Analysis
- max time kernel
37s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
06/01/2024, 22:42
General
- Target ._cache_Avine.exe
- Size 794KB
- Sample240106-2mwslabaa9
- SHA256 7f632b5d88cfc7b26997a717421fb370fd55b63dd723f24cddb8d7d5bd08cb51
Malware Config
Signatures
- RevengeRAT
Remote-access trojan with a wide range of capabilities.
- RevengeRat Executable 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Kills process with taskkill 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\._cache_Avine.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Avine.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Avine .exe"C:\Users\Admin\AppData\Local\Temp\Avine .exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"4⤵
-
\??\c:\windows\system32\cmstp.exe"c:\windows\system32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\zt1stjld.inf5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDrive.exe2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDrive.exe3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Taskmgr.exe2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Taskmgr.exe3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemSettings.exe2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemSettings.exe3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cortana.exe2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cortana.exe1⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM cmstp.exe /F1⤵
- Kills process with taskkill
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Setup.exe
version.exe
memory/232-174-0x0000017367200000-0x0000017367210000-memory.dmp
memory/232-179-0x00007FF80F340000-0x00007FF80FE01000-memory.dmp
memory/232-101-0x0000017367200000-0x0000017367210000-memory.dmp
memory/232-102-0x0000017367200000-0x0000017367210000-memory.dmp
memory/232-189-0x00007FF80F340000-0x00007FF80FE01000-memory.dmp
memory/232-100-0x00007FF80F340000-0x00007FF80FE01000-memory.dmp
memory/716-171-0x000001CFFE240000-0x000001CFFE250000-memory.dmp
memory/716-103-0x000001CFFE240000-0x000001CFFE250000-memory.dmp
memory/716-104-0x000001CFFE240000-0x000001CFFE250000-memory.dmp
memory/716-173-0x000001CFFE240000-0x000001CFFE250000-memory.dmp
memory/716-177-0x00007FF80F340000-0x00007FF80FE01000-memory.dmp
memory/716-114-0x000001CFFE350000-0x000001CFFE372000-memory.dmp
memory/716-138-0x00007FF80F340000-0x00007FF80FE01000-memory.dmp
memory/1536-81-0x00007FF80F340000-0x00007FF80FE01000-memory.dmp
memory/1536-79-0x00007FF80F340000-0x00007FF80FE01000-memory.dmp
memory/2008-167-0x00007FF80F340000-0x00007FF80FE01000-memory.dmp
memory/2008-137-0x000001DC28890000-0x000001DC288A0000-memory.dmp
memory/2008-136-0x000001DC28890000-0x000001DC288A0000-memory.dmp
memory/2008-187-0x00007FF80F340000-0x00007FF80FE01000-memory.dmp
memory/2008-172-0x000001DC28890000-0x000001DC288A0000-memory.dmp
memory/2008-180-0x000001DC28890000-0x000001DC288A0000-memory.dmp
memory/2128-168-0x000001D1EC910000-0x000001D1EC920000-memory.dmp
memory/2128-170-0x00007FF80F340000-0x00007FF80FE01000-memory.dmp
memory/2272-45-0x0000000000250000-0x00000000002A6000-memory.dmp
memory/2272-49-0x00007FF80F340000-0x00007FF80FE01000-memory.dmp
memory/2272-66-0x00007FF80F340000-0x00007FF80FE01000-memory.dmp
memory/2272-48-0x0000000000BD0000-0x0000000000BD8000-memory.dmp
memory/2272-78-0x00007FF80F340000-0x00007FF80FE01000-memory.dmp
memory/2340-85-0x000000001B410000-0x000000001B420000-memory.dmp
memory/2340-88-0x000000001B400000-0x000000001B40C000-memory.dmp
memory/2340-86-0x000000001B410000-0x000000001B420000-memory.dmp
memory/2340-87-0x00007FF80F340000-0x00007FF80FE01000-memory.dmp
memory/2340-97-0x000000001B410000-0x000000001B420000-memory.dmp
memory/2340-94-0x000000001B410000-0x000000001B420000-memory.dmp
memory/2340-93-0x000000001B410000-0x000000001B420000-memory.dmp
memory/2340-83-0x000000001B410000-0x000000001B420000-memory.dmp
memory/2340-72-0x00007FF80F340000-0x00007FF80FE01000-memory.dmp
memory/2340-70-0x00000000008B0000-0x00000000008E0000-memory.dmp
memory/2712-133-0x00007FF80F340000-0x00007FF80FE01000-memory.dmp
memory/2712-134-0x000001A069770000-0x000001A069780000-memory.dmp
memory/2712-188-0x00007FF80F340000-0x00007FF80FE01000-memory.dmp
memory/2712-169-0x000001A069770000-0x000001A069780000-memory.dmp
memory/3372-99-0x00007FF8055E0000-0x00007FF805F81000-memory.dmp
memory/3372-96-0x00007FF8055E0000-0x00007FF805F81000-memory.dmp
memory/3372-95-0x00007FF8055E0000-0x00007FF805F81000-memory.dmp
memory/3376-0-0x0000000000590000-0x000000000065C000-memory.dmp
memory/3376-1-0x00007FF80F340000-0x00007FF80FE01000-memory.dmp
memory/3376-34-0x00007FF80F340000-0x00007FF80FE01000-memory.dmp
memory/3416-17-0x0000000002780000-0x00000000027AA000-memory.dmp
memory/3416-14-0x00000000006B0000-0x0000000000728000-memory.dmp
memory/3416-16-0x0000000002870000-0x0000000002880000-memory.dmp
memory/3416-51-0x00007FF80F340000-0x00007FF80FE01000-memory.dmp
memory/3416-15-0x00007FF80F340000-0x00007FF80FE01000-memory.dmp
memory/3564-50-0x00007FF80F340000-0x00007FF80FE01000-memory.dmp
memory/3564-33-0x000000001AE50000-0x000000001AE60000-memory.dmp
memory/3564-32-0x00007FF80F340000-0x00007FF80FE01000-memory.dmp
memory/3632-71-0x00007FF80F340000-0x00007FF80FE01000-memory.dmp
memory/3632-73-0x00007FF80F340000-0x00007FF80FE01000-memory.dmp
memory/3632-52-0x00007FF80F340000-0x00007FF80FE01000-memory.dmp
memory/4616-196-0x00007FF80F340000-0x00007FF80FE01000-memory.dmp
memory/4616-178-0x000001CA707A0000-0x000001CA707B0000-memory.dmp
memory/4616-166-0x00007FF80F340000-0x00007FF80FE01000-memory.dmp
memory/4616-181-0x000001CA707A0000-0x000001CA707B0000-memory.dmp
memory/4616-135-0x000001CA707A0000-0x000001CA707B0000-memory.dmp