Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
16-05-2022 01:51
Static task
static1
Behavioral task
behavioral1
Sample
265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe
Resource
win10v2004-20220414-en
General
-
Target
265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe
-
Size
344KB
-
MD5
1e51fa7730804312f96790c9c93d506c
-
SHA1
5e4f7fd8a9b2308bfc46b303b12108c1f5532d8d
-
SHA256
265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b
-
SHA512
61853d112a7158392a023596fa2a6575f2bade49ea42a52a6133d520400ea52c0a3d812ae564a3b379cb49e8935491da62d0bfc545677322287e12e18b27345a
Malware Config
Extracted
revengerat
Guest
fastbtc.dynu.net:1604
RV_MUTEX-LB4S0YIGA6UFWH10GXQLHP
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\System.ServiceModel = "C:\\Users\\Admin\\AppData\\Local\\Temp\\265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe" 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exedescription pid process target process PID 976 set thread context of 1560 976 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CENTRALPROCESSOR\0\ProcessorNameString 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exepid process 976 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exedescription pid process Token: SeDebugPrivilege 976 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exedescription pid process target process PID 976 wrote to memory of 1564 976 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe PID 976 wrote to memory of 1564 976 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe PID 976 wrote to memory of 1564 976 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe PID 976 wrote to memory of 1564 976 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe PID 976 wrote to memory of 1560 976 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe PID 976 wrote to memory of 1560 976 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe PID 976 wrote to memory of 1560 976 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe PID 976 wrote to memory of 1560 976 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe PID 976 wrote to memory of 1560 976 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe PID 976 wrote to memory of 1560 976 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe PID 976 wrote to memory of 1560 976 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe PID 976 wrote to memory of 1560 976 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe PID 976 wrote to memory of 1560 976 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe"C:\Users\Admin\AppData\Local\Temp\265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe"C:\Users\Admin\AppData\Local\Temp\265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe"C:\Users\Admin\AppData\Local\Temp\265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe"2⤵
- Adds Run key to start application
- Checks processor information in registry
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/976-54-0x0000000000380000-0x00000000003DC000-memory.dmpFilesize
368KB
-
memory/976-55-0x00000000752D1000-0x00000000752D3000-memory.dmpFilesize
8KB
-
memory/976-56-0x0000000000360000-0x0000000000376000-memory.dmpFilesize
88KB
-
memory/976-57-0x0000000000480000-0x0000000000498000-memory.dmpFilesize
96KB
-
memory/1560-59-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1560-61-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1560-58-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1560-63-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1560-64-0x000000000040693E-mapping.dmp
-
memory/1560-66-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1560-68-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB