Analysis
-
max time kernel
184s -
max time network
173s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
24-07-2022 21:28
Static task
static1
Behavioral task
behavioral1
Sample
3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe
Resource
win10v2004-20220721-en
General
-
Target
3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe
-
Size
172KB
-
MD5
4e85bff3f7fae195ba997de834e23c06
-
SHA1
3aff4c5071c186b91db043ccefbee615f48a1342
-
SHA256
3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8
-
SHA512
ac2460a55edc79b3eab9a5929275d97eb5bd9757af202359b40ef7282e442d047c3373f93f1b15ad4ee85f70cf377e2960df0394f8966d3c1e9ff1b751b659b8
Malware Config
Extracted
revengerat
Guest
199.195.250.222:666
RV_MUTEX-XawrHJfWfhaR
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
RevengeRat Executable 5 IoCs
Processes:
resource yara_rule behavioral1/memory/816-79-0x0000000000400000-0x000000000040A000-memory.dmp revengerat behavioral1/memory/816-80-0x0000000000400000-0x000000000040A000-memory.dmp revengerat behavioral1/memory/816-86-0x0000000000400000-0x000000000040A000-memory.dmp revengerat behavioral1/memory/816-84-0x0000000000400000-0x000000000040A000-memory.dmp revengerat behavioral1/memory/816-81-0x0000000000406ADE-mapping.dmp revengerat -
Executes dropped EXE 3 IoCs
Processes:
opera.exeopera.exeskype.exepid process 676 opera.exe 816 opera.exe 396 skype.exe -
Drops startup file 1 IoCs
Processes:
opera.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\opera.lnk opera.exe -
Loads dropped DLL 4 IoCs
Processes:
cmd.exeopera.exeopera.exepid process 1148 cmd.exe 676 opera.exe 676 opera.exe 816 opera.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
opera.exedescription pid process target process PID 676 set thread context of 816 676 opera.exe opera.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NTFS ADS 8 IoCs
Processes:
cmd.execmd.execmd.execmd.execmd.exeopera.execmd.execmd.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp\3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe:Zone.Identifier cmd.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe:Zone.Identifier cmd.exe File created C:\Users\Admin\AppData\Roaming\opera.exe\:Zone.Identifier:$DATA cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\opera.exe:Zone.Identifier cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\opera.exe:Zone.Identifier cmd.exe File created C:\Users\Admin\AppData\Roaming\skype.exe\:Zone.Identifier:$DATA opera.exe File opened for modification C:\Users\Admin\AppData\Roaming\skype.exe:Zone.Identifier cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\skype.exe:Zone.Identifier cmd.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exeopera.exeopera.exeskype.exedescription pid process Token: SeDebugPrivilege 1972 3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe Token: SeDebugPrivilege 676 opera.exe Token: SeDebugPrivilege 816 opera.exe Token: SeDebugPrivilege 396 skype.exe -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.execmd.exeopera.exeopera.exeskype.exedescription pid process target process PID 1972 wrote to memory of 1652 1972 3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe cmd.exe PID 1972 wrote to memory of 1652 1972 3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe cmd.exe PID 1972 wrote to memory of 1652 1972 3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe cmd.exe PID 1972 wrote to memory of 1652 1972 3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe cmd.exe PID 1972 wrote to memory of 1404 1972 3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe cmd.exe PID 1972 wrote to memory of 1404 1972 3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe cmd.exe PID 1972 wrote to memory of 1404 1972 3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe cmd.exe PID 1972 wrote to memory of 1404 1972 3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe cmd.exe PID 1972 wrote to memory of 896 1972 3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe cmd.exe PID 1972 wrote to memory of 896 1972 3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe cmd.exe PID 1972 wrote to