Analysis
-
max time kernel
126s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-03-2024 14:48
Static task
static1
Behavioral task
behavioral1
Sample
bee0b629d62b22ded860f4b4b727aa82.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bee0b629d62b22ded860f4b4b727aa82.exe
Resource
win10v2004-20240226-en
General
-
Target
bee0b629d62b22ded860f4b4b727aa82.exe
-
Size
336KB
-
MD5
bee0b629d62b22ded860f4b4b727aa82
-
SHA1
41dfd94bb6fc44517b8bf54f0df18f75d6532ffa
-
SHA256
14a5d98a762dc78113a0a642820b7fa2fc7ff86805d1dcc1d05230de717124d2
-
SHA512
4fd5aa0fe69133a045e62b88adb301f07436f1275cdfa14d2bf97ece74f8104c67103421a16edad8b9964669f6ff6fefa24e4a06c5f147f3cc0d4b2350f090e8
-
SSDEEP
6144:kJRMksaJX+krFD+4taWKQRO3ORNeHEhmI0fEJI5IXJbeT/PhBSY:SMkT5+krFDar7MmI0fEJdaT/PhsY
Malware Config
Extracted
revengerat
NyanCatRevenge
dontreachme.duckdns.org:3602
774d753e6b8d42
Signatures
-
Detect ZGRat V1 34 IoCs
Processes:
resource yara_rule behavioral1/memory/1284-4-0x0000000004D80000-0x0000000004E02000-memory.dmp family_zgrat_v1 behavioral1/memory/1284-6-0x0000000004D80000-0x0000000004DFC000-memory.dmp family_zgrat_v1 behavioral1/memory/1284-11-0x0000000004D80000-0x0000000004DFC000-memory.dmp family_zgrat_v1 behavioral1/memory/1284-17-0x0000000004D80000-0x0000000004DFC000-memory.dmp family_zgrat_v1 behavioral1/memory/1284-25-0x0000000004D80000-0x0000000004DFC000-memory.dmp family_zgrat_v1 behavioral1/memory/1284-31-0x0000000004D80000-0x0000000004DFC000-memory.dmp family_zgrat_v1 behavioral1/memory/1284-33-0x0000000004D80000-0x0000000004DFC000-memory.dmp family_zgrat_v1 behavioral1/memory/1284-29-0x0000000004D80000-0x0000000004DFC000-memory.dmp family_zgrat_v1 behavioral1/memory/1284-27-0x0000000004D80000-0x0000000004DFC000-memory.dmp family_zgrat_v1 behavioral1/memory/1284-23-0x0000000004D80000-0x0000000004DFC000-memory.dmp family_zgrat_v1 behavioral1/memory/1284-35-0x0000000004D80000-0x0000000004DFC000-memory.dmp family_zgrat_v1 behavioral1/memory/1284-21-0x0000000004D80000-0x0000000004DFC000-memory.dmp family_zgrat_v1 behavioral1/memory/1284-39-0x0000000004D80000-0x0000000004DFC000-memory.dmp family_zgrat_v1 behavioral1/memory/1284-41-0x0000000004D80000-0x0000000004DFC000-memory.dmp family_zgrat_v1 behavioral1/memory/1284-43-0x0000000004D80000-0x0000000004DFC000-memory.dmp family_zgrat_v1 behavioral1/memory/1284-49-0x0000000004D80000-0x0000000004DFC000-memory.dmp family_zgrat_v1 behavioral1/memory/1284-51-0x0000000004D80000-0x0000000004DFC000-memory.dmp family_zgrat_v1 behavioral1/memory/1284-53-0x0000000004D80000-0x0000000004DFC000-memory.dmp family_zgrat_v1 behavioral1/memory/1284-55-0x0000000004D80000-0x0000000004DFC000-memory.dmp family_zgrat_v1 behavioral1/memory/1284-59-0x0000000004D80000-0x0000000004DFC000-memory.dmp family_zgrat_v1 behavioral1/memory/1284-57-0x0000000004D80000-0x0000000004DFC000-memory.dmp family_zgrat_v1 behavioral1/memory/1284-47-0x0000000004D80000-0x0000000004DFC000-memory.dmp family_zgrat_v1 