Analysis
-
max time kernel
147s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2022 21:28
Static task
static1
Behavioral task
behavioral1
Sample
3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe
Resource
win10v2004-20220721-en
General
-
Target
3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe
-
Size
172KB
-
MD5
4e85bff3f7fae195ba997de834e23c06
-
SHA1
3aff4c5071c186b91db043ccefbee615f48a1342
-
SHA256
3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8
-
SHA512
ac2460a55edc79b3eab9a5929275d97eb5bd9757af202359b40ef7282e442d047c3373f93f1b15ad4ee85f70cf377e2960df0394f8966d3c1e9ff1b751b659b8
Malware Config
Extracted
revengerat
Guest
199.195.250.222:666
RV_MUTEX-XawrHJfWfhaR
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
RevengeRat Executable 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3472-147-0x0000000000400000-0x000000000040A000-memory.dmp revengerat -
Executes dropped EXE 3 IoCs
Processes:
opera.exeopera.exeskype.exepid process 2628 opera.exe 3472 opera.exe 1840 skype.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exeopera.exeopera.exeskype.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation 3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation opera.exe Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation opera.exe Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation skype.exe -
Drops startup file 1 IoCs
Processes:
opera.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\opera.lnk opera.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
opera.exedescription pid process target process PID 2628 set thread context of 3472 2628 opera.exe opera.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NTFS ADS 9 IoCs
Processes:
cmd.execmd.exeopera.execmd.execmd.execmd.execmd.execmd.execmd.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp\3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe:Zone.Identifier cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\opera.exe:Zone.Identifier cmd.exe File created C:\Users\Admin\AppData\Roaming\skype.exe\:Zone.Identifier:$DATA opera.exe File opened for modification C:\Users\Admin\AppData\Roaming\skype.exe:Zone.Identifier cmd.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe:Zone.Identifier cmd.exe File created C:\Users\Admin\AppData\Roaming\opera.exe\:Zone.Identifier:$DATA cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\opera.exe:Zone.Identifier cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\skype.exe:Zone.Identifier cmd.exe File created C:\Users\Admin\AppData\Roaming\opera.exe\:Zone.Identifier:$DATA cmd.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exeopera.exeopera.exeskype.exedescription pid process Token: SeDebugPrivilege 1696 3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe Token: SeDebugPrivilege 2628 opera.exe Token: SeDebugPrivilege 3472 opera.exe Token: SeDebugPrivilege 1840 skype.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.execmd.exeopera.exeopera.exeskype.exedescription pid process target process PID 1696 wrote to memory of 1848 1696 3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe cmd.exe PID 1696 wrote to memory of 1848 1696 3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe cmd.exe PID 1696 wrote to memory of 1848 1696 3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe cmd.exe PID 1696 wrote to memory of 1792 1696 3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe cmd.exe PID 1696 wrote to memory of 1792 1696 3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe cmd.exe PID 1696 wrote to memory of 1792 1696 3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe cmd.exe PID 1696 wrote to memory of 2376 1696 3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe cmd.exe PID 1696 wrote to memory of 2376 1696 3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe cmd.exe PID 1696 wrote to memory of 2376 1696 3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe cmd.exe PID 1696 wrote to memory of 4704 1696 3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe cmd.exe PID 1696 wrote to memory of 4704 1696 3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe cmd.exe PID 1696 wrote to memory of 4704 1696 3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe cmd.exe PID 4704 wrote to memory of 2628 4704 cmd.exe opera.exe PID 4704 wrote to memory of 2628 4704 cmd.exe opera.exe PID 4704 wrote to memory of 2628 4704 cmd.exe opera.exe PID 2628 wrote to memory of 1504 2628 opera.exe cmd.exe PID 2628 wrote to memory of 1504 2628 opera.exe cmd.exe PID 2628 wrote to memory of 1504 2628 opera.exe cmd.exe PID 2628 wrote to memory of 3780 2628 opera.exe cmd.exe PID 2628 wrote to memory of 3780 2628 opera.exe cmd.exe PID 2628 wrote to memory of 3780 2628 opera.exe cmd.exe PID 2628 wrote to memory of 3472 2628 opera.exe opera.exe PID 2628 wrote to memory of 3472 2628 opera.exe opera.exe PID 2628 wrote to memory of 3472 2628 opera.exe opera.exe PID 2628 wrote to memory of 3472 2628 opera.exe opera.exe PID 2628 wrote to memory of 3472 2628 opera.exe opera.exe PID 2628 wrote to memory of 3472 2628 opera.exe opera.exe PID 2628 wrote to memory of 3472 2628 opera.exe opera.exe PID 3472 wrote to memory of 1840 3472 opera.exe skype.exe PID 3472 wrote to memory of 1840 3472 opera.exe skype.exe PID 3472 wrote to memory of 1840 3472 opera.exe skype.exe PID 1840 wrote to memory of 1272 1840 skype.exe cmd.exe PID 1840 wrote to memory of 1272 1840 skype.exe cmd.exe PID 1840 wrote to memory of 1272 1840 skype.exe cmd.exe PID 1840 wrote to memory of 4752 1840 skype.exe cmd.exe PID 1840 wrote to memory of 4752 1840 skype.exe cmd.exe PID 1840 wrote to memory of 4752 1840 skype.exe cmd.exe PID 1840 wrote to memory of 860 1840 skype.exe cmd.exe PID 1840 wrote to memory of 860 1840 skype.exe cmd.exe PID 1840 wrote to memory of 860 1840 skype.