Analysis
-
max time kernel
136s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-03-2024 07:32
Static task
static1
Behavioral task
behavioral1
Sample
b425db5faaff29191253707b4d495278.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b425db5faaff29191253707b4d495278.exe
Resource
win10v2004-20240226-en
General
-
Target
b425db5faaff29191253707b4d495278.exe
-
Size
3.8MB
-
MD5
b425db5faaff29191253707b4d495278
-
SHA1
8c0abed7ec34769df754d0a96c36f304818a13a1
-
SHA256
7c51bf36e62d3094d2854fa3597c42c3cae7adffb3bb30bb95e6f38beff12cbc
-
SHA512
031b0a0e6f7be82792f4bbfebd9b59381317983a9efca3e601062937e67938c20935e98bbe75c35d8354055b8335959a73c87ee32102886d6e16b0dca0774b88
-
SSDEEP
98304:zmgSCO/UvjQwggy1zQjeIwMM46TVI9m6Pg:6gSCOAUw/y1zUewMxI9m6Pg
Malware Config
Extracted
revengerat
NyanCatRevenge
dontreachme.duckdns.org:3601
159ffe7d99124a92baa
Signatures
-
Detect ZGRat V1 33 IoCs
Processes:
resource yara_rule behavioral1/memory/2540-25-0x0000000000A90000-0x0000000000AF0000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-31-0x0000000000A90000-0x0000000000AE9000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-29-0x0000000000A90000-0x0000000000AE9000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-49-0x0000000000A90000-0x0000000000AE9000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-47-0x0000000000A90000-0x0000000000AE9000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-57-0x0000000000A90000-0x0000000000AE9000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-55-0x0000000000A90000-0x0000000000AE9000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-53-0x0000000000A90000-0x0000000000AE9000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-51-0x0000000000A90000-0x0000000000AE9000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-45-0x0000000000A90000-0x0000000000AE9000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-43-0x0000000000A90000-0x0000000000AE9000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-41-0x0000000000A90000-0x0000000000AE9000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-39-0x0000000000A90000-0x0000000000AE9000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-37-0x0000000000A90000-0x0000000000AE9000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-35-0x0000000000A90000-0x0000000000AE9000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-33-0x0000000000A90000-0x0000000000AE9000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-28-0x0000000000A90000-0x0000000000AE9000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-59-0x0000000000A90000-0x0000000000AE9000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-73-0x0000000000A90000-0x0000000000AE9000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-79-0x0000000000A90000-0x0000000000AE9000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-77-0x0000000000A90000-0x0000000000AE9000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-75-0x0000000000A90000-0x0000000000AE9000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-71-0x0000000000A90000-0x0000000000AE9000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-69-0x0000000000A90000-0x0000000000AE9000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-67-0x0000000000A90000-0x0000000000AE9000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-65-0x0000000000A90000-0x0000000000AE9000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-63-0x0000000000A90000-0x0000000000AE9000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-61-0x0000000000A90000-0x0000000000AE9000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-81-0x0000000000A90000-0x0000000000AE9000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-83-0x0000000000A90000-0x0000000000AE9000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-85-0x0000000000A90000-0x0000000000AE9000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-89-0x0000000000A90000-0x0000000000AE9000-memory.dmp family_zgrat_v1 behavioral1/memory/2540-87-0x0000000000A90000-0x0000000000AE9000-memory.dmp family_zgrat_v1 -
