Analysis
-
max time kernel
146s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-06-2022 22:05
Static task
static1
Behavioral task
behavioral1
Sample
12393bd27c682e6a736c901597f8afc107f910bcfc42bf914f30eaebd2115366.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
12393bd27c682e6a736c901597f8afc107f910bcfc42bf914f30eaebd2115366.exe
Resource
win10v2004-20220414-en
General
-
Target
12393bd27c682e6a736c901597f8afc107f910bcfc42bf914f30eaebd2115366.exe
-
Size
17KB
-
MD5
10f6bf1292118e02826d6711c997fa6a
-
SHA1
b8b1d2a5cf5f78a0e58cd20885da1393bf4d7ac7
-
SHA256
12393bd27c682e6a736c901597f8afc107f910bcfc42bf914f30eaebd2115366
-
SHA512
4932ecfe720a7c767049a34ef836f22b24814e18ed8deae85829a6f5421ceae9bd4b9b59c5da1d83caf7b6ada5dbce76e25c56d3090e5380a3d458a11517aaff
Malware Config
Extracted
revengerat
Exploit
fbi.no-ip.net:1717
fbi962.ddns.net:1717
RV_MUTEX
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
RevengeRat Executable 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\system32.exe revengerat C:\Users\Admin\AppData\Roaming\system32.exe revengerat -
Executes dropped EXE 1 IoCs
Processes:
system32.exepid process 1744 system32.exe -
Drops startup file 2 IoCs
Processes:
system32.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dllhost.exe system32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dllhost.exe system32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
system32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client = "C:\\Users\\Admin\\AppData\\Roaming\\system32.exe" system32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
12393bd27c682e6a736c901597f8afc107f910bcfc42bf914f30eaebd2115366.exesystem32.exedescription pid process Token: SeDebugPrivilege 784 12393bd27c682e6a736c901597f8afc107f910bcfc42bf914f30eaebd2115366.exe Token: SeDebugPrivilege 1744 system32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
12393bd27c682e6a736c901597f8afc107f910bcfc42bf914f30eaebd2115366.exedescription pid process target process PID 784 wrote to memory of 1744 784 12393bd27c682e6a736c901597f8afc107f910bcfc42bf914f30eaebd2115366.exe system32.exe PID 784 wrote to memory of 1744 784 12393bd27c682e6a736c901597f8afc107f910bcfc42bf914f30eaebd2115366.exe system32.exe PID 784 wrote to memory of 1744 784 12393bd27c682e6a736c901597f8afc107f910bcfc42bf914f30eaebd2115366.exe system32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\12393bd27c682e6a736c901597f8afc107f910bcfc42bf914f30eaebd2115366.exe"C:\Users\Admin\AppData\Local\Temp\12393bd27c682e6a736c901597f8afc107f910bcfc42bf914f30eaebd2115366.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\system32.exe"C:\Users\Admin\AppData\Roaming\system32.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\system32.exeFilesize
17KB
MD510f6bf1292118e02826d6711c997fa6a
SHA1b8b1d2a5cf5f78a0e58cd20885da1393bf4d7ac7
SHA25612393bd27c682e6a736c901597f8afc107f910bcfc42bf914f30eaebd2115366
SHA5124932ecfe720a7c767049a34ef836f22b24814e18ed8deae85829a6f5421ceae9bd4b9b59c5da1d83caf7b6ada5dbce76e25c56d3090e5380a3d458a11517aaff
-
C:\Users\Admin\AppData\Roaming\system32.exeFilesize
17KB
MD510f6bf1292118e02826d6711c997fa6a
SHA1b8b1d2a5cf5f78a0e58cd20885da1393bf4d7ac7
SHA25612393bd27c682e6a736c901597f8afc107f910bcfc42bf914f30eaebd2115366
SHA5124932ecfe720a7c767049a34ef836f22b24814e18ed8deae85829a6f5421ceae9bd4b9b59c5da1d83caf7b6ada5dbce76e25c56d3090e5380a3d458a11517aaff
-
memory/784-61-0x000007FEF50D0000-0x000007FEF5FAC000-memory.dmpFilesize
14.9MB
-
memory/784-60-0x000007FEF3BA0000-0x000007FEF4245000-memory.dmpFilesize
6.6MB
-
memory/784-71-0x000007FEF50D0000-0x000007FEF5FAC000-memory.dmpFilesize
14.9MB
-
memory/784-59-0x000007FEF69B0000-0x000007FEF6AF3000-memory.dmpFilesize
1.3MB
-
memory/784-74-0x000007FEF4250000-0x000007FEF445D000-memory.dmpFilesize
2.1MB
-
memory/784-54-0x000007FEF46A0000-0x000007FEF50C3000-memory.dmpFilesize
10.1MB
-
memory/784-62-0x000007FEF46A0000-0x000007FEF50C3000-memory.dmpFilesize
10.1MB
-
memory/784-63-0x000007FEF4460000-0x000007FEF4697000-memory.dmpFilesize
2.2MB
-
memory/784-64-0x000007FEF28B0000-0x000007FEF3946000-memory.dmpFilesize
16.6MB
-
memory/784-65-0x000007FEF4250000-0x000007FEF445D000-memory.dmpFilesize
2.1MB
-
memory/784-66-0x000007FEFC061000-0x000007FEFC063000-memory.dmpFilesize
8KB
-
memory/784-73-0x000007FEF46A0000-0x000007FEF50C3000-memory.dmpFilesize
10.1MB
-
memory/784-57-0x000007FEF4460000-0x000007FEF4697000-memory.dmpFilesize
2.2MB
-
memory/784-56-0x000007FEF50D0000-0x000007FEF5FAC000-memory.dmpFilesize
14.9MB
-
memory/784-58-0x000007FEF4250000-0x000007FEF445D000-memory.dmpFilesize
2.1MB
-
memory/784-55-0x000007FEF28B0000-0x000007FEF3946000-memory.dmpFilesize
16.6MB
-
memory/1744-77-0x000007FEF3BA0000-0x000007FEF4245000-memory.dmpFilesize
6.6MB
-
memory/1744-72-0x000007FEF28B0000-0x000007FEF3946000-memory.dmpFilesize
16.6MB
-
memory/1744-70-0x000007FEF46A0000-0x000007FEF50C3000-memory.dmpFilesize
10.1MB
-
memory/1744-75-0x000007FEF50D0000-0x000007FEF5FAC000-memory.dmpFilesize
14.9MB
-
memory/1744-76-0x000007FEF4250000-0x000007FEF445D000-memory.dmpFilesize
2.1MB
-
memory/1744-67-0x0000000000000000-mapping.dmp
-
memory/1744-78-0x000007FEF46A0000-0x000007FEF50C3000-memory.dmpFilesize
10.1MB
-
memory/1744-81-0x000007FEF69B0000-0x000007FEF6AF3000-memory.dmpFilesize
1.3MB
-
memory/1744-80-0x000007FEF28B0000-0x000007FEF3946000-memory.dmpFilesize
16.6MB
-
memory/1744-79-0x000007FEF4460000-0x000007FEF4697000-memory.dmpFilesize
2.2MB
-
memory/1744-82-0x000007FEF50D0000-0x000007FEF5FAC000-memory.dmpFilesize
14.9MB
-
memory/1744-83-0x000007FEF4250000-0x000007FEF445D000-memory.dmpFilesize
2.1MB
-
memory/1744-84-0x000007FEF46A0000-0x000007FEF50C3000-memory.dmpFilesize
10.1MB