behavioral1/memory/1284-45-0x0000000004D80000-0x0000000004DFC000-memory.dmp family_zgrat_v1 behavioral1/memory/1284-61-0x0000000004D80000-0x0000000004DFC000-memory.dmp family_zgrat_v1 behavioral1/memory/1284-63-0x0000000004D80000-0x0000000004DFC000-memory.dmp family_zgrat_v1 behavioral1/memory/1284-67-0x0000000004D80000-0x0000000004DFC000-memory.dmp family_zgrat_v1 behavioral1/memory/1284-69-0x0000000004D80000-0x0000000004DFC000-memory.dmp family_zgrat_v1 behavioral1/memory/1284-65-0x0000000004D80000-0x0000000004DFC000-memory.dmp family_zgrat_v1 behavioral1/memory/1284-37-0x0000000004D80000-0x0000000004DFC000-memory.dmp family_zgrat_v1 behavioral1/memory/1284-19-0x0000000004D80000-0x0000000004DFC000-memory.dmp family_zgrat_v1 behavioral1/memory/1284-15-0x0000000004D80000-0x0000000004DFC000-memory.dmp family_zgrat_v1 behavioral1/memory/1284-13-0x0000000004D80000-0x0000000004DFC000-memory.dmp family_zgrat_v1 behavioral1/memory/1284-9-0x0000000004D80000-0x0000000004DFC000-memory.dmp family_zgrat_v1 behavioral1/memory/1284-7-0x0000000004D80000-0x0000000004DFC000-memory.dmp family_zgrat_v1 -
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
bee0b629d62b22ded860f4b4b727aa82.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Services = "\"C:\\Users\\Admin\\AppData\\Local\\svchost\\Services.exe\"" bee0b629d62b22ded860f4b4b727aa82.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
bee0b629d62b22ded860f4b4b727aa82.exedescription pid process target process PID 1284 set thread context of 2980 1284 bee0b629d62b22ded860f4b4b727aa82.exe bee0b629d62b22ded860f4b4b727aa82.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
bee0b629d62b22ded860f4b4b727aa82.exepowershell.exepid process 1284 bee0b629d62b22ded860f4b4b727aa82.exe 1284 bee0b629d62b22ded860f4b4b727aa82.exe 1284 bee0b629d62b22ded860f4b4b727aa82.exe 1284 bee0b629d62b22ded860f4b4b727aa82.exe 2024 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
bee0b629d62b22ded860f4b4b727aa82.exepowershell.exedescription pid process Token: SeDebugPrivilege 1284 bee0b629d62b22ded860f4b4b727aa82.exe Token: SeDebugPrivilege 2024 powershell.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
bee0b629d62b22ded860f4b4b727aa82.exeWScript.exedescription pid process target process PID 1284 wrote to memory of 2968 1284 bee0b629d62b22ded860f4b4b727aa82.exe WScript.exe PID 1284 wrote to memory of 2968 1284 bee0b629d62b22ded860f4b4b727aa82.exe WScript.exe PID 1284 wrote to memory of 2968 1284 bee0b629d62b22ded860f4b4b727aa82.exe WScript.exe PID 1284 wrote to memory of 2968 1284 bee0b629d62b22ded860f4b4b727aa82.exe WScript.exe PID 1284 wrote to memory of 2980 1284 bee0b629d62b22ded860f4b4b727aa82.exe bee0b629d62b22ded860f4b4b727aa82.exe PID 1284 wrote to memory of 2980 1284 bee0b629d62b22ded860f4b4b727aa82.exe bee0b629d62b22ded860f4b4b727aa82.exe PID 1284 wrote to memory of 2980 1284 bee0b629d62b22ded860f4b4b727aa82.exe bee0b629d62b22ded860f4b4b727aa82.exe PID 1284 wrote to memory of 2980 1284 bee0b629d62b22ded860f4b4b727aa82.exe