memory of 896 1972 3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe cmd.exe PID 1972 wrote to memory of 896 1972 3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe cmd.exe PID 1972 wrote to memory of 1148 1972 3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe cmd.exe PID 1972 wrote to memory of 1148 1972 3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe cmd.exe PID 1972 wrote to memory of 1148 1972 3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe cmd.exe PID 1972 wrote to memory of 1148 1972 3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe cmd.exe PID 1148 wrote to memory of 676 1148 cmd.exe opera.exe PID 1148 wrote to memory of 676 1148 cmd.exe opera.exe PID 1148 wrote to memory of 676 1148 cmd.exe opera.exe PID 1148 wrote to memory of 676 1148 cmd.exe opera.exe PID 676 wrote to memory of 1840 676 opera.exe cmd.exe PID 676 wrote to memory of 1840 676 opera.exe cmd.exe PID 676 wrote to memory of 1840 676 opera.exe cmd.exe PID 676 wrote to memory of 1840 676 opera.exe cmd.exe PID 676 wrote to memory of 1688 676 opera.exe cmd.exe PID 676 wrote to memory of 1688 676 opera.exe cmd.exe PID 676 wrote to memory of 1688 676 opera.exe cmd.exe PID 676 wrote to memory of 1688 676 opera.exe cmd.exe PID 676 wrote to memory of 816 676 opera.exe opera.exe PID 676 wrote to memory of 816 676 opera.exe opera.exe PID 676 wrote to memory of 816 676 opera.exe opera.exe PID 676 wrote to memory of 816 676 opera.exe opera.exe PID 676 wrote to memory of 816 676 opera.exe opera.exe PID 676 wrote to memory of 816 676 opera.exe opera.exe PID 676 wrote to memory of 816 676 opera.exe opera.exe PID 676 wrote to memory of 816 676 opera.exe opera.exe PID 816 wrote to memory of 396 816 opera.exe skype.exe PID 816 wrote to memory of 396 816 opera.exe skype.exe PID 816 wrote to memory of 396 816 opera.exe skype.exe PID 816 wrote to memory of 396 816 opera.exe skype.exe PID 396 wrote to memory of 1372 396 skype.exe cmd.exe PID 396 wrote to memory of 1372 396 skype.exe cmd.exe PID 396 wrote to memory of 1372 396 skype.exe cmd.exe PID 396 wrote to memory of 1372 396 skype.exe cmd.exe PID 396 wrote to memory of 1124 396 skype.exe cmd.exe PID 396 wrote to memory of 1124 396 skype.exe cmd.exe PID 396 wrote to memory of 1124 396 skype.exe cmd.exe PID 396 wrote to memory of 1124 396 skype.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe"C:\Users\Admin\AppData\Local\Temp\3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe:Zone.Identifier"2⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe:Zone.Identifier"2⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe" "C:\Users\Admin\AppData\Roaming\opera.exe"2⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Roaming\opera.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\opera.exe"C:\Users\Admin\AppData\Roaming\opera.exe"3⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Roaming\opera.exe:Zone.Identifier"4⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Roaming\opera.exe:Zone.Identifier"4⤵
- NTFS ADS
-
C:\Users\Admin\AppData\Roaming\opera.exe"C:\Users\Admin\AppData\Roaming\opera.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\skype.exe"C:\Users\Admin\AppData\Roaming\skype.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Roaming\skype.exe:Zone.Identifier"6⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Roaming\skype.exe:Zone.Identifier"6⤵
- NTFS ADS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\opera.exeFilesize
172KB
MD54e85bff3f7fae195ba997de834e23c06
SHA13aff4c5071c186b91db043ccefbee615f48a1342
SHA2563249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8
SHA512ac2460a55edc79b3eab9a5929275d97eb5bd9757af202359b40ef7282e442d047c3373f93f1b15ad4ee85f70cf377e2960df0394f8966d3c1e9ff1b751b659b8
-
C:\Users\Admin\AppData\Roaming\opera.exeFilesize
172KB
MD54e85bff3f7fae195ba997de834e23c06
SHA13aff4c5071c186b91db043ccefbee615f48a1342
SHA2563249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8
SHA512ac2460a55edc79b3eab9a5929275d97eb5bd9757af202359b40ef7282e442d047c3373f93f1b15ad4ee85f70cf377e2960df0394f8966d3c1e9ff1b751b659b8
-
