Analysis
-
max time kernel
130s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2023 23:32
Static task
static1
Behavioral task
behavioral1
Sample
54d4cd535c5555a2e1292817639001549782a097d8f1ec2a734ea00f57e2d780.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
54d4cd535c5555a2e1292817639001549782a097d8f1ec2a734ea00f57e2d780.exe
Resource
win10v2004-20230220-en
General
-
Target
54d4cd535c5555a2e1292817639001549782a097d8f1ec2a734ea00f57e2d780.exe
-
Size
3.8MB
-
MD5
1a9f0f4fda6bf900cda1ce355c8c5e01
-
SHA1
89e2776773f843473c0e284324fa5ef7a96a5539
-
SHA256
54d4cd535c5555a2e1292817639001549782a097d8f1ec2a734ea00f57e2d780
-
SHA512
975e2dab507623814bc8f6af9ecfce9ad29a764e063616cefe5da263ed33ceedc5a18da18768b4f71cdf46ccd497584fe68432e0bec4e496de593c31d801b080
-
SSDEEP
98304:7trbTA1RptoXinXh6B8WXhT7rQUdUi2p2xIqjsdSyVOLPTiU:hc1btnnXRah84h4qEOniU
Malware Config
Extracted
revengerat
NyanCatRevenge
marcelotatuape.ddns.net:333
188246aaba1
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
CDS.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation CDS.exe -
Drops startup file 2 IoCs
Processes:
54d4cd535c5555a2e1292817639001549782a097d8f1ec2a734ea00f57e2d780.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinRAR.exe 54d4cd535c5555a2e1292817639001549782a097d8f1ec2a734ea00f57e2d780.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinRAR.exe 54d4cd535c5555a2e1292817639001549782a097d8f1ec2a734ea00f57e2d780.exe -
Executes dropped EXE 3 IoCs
Processes:
WinRAR.exeCDS.execrypted.exepid process 1808 WinRAR.exe 4968 CDS.exe 4880 crypted.exe -
Loads dropped DLL 1 IoCs
Processes:
CDS.exepid process 4968 CDS.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
WinRAR.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce WinRAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" WinRAR.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
CDS.exepid process 4968 CDS.exe 4968 CDS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AUDIODG.EXEdescription pid process Token: 33 220 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 220 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
54d4cd535c5555a2e1292817639001549782a097d8f1ec2a734ea00f57e2d780.exepid process 4112 54d4cd535c5555a2e1292817639001549782a097d8f1ec2a734ea00f57e2d780.exe 4112 54d4cd535c5555a2e1292817639001549782a097d8f1ec2a734ea00f57e2d780.exe 4112 54d4cd535c5555a2e1292817639001549782a097d8f1ec2a734ea00f57e2d780.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
54d4cd535c5555a2e1292817639001549782a097d8f1ec2a734ea00f57e2d780.exepid process 4112 54d4cd535c5555a2e1292817639001549782a097d8f1ec2a734ea00f57e2d780.exe 4112 54d4cd535c5555a2e1292817639001549782a097d8f1ec2a734ea00f57e2d780.exe 4112 54d4cd535c5555a2e1292817639001549782a097d8f1ec2a734ea00f57e2d780.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
CDS.exepid process 4968 CDS.exe 4968 CDS.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