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
Oluzklgxzdhvq.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\JavaUpdate\\JavaUpdate.exe\"," Oluzklgxzdhvq.exe -
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Executes dropped EXE 3 IoCs
Processes:
Bvgy.exeOluzklgxzdhvq.exeOluzklgxzdhvq.exepid process 1272 Bvgy.exe 2540 Oluzklgxzdhvq.exe 1652 Oluzklgxzdhvq.exe -
Loads dropped DLL 4 IoCs
Processes:
b425db5faaff29191253707b4d495278.exeOluzklgxzdhvq.exepid process 1228 b425db5faaff29191253707b4d495278.exe 1228 b425db5faaff29191253707b4d495278.exe 2268 2540 Oluzklgxzdhvq.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Oluzklgxzdhvq.exedescription pid process target process PID 2540 set thread context of 1652 2540 Oluzklgxzdhvq.exe Oluzklgxzdhvq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
Oluzklgxzdhvq.exepowershell.exepid process 2540 Oluzklgxzdhvq.exe 2540 Oluzklgxzdhvq.exe 2076 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Oluzklgxzdhvq.exepowershell.exedescription pid process Token: SeDebugPrivilege 2540 Oluzklgxzdhvq.exe Token: SeDebugPrivilege 2076 powershell.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
b425db5faaff29191253707b4d495278.exeOluzklgxzdhvq.exeWScript.exedescription pid process target process PID 1228 wrote to memory of 1272 1228 b425db5faaff29191253707b4d495278.exe Bvgy.exe PID 1228 wrote to memory of 1272 1228 b425db5faaff29191253707b4d495278.exe Bvgy.exe PID 1228 wrote to memory of 1272 1228 b425db5faaff29191253707b4d495278.exe Bvgy.exe PID 1228 wrote to memory of 1272 1228 b425db5faaff29191253707b4d495278.exe Bvgy.exe PID 1228 wrote to memory of 2540 1228 b425db5faaff29191253707b4d495278.exe Oluzklgxzdhvq.exe PID 1228 wrote to memory of 2540 1228 b425db5faaff29191253707b4d495278.exe Oluzklgxzdhvq.exe PID 1228 wrote to memory of 2540 1228 b425db5faaff29191253707b4d495278.exe Oluzklgxzdhvq.exe PID 1228 wrote to memory of 2540 1228 b425db5faaff29191253707b4d495278.exe Oluzklgxzdhvq.exe PID 1228 wrote to memory of 2540 1228 b425db5faaff29191253707b4d495278.exe Oluzklgxzdhvq.exe PID 1228 wrote to memory of 2540 1228 b425db5faaff29191253707b4d495278.exe Oluzklgxzdhvq.exe PID 1228 wrote to memory of 2540 1228 b425db5faaff29191253707b4d495278.exe Oluzklgxzdhvq.exe PID 2540 wrote to memory of 1336 2540 Oluzklgxzdhvq.exe WScript.exe PID 2540 wrote to memory of 1336 2540 Oluzklgxzdhvq.exe WScript.exe PID 2540 wrote to memory of 1336 2540 Oluzklgxzdhvq.exe WScript.exe PID 2540 wrote to memory of 1336 2540 Oluzklgxzdhvq.exe WScript.exe PID 2540 wrote to memory of 1652 2540 Oluzklgxzdhvq.exe Oluzklgxzdhvq.exe PID 2540 wrote to memory of 1652 2540 Oluzklgxzdhvq.exe Oluzklgxzdhvq.exe PID 2540 wrote to memory of 1652 2540 Oluzklgxzdhvq.exe Oluzklgxzdhvq.exe PID 2540 wrote to memory of 1652 2540 Oluzklgxzdhvq.exe Oluzklgxzdhvq.exe PID 2540 wrote to memory of 1652 2540 Oluzklgxzdhvq.exe Oluzklgxzdhvq.exe PID 2540 wrote to memory of 1652 2540 Oluzklgxzdhvq.exe Oluzklgxzdhvq.exe PID 2540 wrote to memory