Analysis
-
max time kernel
148s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
15-05-2022 21:44
Static task
static1
Behavioral task
behavioral1
Sample
749fb97b6beff8b404936b5b366ae19ad4611d28162538a8230c22a180ec1797.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
749fb97b6beff8b404936b5b366ae19ad4611d28162538a8230c22a180ec1797.exe
Resource
win10v2004-20220414-en
General
-
Target
749fb97b6beff8b404936b5b366ae19ad4611d28162538a8230c22a180ec1797.exe
-
Size
238KB
-
MD5
fe7f65712ce141ff666b5013f137dbd6
-
SHA1
02dcab6bebd422ff779587780a5b56dfa58c404d
-
SHA256
749fb97b6beff8b404936b5b366ae19ad4611d28162538a8230c22a180ec1797
-
SHA512
cc611b7d164718403828e1cff35c8256f9d9abe0d3978d65719bf024e9634d31e462cd38744972ffe2c004ca86414019a5da35fe2117b56b5beca0d1497c2f47
Malware Config
Extracted
revengerat
Guest
lapoire2.hopto.org:333
RV_MUTEX-DxjEexVoqqNL
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
RevengeRat Executable 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1156-60-0x0000000000400000-0x0000000000408000-memory.dmp revengerat -
Drops startup file 2 IoCs
Processes:
749fb97b6beff8b404936b5b366ae19ad4611d28162538a8230c22a180ec1797.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7bPAfP3n.url 749fb97b6beff8b404936b5b366ae19ad4611d28162538a8230c22a180ec1797.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7bPAfP3n.url 749fb97b6beff8b404936b5b366ae19ad4611d28162538a8230c22a180ec1797.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
749fb97b6beff8b404936b5b366ae19ad4611d28162538a8230c22a180ec1797.exedescription pid process target process PID 1964 set thread context of 1156 1964 749fb97b6beff8b404936b5b366ae19ad4611d28162538a8230c22a180ec1797.exe 749fb97b6beff8b404936b5b366ae19ad4611d28162538a8230c22a180ec1797.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
749fb97b6beff8b404936b5b366ae19ad4611d28162538a8230c22a180ec1797.exepid process 1964 749fb97b6beff8b404936b5b366ae19ad4611d28162538a8230c22a180ec1797.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
749fb97b6beff8b404936b5b366ae19ad4611d28162538a8230c22a180ec1797.exedescription pid process Token: SeDebugPrivilege 1156 749fb97b6beff8b404936b5b366ae19ad4611d28162538a8230c22a180ec1797.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
749fb97b6beff8b404936b5b366ae19ad4611d28162538a8230c22a180ec1797.exedescription pid process target process PID 1964 wrote to memory of 1156 1964 749fb97b6beff8b404936b5b366ae19ad4611d28162538a8230c22a180ec1797.exe 749fb97b6beff8b404936b5b366ae19ad4611d28162538a8230c22a180ec1797.exe PID 1964 wrote to memory of 1156 1964 749fb97b6beff8b404936b5b366ae19ad4611d28162538a8230c22a180ec1797.exe 749fb97b6beff8b404936b5b366ae19ad4611d28162538a8230c22a180ec1797.exe PID 1964 wrote to memory of 1156 1964 749fb97b6beff8b404936b5b366ae19ad4611d28162538a8230c22a180ec1797.exe 749fb97b6beff8b404936b5b366ae19ad4611d28162538a8230c22a180ec1797.exe PID 1964 wrote to memory of 1156 1964 749fb97b6beff8b404936b5b366ae19ad4611d28162538a8230c22a180ec1797.exe 749fb97b6beff8b404936b5b366ae19ad4611d28162538a8230c22a180ec1797.exe PID 1964 wrote to memory of 1156 1964 749fb97b6beff8b404936b5b366ae19ad4611d28162538a8230c22a180ec1797.exe 749fb97b6beff8b404936b5b366ae19ad4611d28162538a8230c22a180ec1797.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\749fb97b6beff8b404936b5b366ae19ad4611d28162538a8230c22a180ec1797.exe"C:\Users\Admin\AppData\Local\Temp\749fb97b6beff8b404936b5b366ae19ad4611d28162538a8230c22a180ec1797.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\749fb97b6beff8b404936b5b366ae19ad4611d28162538a8230c22a180ec1797.exe"C:\Users\Admin\AppData\Local\Temp\749fb97b6beff8b404936b5b366ae19ad4611d28162538a8230c22a180ec1797.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1156
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1156-58-0x0000000000405DDE-mapping.dmp
-
memory/1156-60-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/1964-54-0x0000000000E20000-0x0000000000E60000-memory.dmpFilesize
256KB
-
memory/1964-55-0x0000000075401000-0x0000000075403000-memory.dmpFilesize
8KB
-
memory/1964-56-0x0000000000510000-0x000000000052A000-memory.dmpFilesize
104KB
-
memory/1964-57-0x0000000000580000-0x0000000000590000-memory.dmpFilesize
64KB
-
memory/1964-59-0x00000000005A0000-0x00000000005A3000-memory.dmpFilesize
12KB