Analysis
-
max time kernel
136s -
max time network
114s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
07-05-2022 20:33
Static task
static1
Behavioral task
behavioral1
Sample
fd4f94d12269d74166408823e51fe1fbc64a776ade7554a27acaf07cae6483fa.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
fd4f94d12269d74166408823e51fe1fbc64a776ade7554a27acaf07cae6483fa.exe
Resource
win10v2004-20220414-en
General
-
Target
fd4f94d12269d74166408823e51fe1fbc64a776ade7554a27acaf07cae6483fa.exe
-
Size
89KB
-
MD5
793fd610adf1d34f757e9db8510e8ff2
-
SHA1
e54835aea0d357cd955c3c9876f6c6b1982fcf99
-
SHA256
fd4f94d12269d74166408823e51fe1fbc64a776ade7554a27acaf07cae6483fa
-
SHA512
3ad0a8c0aa14b2bea294d9aa5d914e46dc33d4df1ef2083c5050ab4cac693c01f0419ce9e3da20487d21102baa16b4cc9ce48947127b76aaf661a5bbe84fdd8f
Malware Config
Extracted
revengerat
Guest
darkking111.hopto.org:3131
darkking111.hopto.org:5353
102ef32.ddns.net:3131
102ef32.ddns.net:5353
1026ef32.ddns.net :3131
1026ef32.ddns.net :5353
RV_MUTEX
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
RevengeRat Executable 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1664-60-0x0000000000400000-0x000000000040A000-memory.dmp revengerat behavioral1/memory/1664-61-0x0000000000400000-0x000000000040A000-memory.dmp revengerat behavioral1/memory/1664-62-0x000000000040616E-mapping.dmp revengerat behavioral1/memory/1664-64-0x0000000000400000-0x000000000040A000-memory.dmp revengerat behavioral1/memory/1664-66-0x0000000000400000-0x000000000040A000-memory.dmp revengerat -
Executes dropped EXE 1 IoCs
Processes:
Windows Update.exepid process 1564 Windows Update.exe -
Loads dropped DLL 1 IoCs
Processes:
AppLaunch.exepid process 1664 AppLaunch.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
fd4f94d12269d74166408823e51fe1fbc64a776ade7554a27acaf07cae6483fa.exedescription pid process target process PID 1344 set thread context of 1664 1344 fd4f94d12269d74166408823e51fe1fbc64a776ade7554a27acaf07cae6483fa.exe AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 1664 AppLaunch.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
fd4f94d12269d74166408823e51fe1fbc64a776ade7554a27acaf07cae6483fa.exeAppLaunch.exedescription pid process target process PID 1344 wrote to memory of 1664 1344 fd4f94d12269d74166408823e51fe1fbc64a776ade7554a27acaf07cae6483fa.exe AppLaunch.exe PID 1344 wrote to memory of 1664 1344 fd4f94d12269d74166408823e51fe1fbc64a776ade7554a27acaf07cae6483fa.exe AppLaunch.exe PID 1344 wrote to memory of 1664 1344 fd4f94d12269d74166408823e51fe1fbc64a776ade7554a27acaf07cae6483fa.exe AppLaunch.exe PID 1344 wrote to memory of 1664 1344 fd4f94d12269d74166408823e51fe1fbc64a776ade7554a27acaf07cae6483fa.exe AppLaunch.exe PID 1344 wrote to memory of 1664 1344 fd4f94d12269d74166408823e51fe1fbc64a776ade7554a27acaf07cae6483fa.exe AppLaunch.exe PID 1344 wrote to memory of 1664 1344 fd4f94d12269d74166408823e51fe1fbc64a776ade7554a27acaf07cae6483fa.exe AppLaunch.exe PID 1344 wrote to memory of 1664 1344 fd4f94d12269d74166408823e51fe1fbc64a776ade7554a27acaf07cae6483fa.exe AppLaunch.exe PID 1344 wrote to memory of 1664 1344 fd4f94d12269d74166408823e51fe1fbc64a776ade7554a27acaf07cae6483fa.exe AppLaunch.exe PID 1344 wrote to memory of 1664 1344 fd4f94d12269d74166408823e51fe1fbc64a776ade7554a27acaf07cae6483fa.exe AppLaunch.exe PID 1344 wrote to memory of 1664 1344 fd4f94d12269d74166408823e51fe1fbc64a776ade7554a27acaf07cae6483fa.exe AppLaunch.exe PID 1344 wrote to memory of 1664 1344 fd4f94d12269d74166408823e51fe1fbc64a776ade7554a27acaf07cae6483fa.exe AppLaunch.exe PID 1664 wrote to memory of 1564 1664 AppLaunch.exe Windows Update.exe PID 1664 wrote to memory of 1564 1664 AppLaunch.exe Windows Update.exe PID 1664 wrote to memory of 1564 1664 AppLaunch.exe Windows Update.exe PID 1664 wrote to memory of 1564 1664 AppLaunch.exe Windows Update.exe PID 1664 wrote to memory of 1564 1664 AppLaunch.exe Windows Update.exe PID 1664 wrote to memory of 1564 1664 AppLaunch.exe Windows Update.exe PID 1664 wrote to memory of 1564 1664 AppLaunch.exe Windows Update.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd4f94d12269d74166408823e51fe1fbc64a776ade7554a27acaf07cae6483fa.exe"C:\Users\Admin\AppData\Local\Temp\fd4f94d12269d74166408823e51fe1fbc64a776ade7554a27acaf07cae6483fa.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windows Update.exe"C:\Users\Admin\AppData\Roaming\Windows Update.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
96KB
MD57825cad99621dd288da81d8d8ae13cf5
SHA1f3e1ab0c8e4f22e718cdeb6fa5faa87b0e61e73c
SHA256529088553fe9cb3e497ef704ce9bc7bc07630f6ddfad44afb92acfe639789ec5
SHA5122e81251a2c140a96f681fa95d82eee531b391e2654daa90da08d1dd00f13cba949136d465a2dc37507d40b4a708b6fc695baa716f19737591b1a89bd2a4b60b4
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
96KB
MD57825cad99621dd288da81d8d8ae13cf5
SHA1f3e1ab0c8e4f22e718cdeb6fa5faa87b0e61e73c
SHA256529088553fe9cb3e497ef704ce9bc7bc07630f6ddfad44afb92acfe639789ec5
SHA5122e81251a2c140a96f681fa95d82eee531b391e2654daa90da08d1dd00f13cba949136d465a2dc37507d40b4a708b6fc695baa716f19737591b1a89bd2a4b60b4
-
memory/1344-54-0x0000000001050000-0x000000000106C000-memory.dmpFilesize
112KB
-
memory/1344-55-0x0000000076171000-0x0000000076173000-memory.dmpFilesize
8KB
-
memory/1344-56-0x0000000000370000-0x0000000000384000-memory.dmpFilesize
80KB
-
memory/1564-69-0x0000000000000000-mapping.dmp
-
memory/1664-61-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1664-62-0x000000000040616E-mapping.dmp
-
memory/1664-64-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1664-66-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1664-60-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1664-58-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1664-57-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB