Analysis
-
max time kernel
135s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
25-05-2022 01:09
Static task
static1
Behavioral task
behavioral1
Sample
195a0e8c771f54b6db58ce7b15d93cac487dc09f5f023e688ce68ecdee3963c6.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
195a0e8c771f54b6db58ce7b15d93cac487dc09f5f023e688ce68ecdee3963c6.exe
Resource
win10v2004-20220414-en
General
-
Target
195a0e8c771f54b6db58ce7b15d93cac487dc09f5f023e688ce68ecdee3963c6.exe
-
Size
197KB
-
MD5
4918e4ebd962bf386617d25f47b960ae
-
SHA1
436488850b55c22a84a8ceb8d11704975e4e04eb
-
SHA256
195a0e8c771f54b6db58ce7b15d93cac487dc09f5f023e688ce68ecdee3963c6
-
SHA512
29e6ab7a370a9d6def6459b75a5a07382f22e9cbe4a7542e8eeec57da96c1f4813111aba9321140bde49ff37492abc2c605bcfafa31d858f8ba90dd96072911f
Malware Config
Extracted
revengerat
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
RevengeRat Executable 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1992-55-0x000000001B940000-0x000000001B948000-memory.dmp revengerat -
Downloads MZ/PE file
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
195a0e8c771f54b6db58ce7b15d93cac487dc09f5f023e688ce68ecdee3963c6.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 195a0e8c771f54b6db58ce7b15d93cac487dc09f5f023e688ce68ecdee3963c6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 195a0e8c771f54b6db58ce7b15d93cac487dc09f5f023e688ce68ecdee3963c6.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
195a0e8c771f54b6db58ce7b15d93cac487dc09f5f023e688ce68ecdee3963c6.exedescription pid process Token: SeDebugPrivilege 1992 195a0e8c771f54b6db58ce7b15d93cac487dc09f5f023e688ce68ecdee3963c6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\195a0e8c771f54b6db58ce7b15d93cac487dc09f5f023e688ce68ecdee3963c6.exe"C:\Users\Admin\AppData\Local\Temp\195a0e8c771f54b6db58ce7b15d93cac487dc09f5f023e688ce68ecdee3963c6.exe"1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken