Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
16-05-2022 01:51
Static task
static1
Behavioral task
behavioral1
Sample
265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe
Resource
win10v2004-20220414-en
General
-
Target
265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe
-
Size
344KB
-
MD5
1e51fa7730804312f96790c9c93d506c
-
SHA1
5e4f7fd8a9b2308bfc46b303b12108c1f5532d8d
-
SHA256
265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b
-
SHA512
61853d112a7158392a023596fa2a6575f2bade49ea42a52a6133d520400ea52c0a3d812ae564a3b379cb49e8935491da62d0bfc545677322287e12e18b27345a
Malware Config
Extracted
revengerat
Guest
fastbtc.dynu.net:1604
RV_MUTEX-LB4S0YIGA6UFWH10GXQLHP
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System.ServiceModel = "C:\\Users\\Admin\\AppData\\Local\\Temp\\265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe" 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exedescription pid process target process PID 4392 set thread context of 1292 4392 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exepid process 4392 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe 4392 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exedescription pid process Token: SeDebugPrivilege 4392 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exedescription pid process target process PID 4392 wrote to memory of 3944 4392 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe PID 4392 wrote to memory of 3944 4392 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe PID 4392 wrote to memory of 3944 4392 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe PID 4392 wrote to memory of 1292 4392 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe PID 4392 wrote to memory of 1292 4392 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe PID 4392 wrote to memory of 1292 4392 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe PID 4392 wrote to memory of 1292 4392 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe PID 4392 wrote to memory of 1292 4392 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe PID 4392 wrote to memory of 1292 4392 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe PID 4392 wrote to memory of 1292 4392 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe PID 4392 wrote to memory of 1292 4392 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe 265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe"C:\Users\Admin\AppData\Local\Temp\265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe"C:\Users\Admin\AppData\Local\Temp\265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe"C:\Users\Admin\AppData\Local\Temp\265b84e3773655319c45d5fe2e4e84035781d42a6b324c37f703dfc809e9f07b.exe"2⤵
- Adds Run key to start application
- Checks processor information in registry
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1292-137-0x0000000000000000-mapping.dmp
-
memory/1292-138-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1292-139-0x0000000005270000-0x000000000530C000-memory.dmpFilesize
624KB
-
memory/1292-140-0x0000000005320000-0x0000000005386000-memory.dmpFilesize
408KB
-
memory/3944-136-0x0000000000000000-mapping.dmp
-
memory/4392-130-0x00000000006D0000-0x000000000072C000-memory.dmpFilesize
368KB
-
memory/4392-131-0x00000000056F0000-0x0000000005C94000-memory.dmpFilesize
5.6MB
-
memory/4392-132-0x00000000051E0000-0x0000000005272000-memory.dmpFilesize
584KB
-
memory/4392-133-0x0000000005140000-0x000000000514A000-memory.dmpFilesize
40KB
-
memory/4392-134-0x00000000053F0000-0x0000000005466000-memory.dmpFilesize
472KB
-
memory/4392-135-0x0000000005DF0000-0x0000000005E0E000-memory.dmpFilesize
120KB