershell.exe1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exedescription pid process Token: SeDebugPrivilege 1936 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe Token: SeDebugPrivilege 5060 powershell.exe Token: SeDebugPrivilege 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe Token: SeDebugPrivilege 4444 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.execmd.exepowershell.exe1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exedescription pid process target process PID 1936 wrote to memory of 3328 1936 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe cmd.exe PID 1936 wrote to memory of 3328 1936 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe cmd.exe PID 1936 wrote to memory of 3328 1936 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe cmd.exe PID 3328 wrote to memory of 408 3328 cmd.exe timeout.exe PID 3328 wrote to memory of 408 3328 cmd.exe timeout.exe PID 3328 wrote to memory of 408 3328 cmd.exe timeout.exe PID 3328 wrote to memory of 5060 3328 cmd.exe powershell.exe PID 3328 wrote to memory of 5060 3328 cmd.exe powershell.exe PID 3328 wrote to memory of 5060 3328 cmd.exe powershell.exe PID 5060 wrote to memory of 1448 5060 powershell.exe WScript.exe PID 5060 wrote to memory of 1448 5060 powershell.exe WScript.exe PID 5060 wrote to memory of 1448 5060 powershell.exe WScript.exe PID 5060 wrote to memory of 4900 5060 powershell.exe 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe PID 5060 wrote to memory of 4900 5060 powershell.exe 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe PID 5060 wrote to memory of 4900 5060 powershell.exe 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe PID 4900 wrote to memory of 4444 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe PID 4900 wrote to memory of 4444 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe PID 4900 wrote to memory of 4444 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe PID 4900 wrote to memory of 4444 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe PID 4900 wrote to memory of 4444 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe PID 4900 wrote to memory of 4444 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe PID 4900 wrote to memory of 4444 4900 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe 1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe"C:\Users\Admin\AppData\Local\Temp\1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\cmd.execmd.exe /c timeout 5 & powershell -command Start-Process -WindowStyle hidden -FilePath 'C:\Users\Admin\AppData\Local\Temp\\711712.js'; Start-Sleep -s 5; Start-Process -WindowStyle hidden -FilePath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe'2⤵
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\SysWOW64\timeout.exetimeout 53⤵
- Delays execution with timeout.exe
PID:408 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -command Start-Process -WindowStyle hidden -FilePath 'C:\Users\Admin\AppData\Local\Temp\\711712.js'; Start-Sleep -s 5; Start-Process -WindowStyle hidden -FilePath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe'3⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\711712.js"4⤵
- Suspicious behavior: RenamesItself
PID:1448 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe"4⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1538bdbcaa726662785bd503063af939f08260b45400292592bf63caa4d8a280.exe"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4444
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\711712.jsMD5
0f3972f0eb12f2eec25d627fe5f5eb4d
SHA14515e37481966627778bb814018e284d631624fd
SHA256d5a0a6a8d207c52c63261317eb572637407ff197161c66cf27f4fb4522e0e3f5
SHA5121ff14a996ea42c3d03fdae0038e3fe228c2d0e54ee96dd25c332647c1f814fa4f4b89db0896538cf6fa838d347acaab19ad56934b29df189357787bec50a88dd
-
memory/408-138-0x0000000000000000-mapping.dmp
-
memory/1448-150-0x0000000000000000-mapping.dmp
-
memory/1936-136-0x0000000006190000-0x00000000061F6000-memory.dmpFilesize
408KB
-
memory/1936-134-0x0000000005520000-0x000000000553E000-memory.dmpFilesize
120KB
-
memory/1936-135-0x0000000005E80000-0x0000000005F1C000-memory.dmpFilesize
624KB
-
memory/1936-133-0x00000000055A0000-0x0000000005616000-memory.dmpFilesize
472KB
-
memory/1936-132-0x0000000005410000-0x00000000054A2000-memory.dmpFilesize
584KB
-
memory/1936-130-0x0000000000A20000-0x0000000000A64000-memory.dmpFilesize
272KB
-
memory/1936-131-0x00000000058D0000-0x0000000005E74000-memory.dmpFilesize
5.6MB
-
memory/3328-137-0x0000000000000000-mapping.dmp
-
memory/4444-154-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/4444-153-0x0000000000000000-mapping.dmp
-
memory/4900-155-0x0000000006670000-0x000000000667A000-memory.dmpFilesize
40KB
-
memory/4900-152-0x0000000000000000-mapping.dmp
-
memory/5060-142-0x00000000055E0000-0x0000000005602000-memory.dmpFilesize
136KB
-
memory/5060-146-0x0000000006A80000-0x0000000006A9A000-memory.dmpFilesize
104KB
-
memory/5060-148-0x0000000006AD0000-0x0000000006AF2000-memory.dmpFilesize
136KB
-
memory/5060-147-0x0000000003185000-0x0000000003187000-memory.dmpFilesize
8KB
-
memory/5060-145-0x0000000006B10000-0x0000000006BA6000-memory.dmpFilesize
600KB
-
memory/5060-144-0x00000000065B0000-0x00000000065CE000-memory.dmpFilesize
120KB
-
memory/5060-151-0x0000000008770000-0x0000000008DEA000-memory.dmpFilesize
6.5MB
-
memory/5060-143-0x0000000005F20000-0x0000000005F86000-memory.dmpFilesize
408KB
-
memory/5060-141-0x0000000005880000-0x0000000005EA8000-memory.dmpFilesize
6.2MB
-
memory/5060-140-0x0000000002FC0000-0x0000000002FF6000-memory.dmpFilesize
216KB
-
memory/5060-139-0x0000000000000000-mapping.dmp