bee0b629d62b22ded860f4b4b727aa82.exe PID 1284 wrote to memory of 2980 1284 bee0b629d62b22ded860f4b4b727aa82.exe bee0b629d62b22ded860f4b4b727aa82.exe PID 1284 wrote to memory of 2980 1284 bee0b629d62b22ded860f4b4b727aa82.exe bee0b629d62b22ded860f4b4b727aa82.exe PID 1284 wrote to memory of 2980 1284 bee0b629d62b22ded860f4b4b727aa82.exe bee0b629d62b22ded860f4b4b727aa82.exe PID 1284 wrote to memory of 2980 1284 bee0b629d62b22ded860f4b4b727aa82.exe bee0b629d62b22ded860f4b4b727aa82.exe PID 1284 wrote to memory of 2980 1284 bee0b629d62b22ded860f4b4b727aa82.exe bee0b629d62b22ded860f4b4b727aa82.exe PID 1284 wrote to memory of 2980 1284 bee0b629d62b22ded860f4b4b727aa82.exe bee0b629d62b22ded860f4b4b727aa82.exe PID 1284 wrote to memory of 2980 1284 bee0b629d62b22ded860f4b4b727aa82.exe bee0b629d62b22ded860f4b4b727aa82.exe PID 1284 wrote to memory of 2980 1284 bee0b629d62b22ded860f4b4b727aa82.exe bee0b629d62b22ded860f4b4b727aa82.exe PID 2968 wrote to memory of 2024 2968 WScript.exe powershell.exe PID 2968 wrote to memory of 2024 2968 WScript.exe powershell.exe PID 2968 wrote to memory of 2024 2968 WScript.exe powershell.exe PID 2968 wrote to memory of 2024 2968 WScript.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bee0b629d62b22ded860f4b4b727aa82.exe"C:\Users\Admin\AppData\Local\Temp\bee0b629d62b22ded860f4b4b727aa82.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Vgxhnhj.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Local\svchost\Services.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\bee0b629d62b22ded860f4b4b727aa82.exeC:\Users\Admin\AppData\Local\Temp\bee0b629d62b22ded860f4b4b727aa82.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_Vgxhnhj.vbsFilesize
144B
MD57bb2b51c1da92c48a49ceb6cf0b7d733
SHA1c269c09621dc5e6a0e26a457ed8fcc3eacd7d13b
SHA256b30811a023ecaa08ac8ce3ebef5984221bb853ea64fe09caac7e713fe4642b3f
SHA512623963b5fd47d359e6d4f5fda1fb1fb6e24602f2e6d1e1c94eeda4413a9e41b34c9dc8a30dab901c36f1a44d2433c72c32e34cf4b5a4f295aed94332cd845a8d
-
memory/1284-1-0x0000000073DE0000-0x00000000744CE000-memory.dmpFilesize
6.9MB
-
memory/1284-0-0x0000000000180000-0x00000000001D8000-memory.dmpFilesize
352KB
-
memory/1284-2-0x0000000004A20000-0x0000000004A60000-memory.dmpFilesize
256KB
-
memory/1284-3-0x0000000000520000-0x000000000056E000-memory.dmpFilesize
312KB
-
memory/1284-4-0x0000000004D80000-0x0000000004E02000-memory.dmpFilesize
520KB
-
memory/1284-5-0x0000000073DE0000-0x00000000744CE000-memory.dmpFilesize
6.9MB
-
memory/1284-6-0x0000000004D80000-0x0000000004DFC000-memory.dmpFilesize
496KB
-
memory/1284-11-0x0000000004D80000-0x0000000004DFC000-memory.dmpFilesize
496KB
-
memory/1284-17-0x0000000004D80000-0x0000000004DFC000-memory.dmpFilesize
496KB
-
memory/1284-25-0x0000000004D80000-0x0000000004DFC000-memory.dmpFilesize
496KB
-
memory/1284-31-0x0000000004D80000-0x0000000004DFC000-memory.dmpFilesize
496KB
-
memory/1284-33-0x0000000004D80000-0x0000000004DFC000-memory.dmpFilesize
496KB
-
memory/1284-29-0x0000000004D80000-0x0000000004DFC000-memory.dmpFilesize