of 1652 2540 Oluzklgxzdhvq.exe Oluzklgxzdhvq.exe PID 2540 wrote to memory of 1652 2540 Oluzklgxzdhvq.exe Oluzklgxzdhvq.exe PID 2540 wrote to memory of 1652 2540 Oluzklgxzdhvq.exe Oluzklgxzdhvq.exe PID 2540 wrote to memory of 1652 2540 Oluzklgxzdhvq.exe Oluzklgxzdhvq.exe PID 2540 wrote to memory of 1652 2540 Oluzklgxzdhvq.exe Oluzklgxzdhvq.exe PID 2540 wrote to memory of 1652 2540 Oluzklgxzdhvq.exe Oluzklgxzdhvq.exe PID 1336 wrote to memory of 2076 1336 WScript.exe powershell.exe PID 1336 wrote to memory of 2076 1336 WScript.exe powershell.exe PID 1336 wrote to memory of 2076 1336 WScript.exe powershell.exe PID 1336 wrote to memory of 2076 1336 WScript.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b425db5faaff29191253707b4d495278.exe"C:\Users\Admin\AppData\Local\Temp\b425db5faaff29191253707b4d495278.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Bvgy.exe"C:\Users\Admin\AppData\Local\Temp\Bvgy.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Oluzklgxzdhvq.exe"C:\Users\Admin\AppData\Local\Temp\Oluzklgxzdhvq.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Vrexfkcar.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Local\JavaUpdate\JavaUpdate.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Oluzklgxzdhvq.exeC:\Users\Admin\AppData\Local\Temp\Oluzklgxzdhvq.exe3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Bvgy.exeFilesize
3.5MB
MD59b32753bd0df3b550385c4afad000028
SHA126ec9e2f5d3d40dfe3bed8660cf64c7ade38297d
SHA2568a07295eb72d0a52277aaaf626115bd9121179e9d2dbf9881a665ecf49742e3d
SHA512dd35d177386da94c0ce1dc3d569b4875457acb27003b5d0b8af4fbf93b9dcbf4e8cf252aed62aff4828939cac8b2fdadf622dbb7f985e448b735538b270567b2
-
C:\Users\Admin\AppData\Local\Temp\_Vrexfkcar.vbsFilesize
149B
MD575fda8189e60e05655aea55fe68591c0
SHA1de2177e12403c59f81d278497a387089ddd10d73
SHA256cf8322af201e7b0f5d5b2b93c0df541c8785436ebdf04a32addc46b13caf81c5
SHA5121bc581cbe6ba2f7f9a419bdb9b582ec5585d5cdfd8e245cab19c269d2bd4ecbc151cd98996b8d5f330304fda243c4a13388f1c601111dbab59fd0ad35e5ea647
-
\Users\Admin\AppData\Local\Temp\Oluzklgxzdhvq.exeFilesize
297KB
MD55618d560bdd22ec94586f13054864452
SHA1381035c90dc989bfc9786f8eff094df945b2f6fe
SHA256ade2df768c229a40f6d4d7da23593ac53ab6d5e35b7f936cbcb01bf3569065ca
SHA5128bcd0952421b770346bd149b89b70ae0120050a96491010dfe899cd961623d2328ddfde28c5edca3a2f9e9c326e6a2c35f8436a76e9820d79b9ff6490abe8dd7
-
memory/1228-1-0x0000000074600000-0x0000000074CEE000-memory.dmpFilesize
6.9MB
-
memory/1228-0-0x0000000000400000-0x00000000007CA000-memory.dmpFilesize
3.8MB
-
memory/1228-2-0x0000000004DE0000-0x0000000004E20000-memory.dmpFilesize
256KB
-
memory/1228-10-0x0000000008930000-0x0000000009337000-memory.dmpFilesize
10.0MB
-
memory/1228-21-0x0000000074600000-0x0000000074CEE000-memory.dmpFilesize
6.9MB
-
memory/1272-11-0x000000013F240000-0x000000013FC47000-memory.dmpFilesize
10.0MB
-
memory/1272-22-0x000000013F240000-0x000000013FC47000-memory.dmpFilesize
10.0MB
-
memory/1652-1638-0x0000000000A60000-0x0000000000AA0000-memory.dmpFilesize
256KB
-
memory/1652-1637-0x0000000074600000-0x0000000074CEE000-memory.dmpFilesize
6.9MB
-
memory/1652-1629-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1652-1628-0x0000000074600000-0x0000000074CEE000-memory.dmpFilesize
6.9MB
-
memory/2076-1636-0x0000000070A80000-0x000000007102B000-memory.dmpFilesize
5.7MB
-
memory/2076-1635-0x0000000001D30000-0x0000000001D70000-memory.dmpFilesize
256KB
-
memory/2076-1634-0x0000000001D30000-0x0000000001D70000-memory.dmpFilesize
256KB
-
