Analysis
-
max time kernel
116s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06-09-2022 13:27
Behavioral task
behavioral1
Sample
0x0007000000005c50-55.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0x0007000000005c50-55.exe
Resource
win10v2004-20220812-en
General
-
Target
0x0007000000005c50-55.exe
-
Size
63KB
-
MD5
6b5c0e29662a332947386b371a337a52
-
SHA1
c7bc42ad31263077e59dc8cd85aadd3731c69a77
-
SHA256
94151f693fab777c75599728098c54d63aa1e9fb646aabe0d2c0e7270dfc56f7
-
SHA512
9beae50ab693a5b525d44fab5e64d6dc86a20ee4d59c32b3470d5bab804151d1af4578e19ee310d4b41ec500909d541a910e316859abc62d5fa29e79e829ff82
-
SSDEEP
1536:75DLR+zhAoV7xwd2/GnV+AINrS4dWYB7EdlU+:75XRUAoVFwkIV35QWYBkU+
Malware Config
Extracted
revengerat
Guest
194.5.179.83:4040
127.0.0.1:4040
RV_MUTEX
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
RevengeRat Executable 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\svhost.exe revengerat C:\Users\Admin\AppData\Roaming\svhost.exe revengerat -
Executes dropped EXE 2 IoCs
Processes:
svhost.exe982946.exepid process 460 svhost.exe 1620 982946.exe -
Drops startup file 2 IoCs
Processes:
svhost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.exe svhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.exe svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
0x0007000000005c50-55.exesvhost.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 0x0007000000005c50-55.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 0x0007000000005c50-55.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 svhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svhost.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
982946.exepid process 1620 982946.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
0x0007000000005c50-55.exesvhost.exe982946.exedescription pid process Token: SeDebugPrivilege 1088 0x0007000000005c50-55.exe Token: SeDebugPrivilege 460 svhost.exe Token: SeDebugPrivilege 1620 982946.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
0x0007000000005c50-55.exesvhost.exedescription pid process target process PID 1088 wrote to memory of 460 1088 0x0007000000005c50-55.exe svhost.exe PID 1088 wrote to memory of 460 1088 0x0007000000005c50-55.exe svhost.exe PID 1088 wrote to memory of 460 1088 0x0007000000005c50-55.exe svhost.exe PID 460 wrote to memory of 1620 460 svhost.exe 982946.exe PID 460 wrote to memory of 1620 460 svhost.exe 982946.exe PID 460 wrote to memory of 1620 460 svhost.exe 982946.exe PID 460 wrote to memory of 1620 460 svhost.exe 982946.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0x0007000000005c50-55.exe"C:\Users\Admin\AppData\Local\Temp\0x0007000000005c50-55.exe"1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svhost.exe"C:\Users\Admin\AppData\Roaming\svhost.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\982946.exe"C:\Users\Admin\AppData\Local\Temp\982946.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\982946.exeFilesize
24KB
MD5f8c68280e2f30157639d5c345da04172
SHA15ef1f44e41f61d28abc3d08ddb205dc77f763cfb
SHA25638f988f3367ba56bcb20d2f4a7380e349b702e367cc6ef32259eb96d8e069f4e
SHA512087887dbcb2af5cc9547b4cac4d1a6f79d0c128a1ea5028df044e66d77c3c41a07313e4d804d10bbeda20d47da8cf9739e240fda3b82cc7bd03cabc6855d219b
-
C:\Users\Admin\AppData\Local\Temp\982946.exeFilesize
24KB
MD5f8c68280e2f30157639d5c345da04172
SHA15ef1f44e41f61d28abc3d08ddb205dc77f763cfb
SHA25638f988f3367ba56bcb20d2f4a7380e349b702e367cc6ef32259eb96d8e069f4e
SHA512087887dbcb2af5cc9547b4cac4d1a6f79d0c128a1ea5028df044e66d77c3c41a07313e4d804d10bbeda20d47da8cf9739e240fda3b82cc7bd03cabc6855d219b
-
C:\Users\Admin\AppData\Roaming\svhost.exeFilesize
63KB
MD56b5c0e29662a332947386b371a337a52
SHA1c7bc42ad31263077e59dc8cd85aadd3731c69a77
SHA25694151f693fab777c75599728098c54d63aa1e9fb646aabe0d2c0e7270dfc56f7
SHA5129beae50ab693a5b525d44fab5e64d6dc86a20ee4d59c32b3470d5bab804151d1af4578e19ee310d4b41ec500909d541a910e316859abc62d5fa29e79e829ff82
-
C:\Users\Admin\AppData\Roaming\svhost.exeFilesize
63KB
MD56b5c0e29662a332947386b371a337a52
SHA1c7bc42ad31263077e59dc8cd85aadd3731c69a77
SHA25694151f693fab777c75599728098c54d63aa1e9fb646aabe0d2c0e7270dfc56f7
SHA5129beae50ab693a5b525d44fab5e64d6dc86a20ee4d59c32b3470d5bab804151d1af4578e19ee310d4b41ec500909d541a910e316859abc62d5fa29e79e829ff82
-
memory/460-57-0x0000000000000000-mapping.dmp
-
memory/460-60-0x000007FEF34E0000-0x000007FEF3F03000-memory.dmpFilesize
10.1MB
-
memory/460-61-0x000007FEEF030000-0x000007FEF00C6000-memory.dmpFilesize
16.6MB
-
memory/1088-54-0x000007FEF3F10000-0x000007FEF4933000-memory.dmpFilesize
10.1MB
-
memory/1088-56-0x000007FEFC431000-0x000007FEFC433000-memory.dmpFilesize
8KB
-
memory/1088-55-0x000007FEF2E70000-0x000007FEF3F06000-memory.dmpFilesize
16.6MB
-
memory/1620-63-0x0000000000000000-mapping.dmp
-
memory/1620-66-0x0000000001270000-0x000000000127C000-memory.dmpFilesize
48KB
-
memory/1620-67-0x0000000076681000-0x0000000076683000-memory.dmpFilesize
8KB
-
memory/1620-68-0x0000000001235000-0x0000000001246000-memory.dmpFilesize
68KB
-
memory/1620-69-0x0000000001235000-0x0000000001246000-memory.dmpFilesize
68KB