C:\Users\Admin\AppData\Roaming\opera.exeFilesize
172KB
MD54e85bff3f7fae195ba997de834e23c06
SHA13aff4c5071c186b91db043ccefbee615f48a1342
SHA2563249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8
SHA512ac2460a55edc79b3eab9a5929275d97eb5bd9757af202359b40ef7282e442d047c3373f93f1b15ad4ee85f70cf377e2960df0394f8966d3c1e9ff1b751b659b8
-
C:\Users\Admin\AppData\Roaming\skype.exeFilesize
172KB
MD54e85bff3f7fae195ba997de834e23c06
SHA13aff4c5071c186b91db043ccefbee615f48a1342
SHA2563249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8
SHA512ac2460a55edc79b3eab9a5929275d97eb5bd9757af202359b40ef7282e442d047c3373f93f1b15ad4ee85f70cf377e2960df0394f8966d3c1e9ff1b751b659b8
-
C:\Users\Admin\AppData\Roaming\skype.exeFilesize
172KB
MD54e85bff3f7fae195ba997de834e23c06
SHA13aff4c5071c186b91db043ccefbee615f48a1342
SHA2563249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8
SHA512ac2460a55edc79b3eab9a5929275d97eb5bd9757af202359b40ef7282e442d047c3373f93f1b15ad4ee85f70cf377e2960df0394f8966d3c1e9ff1b751b659b8
-
\Users\Admin\AppData\Roaming\opera.exeFilesize
172KB
MD54e85bff3f7fae195ba997de834e23c06
SHA13aff4c5071c186b91db043ccefbee615f48a1342
SHA2563249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8
SHA512ac2460a55edc79b3eab9a5929275d97eb5bd9757af202359b40ef7282e442d047c3373f93f1b15ad4ee85f70cf377e2960df0394f8966d3c1e9ff1b751b659b8
-
\Users\Admin\AppData\Roaming\opera.exeFilesize
172KB
MD54e85bff3f7fae195ba997de834e23c06
SHA13aff4c5071c186b91db043ccefbee615f48a1342
SHA2563249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8
SHA512ac2460a55edc79b3eab9a5929275d97eb5bd9757af202359b40ef7282e442d047c3373f93f1b15ad4ee85f70cf377e2960df0394f8966d3c1e9ff1b751b659b8
-
\Users\Admin\AppData\Roaming\opera.exeFilesize
172KB
MD54e85bff3f7fae195ba997de834e23c06
SHA13aff4c5071c186b91db043ccefbee615f48a1342
SHA2563249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8
SHA512ac2460a55edc79b3eab9a5929275d97eb5bd9757af202359b40ef7282e442d047c3373f93f1b15ad4ee85f70cf377e2960df0394f8966d3c1e9ff1b751b659b8
-
\Users\Admin\AppData\Roaming\skype.exeFilesize
172KB
MD54e85bff3f7fae195ba997de834e23c06
SHA13aff4c5071c186b91db043ccefbee615f48a1342
SHA2563249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8
SHA512ac2460a55edc79b3eab9a5929275d97eb5bd9757af202359b40ef7282e442d047c3373f93f1b15ad4ee85f70cf377e2960df0394f8966d3c1e9ff1b751b659b8
-
memory/396-93-0x0000000000270000-0x00000000002C2000-memory.dmpFilesize
328KB
-
memory/396-92-0x0000000000DF0000-0x0000000000E24000-memory.dmpFilesize
208KB
-
memory/396-89-0x0000000000000000-mapping.dmp
-
memory/676-74-0x0000000000AF0000-0x0000000000AFC000-memory.dmpFilesize
48KB
-
memory/676-68-0x00000000013B0000-0x00000000013E4000-memory.dmpFilesize
208KB
-
memory/676-69-0x0000000000530000-0x0000000000582000-memory.dmpFilesize
328KB
-
memory/676-66-0x0000000000000000-mapping.dmp
-
memory/816-86-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/816-81-0x0000000000406ADE-mapping.dmp
-
memory/816-84-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/816-76-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/816-77-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/816-79-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/816-80-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/896-62-0x0000000000000000-mapping.dmp
-
memory/1124-96-0x0000000000000000-mapping.dmp
-
memory/1148-63-0x0000000000000000-mapping.dmp
-
memory/1372-95-0x0000000000000000-mapping.dmp
-
memory/1404-60-0x0000000000000000-mapping.dmp
-
memory/1652-58-0x0000000000000000-mapping.dmp
-
memory/1688-72-0x0000000000000000-mapping.dmp
-
memory/1840-71-0x0000000000000000-mapping.dmp
-
memory/1972-54-0x00000000010D0000-0x0000000001104000-memory.dmpFilesize
208KB
-
memory/1972-61-0x0000000001080000-0x000000000108C000-memory.dmpFilesize
48KB
-
memory/1972-59-0x0000000001020000-0x0000000001028000-memory.dmpFilesize
32KB
-
memory/1972-57-0x0000000075731000-0x0000000075733000-memory.dmpFilesize
8KB
-
memory/1972-56-0x00000000005A0000-0x00000000005CA000-memory.dmpFilesize
168KB
-
memory/1972-55-0x0000000000650000-0x00000000006A2000-memory.dmpFilesize
328KB