memory/2076-1633-0x0000000070A80000-0x000000007102B000-memory.dmpFilesize
5.7MB
-
memory/2076-1632-0x0000000070A80000-0x000000007102B000-memory.dmpFilesize
5.7MB
-
memory/2540-37-0x0000000000A90000-0x0000000000AE9000-memory.dmpFilesize
356KB
-
memory/2540-69-0x0000000000A90000-0x0000000000AE9000-memory.dmpFilesize
356KB
-
memory/2540-47-0x0000000000A90000-0x0000000000AE9000-memory.dmpFilesize
356KB
-
memory/2540-57-0x0000000000A90000-0x0000000000AE9000-memory.dmpFilesize
356KB
-
memory/2540-55-0x0000000000A90000-0x0000000000AE9000-memory.dmpFilesize
356KB
-
memory/2540-53-0x0000000000A90000-0x0000000000AE9000-memory.dmpFilesize
356KB
-
memory/2540-51-0x0000000000A90000-0x0000000000AE9000-memory.dmpFilesize
356KB
-
memory/2540-45-0x0000000000A90000-0x0000000000AE9000-memory.dmpFilesize
356KB
-
memory/2540-43-0x0000000000A90000-0x0000000000AE9000-memory.dmpFilesize
356KB
-
memory/2540-41-0x0000000000A90000-0x0000000000AE9000-memory.dmpFilesize
356KB
-
memory/2540-39-0x0000000000A90000-0x0000000000AE9000-memory.dmpFilesize
356KB
-
memory/2540-29-0x0000000000A90000-0x0000000000AE9000-memory.dmpFilesize
356KB
-
memory/2540-35-0x0000000000A90000-0x0000000000AE9000-memory.dmpFilesize
356KB
-
memory/2540-33-0x0000000000A90000-0x0000000000AE9000-memory.dmpFilesize
356KB
-
memory/2540-28-0x0000000000A90000-0x0000000000AE9000-memory.dmpFilesize
356KB
-
memory/2540-59-0x0000000000A90000-0x0000000000AE9000-memory.dmpFilesize
356KB
-
memory/2540-73-0x0000000000A90000-0x0000000000AE9000-memory.dmpFilesize
356KB
-
memory/2540-79-0x0000000000A90000-0x0000000000AE9000-memory.dmpFilesize
356KB
-
memory/2540-77-0x0000000000A90000-0x0000000000AE9000-memory.dmpFilesize
356KB
-
memory/2540-75-0x0000000000A90000-0x0000000000AE9000-memory.dmpFilesize
356KB
-
memory/2540-71-0x0000000000A90000-0x0000000000AE9000-memory.dmpFilesize
356KB
-
memory/2540-49-0x0000000000A90000-0x0000000000AE9000-memory.dmpFilesize
356KB
-
memory/2540-67-0x0000000000A90000-0x0000000000AE9000-memory.dmpFilesize
356KB
-
memory/2540-65-0x0000000000A90000-0x0000000000AE9000-memory.dmpFilesize
356KB
-
memory/2540-63-0x0000000000A90000-0x0000000000AE9000-memory.dmpFilesize
356KB
-
memory/2540-61-0x0000000000A90000-0x0000000000AE9000-memory.dmpFilesize
356KB
-
memory/2540-81-0x0000000000A90000-0x0000000000AE9000-memory.dmpFilesize
356KB
-
memory/2540-83-0x0000000000A90000-0x0000000000AE9000-memory.dmpFilesize
356KB
-
memory/2540-85-0x0000000000A90000-0x0000000000AE9000-memory.dmpFilesize
356KB
-
memory/2540-89-0x0000000000A90000-0x0000000000AE9000-memory.dmpFilesize
356KB
-
memory/2540-87-0x0000000000A90000-0x0000000000AE9000-memory.dmpFilesize
356KB
-
memory/2540-1604-0x0000000004F70000-0x0000000004FB0000-memory.dmpFilesize
256KB
-
memory/2540-1627-0x0000000074600000-0x0000000074CEE000-memory.dmpFilesize
6.9MB
-
memory/2540-31-0x0000000000A90000-0x0000000000AE9000-memory.dmpFilesize
356KB
-
memory/2540-27-0x0000000004F70000-0x0000000004FB0000-memory.dmpFilesize
256KB
-
memory/2540-26-0x0000000004F70000-0x0000000004FB0000-memory.dmpFilesize
256KB
-
memory/2540-25-0x0000000000A90000-0x0000000000AF0000-memory.dmpFilesize
384KB
-
memory/2540-24-0x0000000000520000-0x000000000055C000-memory.dmpFilesize
240KB
-
memory/2540-23-0x0000000074600000-0x0000000074CEE000-memory.dmpFilesize
6.9MB
-
memory/2540-20-0x0000000004F70000-0x0000000004FB0000-memory.dmpFilesize
256KB
-
memory/2540-19-0x0000000074600000-0x0000000074CEE000-memory.dmpFilesize
6.9MB
-
memory/2540-18-0x0000000000F10000-0x0000000000F60000-memory.dmpFilesize
320KB