54d4cd535c5555a2e1292817639001549782a097d8f1ec2a734ea00f57e2d780.exeWinRAR.exeCDS.exedescription pid process target process PID 4112 wrote to memory of 1808 4112 54d4cd535c5555a2e1292817639001549782a097d8f1ec2a734ea00f57e2d780.exe WinRAR.exe PID 4112 wrote to memory of 1808 4112 54d4cd535c5555a2e1292817639001549782a097d8f1ec2a734ea00f57e2d780.exe WinRAR.exe PID 4112 wrote to memory of 1808 4112 54d4cd535c5555a2e1292817639001549782a097d8f1ec2a734ea00f57e2d780.exe WinRAR.exe PID 1808 wrote to memory of 4968 1808 WinRAR.exe CDS.exe PID 1808 wrote to memory of 4968 1808 WinRAR.exe CDS.exe PID 1808 wrote to memory of 4968 1808 WinRAR.exe CDS.exe PID 4968 wrote to memory of 4880 4968 CDS.exe crypted.exe PID 4968 wrote to memory of 4880 4968 CDS.exe crypted.exe PID 4968 wrote to memory of 4880 4968 CDS.exe crypted.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\54d4cd535c5555a2e1292817639001549782a097d8f1ec2a734ea00f57e2d780.exe"C:\Users\Admin\AppData\Local\Temp\54d4cd535c5555a2e1292817639001549782a097d8f1ec2a734ea00f57e2d780.exe"1⤵
- Drops startup file
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinRAR.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinRAR.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe"C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe"4⤵
- Executes dropped EXE
PID:4880
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x404 0x3f81⤵
- Suspicious use of AdjustPrivilegeToken
PID:220
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\630_10.pngFilesize
2KB
MD5340b294efc691d1b20c64175d565ebc7
SHA181cb9649bd1c9a62ae79e781818fc24d15c29ce7
SHA25672566894059452101ea836bbff9ede5069141eeb52022ab55baa24e1666825c9
SHA5121395a8e175c63a1a1ff459a9dac437156c74299272e020e7e078a087969251a8534f17244a529acbc1b6800a97d4c0abfa3c88f6fcb88423f56dfaae9b49fc3d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.cddFilesize
13KB
MD53e7ecaeb51c2812d13b07ec852d74aaf
SHA1e9bdab93596ffb0f7f8c65243c579180939acb26
SHA256e7e942993864e8b18780ef10a415f7b93924c6378248c52f0c96895735222b96
SHA512635cd5173b595f1905af9eeea65037601cf8496d519c506b6d082662d438c26a1bfe653eaf6edcb117ccf8767975c37ab0238ca4c77574e2706f9b238a15ad4d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exeFilesize
6.1MB
MD5424bf196deaeb4ddcafb78e137fa560a
SHA1007738e9486c904a3115daa6e8ba2ee692af58c8
SHA2560963cef2f742a31b2604fe975f4471ae6a76641490fe60805db744fef9bdd5d2
SHA512a9be6dd5b2ed84baea34e0f1b1e8f5388ce3662c5dcb6a80c2d175be95f9598312837420c07b52cdfaa9e94bcffd8c7a2b9db2b551dfac171bce4b92f466e797
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exeFilesize
6.1MB
MD5424bf196deaeb4ddcafb78e137fa560a
SHA1007738e9486c904a3115daa6e8ba2ee692af58c8
SHA2560963cef2f742a31b2604fe975f4471ae6a76641490fe60805db744fef9bdd5d2
SHA512a9be6dd5b2ed84baea34e0f1b1e8f5388ce3662c5dcb6a80c2d175be95f9598312837420c07b52cdfaa9e94bcffd8c7a2b9db2b551dfac171bce4b92f466e797
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c.datFilesize
14KB
MD582cc7a20bb593d452746289a0e5bdcd0
SHA19d22a3f397f3f8dcc317c283397522797424c363
SHA256f2af4ad18effcbf7e523b043a8c4e5ea6eec305f133509dac3865c9da38e02f7
SHA51255ae051e412dc7491e177857c60bfc3db6b4375de68c5d00156b1dd280231e97d891934c15aaa7e3e51a35c9435fcdf2ead931c2593750879ec714a8d6cd05c2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exeFilesize
14KB
MD585273904caddf9308a9be66225b89b29
SHA1515dc3eb5441051a24789a2383fa79bfe023db0a
SHA2563109283533a011c6b1e99019f42eef658a86619c226f89190669eb77fc93c45a
