Analysis
-
max time kernel
147s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
15-05-2022 21:21
Static task
static1
Behavioral task
behavioral1
Sample
5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe
Resource
win10v2004-20220414-en
General
-
Target
5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe
-
Size
943KB
-
MD5
0c2f6990335ab2e2593fa2426b41bdb9
-
SHA1
96c6a1d912373cd9d493619f19363da0c3efb792
-
SHA256
5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997
-
SHA512
8e8914384d009cc5f7dccae38d57877f9152227839b0ccd2e2a70b02848fbda744704b4978976f91c30ca336fe9793c75fd56a2b09a883d531b48fc88db87b43
Malware Config
Extracted
revengerat
Guest
ournewcompany2.hopto.org:333
RV_MUTEX
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
RevengeRat Executable 9 IoCs
Processes:
resource yara_rule behavioral1/memory/940-63-0x0000000000400000-0x0000000000408000-memory.dmp revengerat behavioral1/memory/940-64-0x0000000000400000-0x0000000000408000-memory.dmp revengerat behavioral1/memory/940-65-0x0000000000405DCE-mapping.dmp revengerat behavioral1/memory/940-68-0x0000000000400000-0x0000000000408000-memory.dmp revengerat behavioral1/memory/940-72-0x0000000000400000-0x0000000000408000-memory.dmp revengerat behavioral1/memory/1020-85-0x0000000000405DCE-mapping.dmp revengerat behavioral1/memory/2036-75-0x0000000000405DCE-mapping.dmp revengerat behavioral1/memory/432-95-0x0000000000405DCE-mapping.dmp revengerat behavioral1/memory/1332-105-0x0000000000405DCE-mapping.dmp revengerat -
Drops startup file 2 IoCs
Processes:
WScript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe WScript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe WScript.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exedescription pid process target process PID 1580 set thread context of 2020 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 set thread context of 940 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 set thread context of 2036 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 set thread context of 1020 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 set thread context of 432 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 set thread context of 1332 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 940 RegAsm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exedescription pid process target process PID 1580 wrote to memory of 112 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe WScript.exe PID 1580 wrote to memory of 112 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe WScript.exe PID 1580 wrote to memory of 112 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe WScript.exe PID 1580 wrote to memory of 112 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe WScript.exe PID 1580 wrote to memory of 2020 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 2020 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 2020 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 2020 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 2020 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 2020 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 2020 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 2020 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 940 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 940 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 940 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 940 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 940 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 940 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 940 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 940 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 940 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 940 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 940 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 2036 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 2036 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 2036 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 2036 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 2036 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 2036 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 2036 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 2036 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 2036 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 2036 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 2036 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 1020 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 1020 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 1020 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 1020 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 1020 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 1020 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 1020 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 1020 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 1020 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 1020 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 1020 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 432 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 432 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 432 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 432 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 432 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 432 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 432 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 432 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 432 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 432 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 432 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 1332 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 1332 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 1332 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 1332 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 1332 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 1332 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 1332 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe PID 1580 wrote to memory of 1332 1580 5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe"C:\Users\Admin\AppData\Local\Temp\5b5255c6f73275be042f41567681153584385c36eb98ab0dfc9b4aac9c3ee997.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\1.vbs"2⤵
- Drops startup file
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\1.vbsFilesize
355B
MD5a031215df07e202bd306c7c4909417f7
SHA196e850d134498f448caf6597279c97ddefab7d3b
SHA25607121a00ad5494ac1d1efccc33c03555e47d58a54dc27257984657665c23fa9c
SHA5125c76dfbfcd302831da5855f0d984d27f868a39af457a626a2c47449fd1a74a90a7dc45c151831ae42834c45484ec4d1ee1c778dcd5e6b66085d33868165cff36
-
memory/112-55-0x0000000000000000-mapping.dmp
-
memory/432-95-0x0000000000405DCE-mapping.dmp
-
memory/432-115-0x00000000743D0000-0x000000007497B000-memory.dmpFilesize
5.7MB
-
memory/940-65-0x0000000000405DCE-mapping.dmp
-
memory/940-60-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/940-63-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/940-64-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/940-117-0x00000000743D0000-0x000000007497B000-memory.dmpFilesize
5.7MB
-
memory/940-68-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/940-72-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/940-61-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/1020-85-0x0000000000405DCE-mapping.dmp
-
memory/1332-105-0x0000000000405DCE-mapping.dmp
-
memory/1332-116-0x00000000743D0000-0x000000007497B000-memory.dmpFilesize
5.7MB
-
memory/1580-54-0x0000000076811000-0x0000000076813000-memory.dmpFilesize
8KB
-
memory/2020-59-0x0000000000405DCE-mapping.dmp
-
memory/2036-75-0x0000000000405DCE-mapping.dmp
-
memory/2036-118-0x00000000743D0000-0x000000007497B000-memory.dmpFilesize
5.7MB