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe"C:\Users\Admin\AppData\Local\Temp\3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe:Zone.Identifier"2⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe:Zone.Identifier"2⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\3249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8.exe" "C:\Users\Admin\AppData\Roaming\opera.exe"2⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Roaming\opera.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\opera.exe"C:\Users\Admin\AppData\Roaming\opera.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Roaming\opera.exe:Zone.Identifier"4⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Roaming\opera.exe:Zone.Identifier"4⤵
- NTFS ADS
-
C:\Users\Admin\AppData\Roaming\opera.exe"C:\Users\Admin\AppData\Roaming\opera.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\skype.exe"C:\Users\Admin\AppData\Roaming\skype.exe"5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Roaming\skype.exe:Zone.Identifier"6⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Roaming\skype.exe:Zone.Identifier"6⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Roaming\skype.exe" "C:\Users\Admin\AppData\Roaming\opera.exe"6⤵
- NTFS ADS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\opera.exe.logFilesize
990B
MD5170a0d0ffeab25418914970e24e92882
SHA17f8b4e3d2055b93bae7aed7e4a870cb587ec15a7
SHA2568a8adb54e43567ca2dc37ccf3cae976423a8e97bee883653597827dc839540d8
SHA512fbfe490bf727444bcf4ab135b6f859745e3122d13e1f7a38745b4c38b158dd72f333a92e53b3891362714b4ff5419be5ec81ca425a3004b6e3b6c610c548e2f1
-
C:\Users\Admin\AppData\Roaming\opera.exeFilesize
172KB
MD54e85bff3f7fae195ba997de834e23c06
SHA13aff4c5071c186b91db043ccefbee615f48a1342
SHA2563249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8
SHA512ac2460a55edc79b3eab9a5929275d97eb5bd9757af202359b40ef7282e442d047c3373f93f1b15ad4ee85f70cf377e2960df0394f8966d3c1e9ff1b751b659b8
-
C:\Users\Admin\AppData\Roaming\opera.exeFilesize
172KB
MD54e85bff3f7fae195ba997de834e23c06
SHA13aff4c5071c186b91db043ccefbee615f48a1342
SHA2563249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8
SHA512ac2460a55edc79b3eab9a5929275d97eb5bd9757af202359b40ef7282e442d047c3373f93f1b15ad4ee85f70cf377e2960df0394f8966d3c1e9ff1b751b659b8
-
C:\Users\Admin\AppData\Roaming\opera.exeFilesize
172KB
MD54e85bff3f7fae195ba997de834e23c06
SHA13aff4c5071c186b91db043ccefbee615f48a1342
SHA2563249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8
SHA512ac2460a55edc79b3eab9a5929275d97eb5bd9757af202359b40ef7282e442d047c3373f93f1b15ad4ee85f70cf377e2960df0394f8966d3c1e9ff1b751b659b8
-
C:\Users\Admin\AppData\Roaming\skype.exeFilesize
172KB
MD54e85bff3f7fae195ba997de834e23c06
SHA13aff4c5071c186b91db043ccefbee615f48a1342
SHA2563249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8
SHA512ac2460a55edc79b3eab9a5929275d97eb5bd9757af202359b40ef7282e442d047c3373f93f1b15ad4ee85f70cf377e2960df0394f8966d3c1e9ff1b751b659b8
-
C:\Users\Admin\AppData\Roaming\skype.exeFilesize
172KB
MD54e85bff3f7fae195ba997de834e23c06
SHA13aff4c5071c186b91db043ccefbee615f48a1342
SHA2563249bf20c3e1bf52f6fd223bbd6b2c7f181d951ddbe2868ee0b33607224516d8
SHA512ac2460a55edc79b3eab9a5929275d97eb5bd9757af202359b40ef7282e442d047c3373f93f1b15ad4ee85f70cf377e2960df0394f8966d3c1e9ff1b751b659b8
-
memory/860-155-0x0000000000000000-mapping.dmp
-
memory/1272-153-0x0000000000000000-mapping.dmp
-
memory/1504-143-0x0000000000000000-mapping.dmp
-
memory/1696-136-0x00000000091E0000-0x00000000093A2000-memory.dmpFilesize
1.8MB
-
memory/1696-133-0x0000000008840000-0x00000000088A6000-memory.dmpFilesize
408KB
-
memory/1696-132-0x0000000005730000-0x00000000057C2000-memory.dmpFilesize
584KB
-
memory/1696-130-0x0000000000E80000-0x0000000000EB4000-memory.dmpFilesize
208KB
-
memory/1696-134-0x0000000008800000-0x0000000008822000-memory.dmpFilesize
136KB
-
memory/1696-131-0x0000000005C00000-0x00000000061A4000-memory.dmpFilesize
5.6MB
-
memory/1792-137-0x0000000000000000-mapping.dmp
-
memory/1840-150-0x0000000000000000-mapping.dmp
-
memory/1848-135-0x0000000000000000-mapping.dmp
-
memory/2376-138-0x0000000000000000-mapping.dmp
-
memory/2628-145-0x0000000008BC0000-0x0000000008C5C000-memory.dmpFilesize
624KB
-
memory/2628-140-0x0000000000000000-mapping.dmp
-
memory/3472-147-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/3472-146-0x0000000000000000-mapping.dmp
-
memory/3780-144-0x0000000000000000-mapping.dmp
-
memory/4704-139-0x0000000000000000-mapping.dmp
-
memory/4752-154-0x0000000000000000-mapping.dmp