Analysis
-
max time kernel
151s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
08-06-2022 21:30
Static task
static1
Behavioral task
behavioral1
Sample
1747656c6de8c6ad0819941a11b24044ca615d4e257932ff89b81c6696e5accf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
1747656c6de8c6ad0819941a11b24044ca615d4e257932ff89b81c6696e5accf.exe
Resource
win10v2004-20220414-en
General
-
Target
1747656c6de8c6ad0819941a11b24044ca615d4e257932ff89b81c6696e5accf.exe
-
Size
690KB
-
MD5
f8a9b6639c3ee67e13a118667e75a00f
-
SHA1
d77863e6afad3291eccdcd8ed0fbfd6a543931d5
-
SHA256
1747656c6de8c6ad0819941a11b24044ca615d4e257932ff89b81c6696e5accf
-
SHA512
0083e3cff8d7cbd5cab7b5ebcd738f6293be7c37fedc2e9747e942d2893e59935225801602f04458d3b47fda0397fa90fcddc49d3c9a62b97c9dd07d5eae86c8
Malware Config
Extracted
revengerat
noipnoip
redlan1.hopto.org:3344
RV_MUTEX-dawrHJfWfhaRCl
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
RevengeRat Executable 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1920-58-0x0000000000090000-0x0000000000098000-memory.dmp revengerat behavioral1/memory/1920-62-0x0000000000095E5E-mapping.dmp revengerat behavioral1/memory/1920-63-0x0000000000090000-0x0000000000098000-memory.dmp revengerat behavioral1/memory/1920-64-0x0000000000090000-0x0000000000098000-memory.dmp revengerat -
Processes:
resource yara_rule behavioral1/memory/1080-55-0x0000000000EF0000-0x0000000001075000-memory.dmp upx behavioral1/memory/1080-66-0x0000000000EF0000-0x0000000001075000-memory.dmp upx -
Drops startup file 1 IoCs
Processes:
1747656c6de8c6ad0819941a11b24044ca615d4e257932ff89b81c6696e5accf.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AppVTerminator.url 1747656c6de8c6ad0819941a11b24044ca615d4e257932ff89b81c6696e5accf.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/1080-55-0x0000000000EF0000-0x0000000001075000-memory.dmp autoit_exe behavioral1/memory/1080-66-0x0000000000EF0000-0x0000000001075000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1747656c6de8c6ad0819941a11b24044ca615d4e257932ff89b81c6696e5accf.exedescription pid process target process PID 1080 set thread context of 1920 1080 1747656c6de8c6ad0819941a11b24044ca615d4e257932ff89b81c6696e5accf.exe RegAsm.exe -
Drops file in Windows directory 1 IoCs
Processes:
RegAsm.exedescription ioc process File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
1747656c6de8c6ad0819941a11b24044ca615d4e257932ff89b81c6696e5accf.exepid process 1080 1747656c6de8c6ad0819941a11b24044ca615d4e257932ff89b81c6696e5accf.exe 1080 1747656c6de8c6ad0819941a11b24044ca615d4e257932ff89b81c6696e5accf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 1920 RegAsm.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
1747656c6de8c6ad0819941a11b24044ca615d4e257932ff89b81c6696e5accf.exepid process 1080 1747656c6de8c6ad0819941a11b24044ca615d4e257932ff89b81c6696e5accf.exe 1080 1747656c6de8c6ad0819941a11b24044ca615d4e257932ff89b81c6696e5accf.exe 1080 1747656c6de8c6ad0819941a11b24044ca615d4e257932ff89b81c6696e5accf.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
1747656c6de8c6ad0819941a11b24044ca615d4e257932ff89b81c6696e5accf.exepid process 1080 1747656c6de8c6ad0819941a11b24044ca615d4e257932ff89b81c6696e5accf.exe 1080 1747656c6de8c6ad0819941a11b24044ca615d4e257932ff89b81c6696e5accf.exe 1080 1747656c6de8c6ad0819941a11b24044ca615d4e257932ff89b81c6696e5accf.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
1747656c6de8c6ad0819941a11b24044ca615d4e257932ff89b81c6696e5accf.exedescription pid process target process PID 1080 wrote to memory of 1920 1080 1747656c6de8c6ad0819941a11b24044ca615d4e257932ff89b81c6696e5accf.exe RegAsm.exe PID 1080 wrote to memory of 1920 1080 1747656c6de8c6ad0819941a11b24044ca615d4e257932ff89b81c6696e5accf.exe RegAsm.exe PID 1080 wrote to memory of 1920 1080 1747656c6de8c6ad0819941a11b24044ca615d4e257932ff89b81c6696e5accf.exe RegAsm.exe PID 1080 wrote to memory of 1920 1080 1747656c6de8c6ad0819941a11b24044ca615d4e257932ff89b81c6696e5accf.exe RegAsm.exe PID 1080 wrote to memory of 1920 1080 1747656c6de8c6ad0819941a11b24044ca615d4e257932ff89b81c6696e5accf.exe RegAsm.exe PID 1080 wrote to memory of 1920 1080 1747656c6de8c6ad0819941a11b24044ca615d4e257932ff89b81c6696e5accf.exe RegAsm.exe PID 1080 wrote to memory of 1920 1080 1747656c6de8c6ad0819941a11b24044ca615d4e257932ff89b81c6696e5accf.exe RegAsm.exe PID 1080 wrote to memory of 1920 1080 1747656c6de8c6ad0819941a11b24044ca615d4e257932ff89b81c6696e5accf.exe RegAsm.exe PID 1080 wrote to memory of 1920 1080 1747656c6de8c6ad0819941a11b24044ca615d4e257932ff89b81c6696e5accf.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1747656c6de8c6ad0819941a11b24044ca615d4e257932ff89b81c6696e5accf.exe"C:\Users\Admin\AppData\Local\Temp\1747656c6de8c6ad0819941a11b24044ca615d4e257932ff89b81c6696e5accf.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1080-54-0x00000000752D1000-0x00000000752D3000-memory.dmpFilesize
8KB
-
memory/1080-55-0x0000000000EF0000-0x0000000001075000-memory.dmpFilesize
1.5MB
-
memory/1080-66-0x0000000000EF0000-0x0000000001075000-memory.dmpFilesize
1.5MB
-
memory/1920-56-0x0000000000090000-0x0000000000098000-memory.dmpFilesize
32KB
-
memory/1920-58-0x0000000000090000-0x0000000000098000-memory.dmpFilesize
32KB
-
memory/1920-62-0x0000000000095E5E-mapping.dmp
-
memory/1920-63-0x0000000000090000-0x0000000000098000-memory.dmpFilesize
32KB
-
memory/1920-64-0x0000000000090000-0x0000000000098000-memory.dmpFilesize
32KB
-
memory/1920-67-0x0000000074180000-0x000000007472B000-memory.dmpFilesize
5.7MB
-
memory/1920-68-0x0000000074180000-0x000000007472B000-memory.dmpFilesize
5.7MB