SHA5123dd1a543a15c1705296a0343220aaa0b30c8d4dc868c10dc109eb257a551019fe8371a2044ae5a450e16fb5a765e4b2c7d2a528943a637de8f1af66e5a79eef0
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exeFilesize
14KB
MD585273904caddf9308a9be66225b89b29
SHA1515dc3eb5441051a24789a2383fa79bfe023db0a
SHA2563109283533a011c6b1e99019f42eef658a86619c226f89190669eb77fc93c45a
SHA5123dd1a543a15c1705296a0343220aaa0b30c8d4dc868c10dc109eb257a551019fe8371a2044ae5a450e16fb5a765e4b2c7d2a528943a637de8f1af66e5a79eef0
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exeFilesize
14KB
MD585273904caddf9308a9be66225b89b29
SHA1515dc3eb5441051a24789a2383fa79bfe023db0a
SHA2563109283533a011c6b1e99019f42eef658a86619c226f89190669eb77fc93c45a
SHA5123dd1a543a15c1705296a0343220aaa0b30c8d4dc868c10dc109eb257a551019fe8371a2044ae5a450e16fb5a765e4b2c7d2a528943a637de8f1af66e5a79eef0
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fs.settingsFilesize
5B
MD568934a3e9455fa72420237eb05902327
SHA17cb6efb98ba5972a9b5090dc2e517fe14d12cb04
SHA256fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa
SHA512719fa67eef49c4b2a2b83f0c62bddd88c106aaadb7e21ae057c8802b700e36f81fe3f144812d8b05d66dc663d908b25645e153262cf6d457aa34e684af9e328d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lua5.1.dllFilesize
322KB
MD5c3256800dce47c14acc83ccca4c3e2ac
SHA19d126818c66991dbc3813a65eddb88bbcf77f30a
SHA256f26f4f66022acc96d0319c09814ebeda60f4ab96b63b6262045dc786dc7c5866
SHA5126865a98ad8a6bd02d1ba35a28b36b6306af393f5e9ad767cd6da027bb021f7399d629423f510c44436ac3e4603b6c606493edf8b14d21fabf3eab16d37bd0d25
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lua5.1.dllFilesize
322KB
MD5c3256800dce47c14acc83ccca4c3e2ac
SHA19d126818c66991dbc3813a65eddb88bbcf77f30a
SHA256f26f4f66022acc96d0319c09814ebeda60f4ab96b63b6262045dc786dc7c5866
SHA5126865a98ad8a6bd02d1ba35a28b36b6306af393f5e9ad767cd6da027bb021f7399d629423f510c44436ac3e4603b6c606493edf8b14d21fabf3eab16d37bd0d25
-
C:\Users\Admin\AppData\Local\Temp\aut6BFD.tmpFilesize
3.2MB
MD5f2650ed50b160d20271da3f488aaeb8f
SHA1c95baa1c6ce91f87b83b90a7988f5acffa97ff48
SHA2564b7724ca163a433c88b0c02a6974c3db55b4374688bcf6c7d396bccba582eb74
SHA512f597ede97af90e08ab1ff4cae3d978337a13977874472b05218f99ecfa96d15f74201c3ecd98d496c19a8cb57bd0e9a6063380042bbb53e0b00dd74208973305
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinRAR.exeFilesize
3.2MB
MD5f2650ed50b160d20271da3f488aaeb8f
SHA1c95baa1c6ce91f87b83b90a7988f5acffa97ff48
SHA2564b7724ca163a433c88b0c02a6974c3db55b4374688bcf6c7d396bccba582eb74
SHA512f597ede97af90e08ab1ff4cae3d978337a13977874472b05218f99ecfa96d15f74201c3ecd98d496c19a8cb57bd0e9a6063380042bbb53e0b00dd74208973305
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinRAR.exeFilesize
3.2MB
MD5f2650ed50b160d20271da3f488aaeb8f
SHA1c95baa1c6ce91f87b83b90a7988f5acffa97ff48
SHA2564b7724ca163a433c88b0c02a6974c3db55b4374688bcf6c7d396bccba582eb74
SHA512f597ede97af90e08ab1ff4cae3d978337a13977874472b05218f99ecfa96d15f74201c3ecd98d496c19a8cb57bd0e9a6063380042bbb53e0b00dd74208973305
-
memory/4880-185-0x0000000000680000-0x0000000000690000-memory.dmpFilesize
64KB
-
memory/4880-186-0x0000000000680000-0x0000000000690000-memory.dmpFilesize
64KB