Analysis
-
max time kernel
132s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 01:50
Static task
static1
Behavioral task
behavioral1
Sample
3f5d94ceb5367b224386438511aa78c245d977846a71fcd8ffa6c6470d1b3fe7.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3f5d94ceb5367b224386438511aa78c245d977846a71fcd8ffa6c6470d1b3fe7.exe
Resource
win10v2004-20220414-en
General
-
Target
3f5d94ceb5367b224386438511aa78c245d977846a71fcd8ffa6c6470d1b3fe7.exe
-
Size
17KB
-
MD5
1098d8e6429779b56a6b6a542cd3bc11
-
SHA1
73f6b9c7b6cf16d2abdf3a6ec06b0ac2aeb62af5
-
SHA256
3f5d94ceb5367b224386438511aa78c245d977846a71fcd8ffa6c6470d1b3fe7
-
SHA512
825a655df4440f3f4a072fe0ff4ab5d237cae5f3485d3bd51ce8053bf336aa4286f0e16d796e83c40c99d236cbe08c54b6914e34a5b307968d3d3fb88aa977a0
Malware Config
Extracted
revengerat
The New
wowhu.zapto.org:5550
wowhu.zapto.org:5551
wowhu.zapto.org:5552
wowhu.zapto.org:5553
wowhu.zapto.org:5554
wowhu.zapto.org:5555
haxballfc.ddns.net:5550
haxballfc.ddns.net:5551
haxballfc.ddns.net:5552
haxballfc.ddns.net:5553
haxballfc.ddns.net:5554
haxballfc.ddns.net:5555
linkshosts.ddns.net:5550
linkshosts.ddns.net:5551
linkshosts.ddns.net:5552
linkshosts.ddns.net:5553
linkshosts.ddns.net:5554
linkshosts.ddns.net:5555
gaminghost.ddns.net:5550
gaminghost.ddns.net:5551
gaminghost.ddns.net:5552
gaminghost.ddns.net:5553
gaminghost.ddns.net:5554
gaminghost.ddns.net:5555
worldsez.publicvm.com:5550
worldsez.publicvm.com:5551
worldsez.publicvm.com:5552
worldsez.publicvm.com:5553
worldsez.publicvm.com:5554
worldsez.publicvm.com:5555
lighttech.publicvm.com:5550
lighttech.publicvm.com:5551
lighttech.publicvm.com:5552
lighttech.publicvm.com:5553
lighttech.publicvm.com:5554
lighttech.publicvm.com:5555
RV_MUTEX-IPcYBGldGoFYE
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
RevengeRat Executable 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe revengerat C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe revengerat -
Executes dropped EXE 1 IoCs
Processes:
winhost.exepid process 1988 winhost.exe -
Drops startup file 3 IoCs
Processes:
3f5d94ceb5367b224386438511aa78c245d977846a71fcd8ffa6c6470d1b3fe7.exewinhost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe 3f5d94ceb5367b224386438511aa78c245d977846a71fcd8ffa6c6470d1b3fe7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe 3f5d94ceb5367b224386438511aa78c245d977846a71fcd8ffa6c6470d1b3fe7.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe winhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
3f5d94ceb5367b224386438511aa78c245d977846a71fcd8ffa6c6470d1b3fe7.exewinhost.exedescription pid process Token: SeDebugPrivilege 748 3f5d94ceb5367b224386438511aa78c245d977846a71fcd8ffa6c6470d1b3fe7.exe Token: SeDebugPrivilege 1988 winhost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
3f5d94ceb5367b224386438511aa78c245d977846a71fcd8ffa6c6470d1b3fe7.exedescription pid process target process PID 748 wrote to memory of 1988 748 3f5d94ceb5367b224386438511aa78c245d977846a71fcd8ffa6c6470d1b3fe7.exe winhost.exe PID 748 wrote to memory of 1988 748 3f5d94ceb5367b224386438511aa78c245d977846a71fcd8ffa6c6470d1b3fe7.exe winhost.exe PID 748 wrote to memory of 1988 748 3f5d94ceb5367b224386438511aa78c245d977846a71fcd8ffa6c6470d1b3fe7.exe winhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f5d94ceb5367b224386438511aa78c245d977846a71fcd8ffa6c6470d1b3fe7.exe"C:\Users\Admin\AppData\Local\Temp\3f5d94ceb5367b224386438511aa78c245d977846a71fcd8ffa6c6470d1b3fe7.exe"1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exeFilesize
17KB
MD51098d8e6429779b56a6b6a542cd3bc11
SHA173f6b9c7b6cf16d2abdf3a6ec06b0ac2aeb62af5
SHA2563f5d94ceb5367b224386438511aa78c245d977846a71fcd8ffa6c6470d1b3fe7
SHA512825a655df4440f3f4a072fe0ff4ab5d237cae5f3485d3bd51ce8053bf336aa4286f0e16d796e83c40c99d236cbe08c54b6914e34a5b307968d3d3fb88aa977a0
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exeFilesize
17KB
MD51098d8e6429779b56a6b6a542cd3bc11
SHA173f6b9c7b6cf16d2abdf3a6ec06b0ac2aeb62af5
SHA2563f5d94ceb5367b224386438511aa78c245d977846a71fcd8ffa6c6470d1b3fe7
SHA512825a655df4440f3f4a072fe0ff4ab5d237cae5f3485d3bd51ce8053bf336aa4286f0e16d796e83c40c99d236cbe08c54b6914e34a5b307968d3d3fb88aa977a0
-
memory/748-54-0x000007FEF4380000-0x000007FEF4DA3000-memory.dmpFilesize
10.1MB
-
memory/748-55-0x000007FEEEAC0000-0x000007FEEFB56000-memory.dmpFilesize
16.6MB
-
memory/748-56-0x000007FEFBE51000-0x000007FEFBE53000-memory.dmpFilesize
8KB
-
memory/1988-57-0x0000000000000000-mapping.dmp
-
memory/1988-60-0x000007FEF5260000-0x000007FEF5C83000-memory.dmpFilesize
10.1MB
-
memory/1988-61-0x000007FEEDA20000-0x000007FEEEAB6000-memory.dmpFilesize
16.6MB