Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
09-02-2023 15:46
Static task
static1
Behavioral task
behavioral1
Sample
stealer30.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
stealer30.exe
Resource
win10v2004-20220901-en
General
-
Target
stealer30.exe
-
Size
373KB
-
MD5
70d717a07a6df0db8fa222a5719c1ccd
-
SHA1
71dd5d3f838e2f869cca3aaf186c60aeb05bd682
-
SHA256
4acc7393b942c7c331ef0d08dc20000177adbe93f7a5202af14735b148c432f7
-
SHA512
cd83260c5b5891815907fb8b18383d8428c7d77a5c8af0556aaa8036e7dc2026c1e268506df86385dc8a2cb7d776b700b638adbf79b4d393a331b6d6e85cb250
-
SSDEEP
6144:wsNJZA19r/SpqYYn/70nFIyUveIh6i2AgVv0Io9J:b/i9T07YD0XF+n
Malware Config
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
RevengeRat Executable 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4224-135-0x0000000000400000-0x0000000000414000-memory.dmp revengerat behavioral2/memory/4224-137-0x0000000000400000-0x0000000000414000-memory.dmp revengerat -
Drops startup file 2 IoCs
Processes:
vbc.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BraveUpdate vbc.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BraveUpdate.exe vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
stealer30.exedescription pid process target process PID 644 set thread context of 4224 644 stealer30.exe stealer30.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
stealer30.exestealer30.exedescription pid process Token: SeDebugPrivilege 644 stealer30.exe Token: SeDebugPrivilege 4224 stealer30.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
stealer30.exestealer30.exevbc.exedescription pid process target process PID 644 wrote to memory of 4224 644 stealer30.exe stealer30.exe PID 644 wrote to memory of 4224 644 stealer30.exe stealer30.exe PID 644 wrote to memory of 4224 644 stealer30.exe stealer30.exe PID 644 wrote to memory of 4224 644 stealer30.exe stealer30.exe PID 644 wrote to memory of 4224 644 stealer30.exe stealer30.exe PID 644 wrote to memory of 4224 644 stealer30.exe stealer30.exe PID 644 wrote to memory of 4224 644 stealer30.exe stealer30.exe PID 644 wrote to memory of 4224 644 stealer30.exe stealer30.exe PID 4224 wrote to memory of 4728 4224 stealer30.exe vbc.exe PID 4224 wrote to memory of 4728 4224 stealer30.exe vbc.exe PID 4224 wrote to memory of 4728 4224 stealer30.exe vbc.exe PID 4728 wrote to memory of 4300 4728 vbc.exe cvtres.exe PID 4728 wrote to memory of 4300 4728 vbc.exe cvtres.exe PID 4728 wrote to memory of 4300 4728 vbc.exe cvtres.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\stealer30.exe"C:\Users\Admin\AppData\Local\Temp\stealer30.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\stealer30.exe"C:\Users\Admin\AppData\Local\Temp\stealer30.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2rz4xoxk\2rz4xoxk.cmdline"3⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES55CC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFF02B61A7E174EFF85C3274B58BBBE.TMP"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\stealer30.exe.logFilesize
520B
MD53ca2f9e6a94c24c455ac9431a0bf479b
SHA1a90309eec691588990609f8f8ad9b935d6f38eb2
SHA256e84d0c64750ec6333b67eb8aef737bb21cd86c6ef6e520c6537ede13505e125e
SHA512ba66e42b384f0d865a21d9169169a0b2bd9c62ebee68acc63a191b1a67ca16f4534f955055fc84bbc4a9cd22cec11c3c22a15df7741d99b7dec456e5cabcb0b5
-
C:\Users\Admin\AppData\Local\Temp\2rz4xoxk\2rz4xoxk.0.vbFilesize
156B
MD5e8b2170621cbfeab631f0c07acee420f
SHA1192e59b621936cc343c45b124a44b5749f85d954
SHA256d3201dea2b468c1e018bdb138c0fb72f6c36720bd4794e71e7e3554e0c60e4e8
SHA5124725637f4a26beb8be7d83750d755225f1b2a4133db7dd0b9a7014108ed5cc2fc7bbd84d70de86f33f6348c62ce5e44e92dcd3a447a65e2231254fdb3a6491be
-
C:\Users\Admin\AppData\Local\Temp\2rz4xoxk\2rz4xoxk.cmdlineFilesize
204B
MD5f4e3fb16328f4ab657b72b61ea7a38bc
SHA1b7f615aeb528fa6a5b2961b4c38493bd52fbbfc4
SHA256fe065c353ad46982e36eb7a1f1687d6dde9b6e2c0b5ac8a81e1fae3345f865c2
SHA51289e90baaf7a7071bafd2684d2795e8b8e2a16554c700e765fc3c91c436b6c7d07eecb07383cd7102b12af1a90030b9e15618ea27b52240c9fe0fc03f39f2b80c
-
C:\Users\Admin\AppData\Local\Temp\RES55CC.tmpFilesize
1KB
MD5827aa43834dffa3588b688df766364ef
SHA1bc70f61e69174d024be59dacca1b7df2942ba9fc
SHA256656292b2d42829d35207537ce1583d7e7b0da26dbae0dff22b491d52024a95c7
SHA512fd974d6985811a656dba8d3c327e5207ceea4e6eb404dc44bf34963ee13b2bbb91e83d53805acb475d79af340f564530ff940ffe97b5b2bc2595c0f0fd263a0d
-
C:\Users\Admin\AppData\Local\Temp\vbcFF02B61A7E174EFF85C3274B58BBBE.TMPFilesize
1KB
MD56aa287a36a3a87cf2e9954e020b36f1c
SHA153d0fd30de7dbaefb4ddd72d948d7e33dfa78077
SHA25691e0548f83cd56956da168e71c46760f11505e07ddec4458ff640b08f1a84a5d
SHA5122181f8e6e829380661276d4b5c13795810aac5cd5f14fdae08557095794dc11bd3f7897b5e69ad7f659d879fd8ade2f108fb778d2a05a7d509a67e3a7d94149a
-
memory/644-133-0x0000000005C50000-0x00000000061F4000-memory.dmpFilesize
5.6MB
-
memory/644-132-0x0000000000B30000-0x0000000000B92000-memory.dmpFilesize
392KB
-
memory/4224-135-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4224-140-0x00000000054B0000-0x0000000005516000-memory.dmpFilesize
408KB
-
memory/4224-139-0x0000000005410000-0x00000000054AC000-memory.dmpFilesize
624KB
-
memory/4224-137-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4224-134-0x0000000000000000-mapping.dmp
-
memory/4300-144-0x0000000000000000-mapping.dmp
-
memory/4728-141-0x0000000000000000-mapping.dmp