Analysis
-
max time kernel
136s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
06-08-2023 18:00
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v2004-20230703-en
General
-
Target
Setup.exe
-
Size
458KB
-
MD5
bfa40de5db5a15e0317dd72d982083dc
-
SHA1
fb93616799e85771a028944148bad57b15d0289b
-
SHA256
0feeb8481e07c0d5c1973f7a1644b788d56c9616c82ae0ce73505893664804a1
-
SHA512
cb39b9299485795ea810cb8f36b65bb3b816c37b7edd580bacccfaa8f9c222e0ebe08418ebef28512a2e87fc0ed758d5c6b3c445dfa5900e64d911fded2043c0
-
SSDEEP
6144:uK7EhfK4NKt9R8czLM0KGAFmLYYZMi/DQ/n0WvVhSOKi1UT:x7ElnUtkwLeNkZX/KvVcL
Malware Config
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
RevengeRat Executable 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2876-95-0x0000000000160000-0x000000000016C000-memory.dmp revengerat -
Executes dropped EXE 2 IoCs
Processes:
svchost.exeexplorer.exepid process 2352 svchost.exe 2876 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Setup.exeexplorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Corporation Security = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\svchost.exe" Setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Explorer = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\explorer.exe" explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
explorer.exedescription pid process Token: SeDebugPrivilege 2876 explorer.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
Setup.exesvchost.exedescription pid process target process PID 2224 wrote to memory of 2352 2224 Setup.exe svchost.exe PID 2224 wrote to memory of 2352 2224 Setup.exe svchost.exe PID 2224 wrote to memory of 2352 2224 Setup.exe svchost.exe PID 2352 wrote to memory of 2876 2352 svchost.exe explorer.exe PID 2352 wrote to memory of 2876 2352 svchost.exe explorer.exe PID 2352 wrote to memory of 2876 2352 svchost.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exeFilesize
133KB
MD5247976d7e405bfd0f716a3d5f2cd499b
SHA1dbcf03a94b3cced51ebe42af6f860e8d898f2459
SHA256c37430f6f2249e0faff20595f0677955cd2c1f727f94bff53f21ecc894e340f6
SHA512664b189c6b99b8927bb6fdb52c2c3f0031e88edc1dac80c8f6da5682ac30f17f295bed739df56e4bb754dca773c9eeb4e4b56fc3c36ccda0ab182ad54dd7edad
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exeFilesize
133KB
MD5247976d7e405bfd0f716a3d5f2cd499b
SHA1dbcf03a94b3cced51ebe42af6f860e8d898f2459
SHA256c37430f6f2249e0faff20595f0677955cd2c1f727f94bff53f21ecc894e340f6
SHA512664b189c6b99b8927bb6fdb52c2c3f0031e88edc1dac80c8f6da5682ac30f17f295bed739df56e4bb754dca773c9eeb4e4b56fc3c36ccda0ab182ad54dd7edad
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exeFilesize
133KB
MD5247976d7e405bfd0f716a3d5f2cd499b
SHA1dbcf03a94b3cced51ebe42af6f860e8d898f2459
SHA256c37430f6f2249e0faff20595f0677955cd2c1f727f94bff53f21ecc894e340f6
SHA512664b189c6b99b8927bb6fdb52c2c3f0031e88edc1dac80c8f6da5682ac30f17f295bed739df56e4bb754dca773c9eeb4e4b56fc3c36ccda0ab182ad54dd7edad
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exeFilesize
339KB
MD5301e8d9a2445dd999ce816c17d8dbbb3
SHA1b91163babeb738bd4d0f577ac764cee17fffe564
SHA2562ea1fa52a6896ce0100084e3696712d76b4d1e995ca0012954bae3107562a9eb
SHA5124941a820d26206fa3e333419622c3b07c8ebdaad51d1c6976df912e9ec123ad39a0c67fb5c3e362658f8463b366892fc4575d4cc2ebe62c2011d10ed5eb6bba3
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exeFilesize
339KB
MD5301e8d9a2445dd999ce816c17d8dbbb3
SHA1b91163babeb738bd4d0f577ac764cee17fffe564
SHA2562ea1fa52a6896ce0100084e3696712d76b4d1e995ca0012954bae3107562a9eb
SHA5124941a820d26206fa3e333419622c3b07c8ebdaad51d1c6976df912e9ec123ad39a0c67fb5c3e362658f8463b366892fc4575d4cc2ebe62c2011d10ed5eb6bba3
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exeFilesize
339KB
MD5301e8d9a2445dd999ce816c17d8dbbb3
SHA1b91163babeb738bd4d0f577ac764cee17fffe564
SHA2562ea1fa52a6896ce0100084e3696712d76b4d1e995ca0012954bae3107562a9eb
SHA5124941a820d26206fa3e333419622c3b07c8ebdaad51d1c6976df912e9ec123ad39a0c67fb5c3e362658f8463b366892fc4575d4cc2ebe62c2011d10ed5eb6bba3
-
memory/2224-71-0x000007FEF5D30000-0x000007FEF66CD000-memory.dmpFilesize
9.6MB
-
memory/2224-54-0x0000000000B90000-0x0000000000C08000-memory.dmpFilesize
480KB
-
memory/2224-55-0x0000000000260000-0x000000000028C000-memory.dmpFilesize
176KB
-
memory/2224-56-0x000007FEF5D30000-0x000007FEF66CD000-memory.dmpFilesize
9.6MB
-
memory/2224-57-0x0000000000590000-0x0000000000610000-memory.dmpFilesize
512KB
-
memory/2224-58-0x000007FEF5D30000-0x000007FEF66CD000-memory.dmpFilesize
9.6MB
-
memory/2352-83-0x0000000000B00000-0x0000000000B80000-memory.dmpFilesize
512KB
-
memory/2352-90-0x000007FEF5D30000-0x000007FEF66CD000-memory.dmpFilesize
9.6MB
-
memory/2352-82-0x000007FEF5D30000-0x000007FEF66CD000-memory.dmpFilesize
9.6MB
-
memory/2352-72-0x0000000000480000-0x0000000000488000-memory.dmpFilesize
32KB
-
memory/2352-74-0x0000000000B00000-0x0000000000B80000-memory.dmpFilesize
512KB
-
memory/2352-73-0x000007FEF5D30000-0x000007FEF66CD000-memory.dmpFilesize
9.6MB
-
memory/2352-70-0x0000000000D20000-0x0000000000D7A000-memory.dmpFilesize
360KB
-
memory/2352-75-0x000007FEF5D30000-0x000007FEF66CD000-memory.dmpFilesize
9.6MB
-
memory/2876-91-0x00000000012B0000-0x00000000012D6000-memory.dmpFilesize
152KB
-
memory/2876-92-0x000007FEF27D0000-0x000007FEF31BC000-memory.dmpFilesize
9.9MB
-
memory/2876-93-0x000000001B140000-0x000000001B1C0000-memory.dmpFilesize
512KB
-
memory/2876-94-0x0000000000140000-0x000000000014E000-memory.dmpFilesize
56KB
-
memory/2876-95-0x0000000000160000-0x000000000016C000-memory.dmpFilesize
48KB
-
memory/2876-98-0x000007FEF27D0000-0x000007FEF31BC000-memory.dmpFilesize
9.9MB
-
memory/2876-99-0x000000001B140000-0x000000001B1C0000-memory.dmpFilesize
512KB