496KB
-
memory/1284-27-0x0000000004D80000-0x0000000004DFC000-memory.dmpFilesize
496KB
-
memory/1284-23-0x0000000004D80000-0x0000000004DFC000-memory.dmpFilesize
496KB
-
memory/1284-35-0x0000000004D80000-0x0000000004DFC000-memory.dmpFilesize
496KB
-
memory/1284-21-0x0000000004D80000-0x0000000004DFC000-memory.dmpFilesize
496KB
-
memory/1284-39-0x0000000004D80000-0x0000000004DFC000-memory.dmpFilesize
496KB
-
memory/1284-41-0x0000000004D80000-0x0000000004DFC000-memory.dmpFilesize
496KB
-
memory/1284-43-0x0000000004D80000-0x0000000004DFC000-memory.dmpFilesize
496KB
-
memory/1284-49-0x0000000004D80000-0x0000000004DFC000-memory.dmpFilesize
496KB
-
memory/1284-51-0x0000000004D80000-0x0000000004DFC000-memory.dmpFilesize
496KB
-
memory/1284-53-0x0000000004D80000-0x0000000004DFC000-memory.dmpFilesize
496KB
-
memory/1284-55-0x0000000004D80000-0x0000000004DFC000-memory.dmpFilesize
496KB
-
memory/1284-59-0x0000000004D80000-0x0000000004DFC000-memory.dmpFilesize
496KB
-
memory/1284-57-0x0000000004D80000-0x0000000004DFC000-memory.dmpFilesize
496KB
-
memory/1284-47-0x0000000004D80000-0x0000000004DFC000-memory.dmpFilesize
496KB
-
memory/1284-45-0x0000000004D80000-0x0000000004DFC000-memory.dmpFilesize
496KB
-
memory/1284-61-0x0000000004D80000-0x0000000004DFC000-memory.dmpFilesize
496KB
-
memory/1284-63-0x0000000004D80000-0x0000000004DFC000-memory.dmpFilesize
496KB
-
memory/1284-67-0x0000000004D80000-0x0000000004DFC000-memory.dmpFilesize
496KB
-
memory/1284-69-0x0000000004D80000-0x0000000004DFC000-memory.dmpFilesize
496KB
-
memory/1284-65-0x0000000004D80000-0x0000000004DFC000-memory.dmpFilesize
496KB
-
memory/1284-37-0x0000000004D80000-0x0000000004DFC000-memory.dmpFilesize
496KB
-
memory/1284-19-0x0000000004D80000-0x0000000004DFC000-memory.dmpFilesize
496KB
-
memory/1284-15-0x0000000004D80000-0x0000000004DFC000-memory.dmpFilesize
496KB
-
memory/1284-13-0x0000000004D80000-0x0000000004DFC000-memory.dmpFilesize
496KB
-
memory/1284-9-0x0000000004D80000-0x0000000004DFC000-memory.dmpFilesize
496KB
-
memory/1284-7-0x0000000004D80000-0x0000000004DFC000-memory.dmpFilesize
496KB
-
memory/1284-2504-0x0000000073DE0000-0x00000000744CE000-memory.dmpFilesize
6.9MB
-
memory/2024-2507-0x00000000700B0000-0x000000007065B000-memory.dmpFilesize
5.7MB
-
memory/2024-2508-0x00000000700B0000-0x000000007065B000-memory.dmpFilesize
5.7MB
-
memory/2024-2511-0x00000000024E0000-0x0000000002520000-memory.dmpFilesize
256KB
-
memory/2024-2510-0x00000000024E0000-0x0000000002520000-memory.dmpFilesize
256KB
-
memory/2024-2509-0x00000000024E0000-0x0000000002520000-memory.dmpFilesize
256KB
-
memory/2024-2513-0x00000000700B0000-0x000000007065B000-memory.dmpFilesize
5.7MB
-
memory/2980-2503-0x0000000073DE0000-0x00000000744CE000-memory.dmpFilesize
6.9MB
-
memory/2980-2502-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2980-2512-0x0000000004B90000-0x0000000004BD0000-memory.dmpFilesize
256KB
-
memory/2980-2514-0x0000000073DE0000-0x00000000744CE000-memory.dmpFilesize
6.9MB