Analysis
-
max time kernel
143s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10-03-2024 14:48
Static task
static1
Behavioral task
behavioral1
Sample
bee0b629d62b22ded860f4b4b727aa82.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bee0b629d62b22ded860f4b4b727aa82.exe
Resource
win10v2004-20240226-en
General
-
Target
bee0b629d62b22ded860f4b4b727aa82.exe
-
Size
336KB
-
MD5
bee0b629d62b22ded860f4b4b727aa82
-
SHA1
41dfd94bb6fc44517b8bf54f0df18f75d6532ffa
-
SHA256
14a5d98a762dc78113a0a642820b7fa2fc7ff86805d1dcc1d05230de717124d2
-
SHA512
4fd5aa0fe69133a045e62b88adb301f07436f1275cdfa14d2bf97ece74f8104c67103421a16edad8b9964669f6ff6fefa24e4a06c5f147f3cc0d4b2350f090e8
-
SSDEEP
6144:kJRMksaJX+krFD+4taWKQRO3ORNeHEhmI0fEJI5IXJbeT/PhBSY:SMkT5+krFDar7MmI0fEJdaT/PhsY
Malware Config
Extracted
revengerat
NyanCatRevenge
dontreachme.duckdns.org:3602
774d753e6b8d42
Signatures
-
Detect ZGRat V1 34 IoCs
Processes:
resource yara_rule behavioral2/memory/3488-8-0x0000000006B70000-0x0000000006BF2000-memory.dmp family_zgrat_v1 behavioral2/memory/3488-9-0x0000000006B70000-0x0000000006BEC000-memory.dmp family_zgrat_v1 behavioral2/memory/3488-10-0x0000000006B70000-0x0000000006BEC000-memory.dmp family_zgrat_v1 behavioral2/memory/3488-12-0x0000000006B70000-0x0000000006BEC000-memory.dmp family_zgrat_v1 behavioral2/memory/3488-14-0x0000000006B70000-0x0000000006BEC000-memory.dmp family_zgrat_v1 behavioral2/memory/3488-16-0x0000000006B70000-0x0000000006BEC000-memory.dmp family_zgrat_v1 behavioral2/memory/3488-18-0x0000000006B70000-0x0000000006BEC000-memory.dmp family_zgrat_v1 behavioral2/memory/3488-20-0x0000000006B70000-0x0000000006BEC000-memory.dmp family_zgrat_v1 behavioral2/memory/3488-22-0x0000000006B70000-0x0000000006BEC000-memory.dmp family_zgrat_v1 behavioral2/memory/3488-24-0x0000000006B70000-0x0000000006BEC000-memory.dmp family_zgrat_v1 behavioral2/memory/3488-26-0x0000000006B70000-0x0000000006BEC000-memory.dmp family_zgrat_v1 behavioral2/memory/3488-28-0x0000000006B70000-0x0000000006BEC000-memory.dmp family_zgrat_v1 behavioral2/memory/3488-30-0x0000000006B70000-0x0000000006BEC000-memory.dmp family_zgrat_v1 behavioral2/memory/3488-32-0x0000000006B70000-0x0000000006BEC000-memory.dmp family_zgrat_v1 behavioral2/memory/3488-35-0x0000000006B70000-0x0000000006BEC000-memory.dmp family_zgrat_v1 behavioral2/memory/3488-37-0x0000000006B70000-0x0000000006BEC000-memory.dmp family_zgrat_v1 behavioral2/memory/3488-39-0x0000000006B70000-0x0000000006BEC000-memory.dmp family_zgrat_v1 behavioral2/memory/3488-41-0x0000000006B70000-0x0000000006BEC000-memory.dmp family_zgrat_v1 behavioral2/memory/3488-43-0x0000000006B70000-0x0000000006BEC000-memory.dmp family_zgrat_v1 behavioral2/memory/3488-47-0x0000000006B70000-0x0000000006BEC000-memory.dmp family_zgrat_v1 behavioral2/memory/3488-49-0x0000000006B70000-0x0000000006BEC000-memory.dmp family_zgrat_v1 behavioral2/memory/3488-45-0x0000000006B70000-0x0000000006BEC000-memory.dmp family_zgrat_v1 behavioral2/memory/3488-51-0x0000000006B70000-0x0000000006BEC000-memory.dmp family_zgrat_v1 behavioral2/memory/3488-55-0x0000000006B70000-0x0000000006BEC000-memory.dmp family_zgrat_v1 behavioral2/memory/3488-53-0x0000000006B70000-0x0000000006BEC000-memory.dmp family_zgrat_v1 behavioral2/memory/3488-57-0x0000000006B70000-0x0000000006BEC000-memory.dmp family_zgrat_v1 behavioral2/memory/3488-61-0x0000000006B70000-0x0000000006BEC000-memory.dmp family_zgrat_v1 behavioral2/memory/3488-63-0x0000000006B70000-0x0000000006BEC000-memory.dmp family_zgrat_v1 behavioral2/memory/3488-65-0x0000000006B70000-0x0000000006BEC000-memory.dmp family_zgrat_v1 behavioral2/memory/3488-59-0x0000000006B70000-0x0000000006BEC000-memory.dmp family_zgrat_v1 behavioral2/memory/3488-67-0x0000000006B70000-0x0000000006BEC000-memory.dmp family_zgrat_v1 behavioral2/memory/3488-69-0x0000000006B70000-0x0000000006BEC000-memory.dmp family_zgrat_v1 behavioral2/memory/3488-71-0x0000000006B70000-0x0000000006BEC000-memory.dmp family_zgrat_v1 behavioral2/memory/3488-73-0x0000000006B70000-0x0000000006BEC000-memory.dmp family_zgrat_v1 -
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
bee0b629d62b22ded860f4b4b727aa82.exeWScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation bee0b629d62b22ded860f4b4b727aa82.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation WScript.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
bee0b629d62b22ded860f4b4b727aa82.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Services = "\"C:\\Users\\Admin\\AppData\\Local\\svchost\\Services.exe\"" bee0b629d62b22ded860f4b4b727aa82.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
bee0b629d62b22ded860f4b4b727aa82.exedescription pid process target process PID 3488 set thread context of 2728 3488 bee0b629d62b22ded860f4b4b727aa82.exe bee0b629d62b22ded860f4b4b727aa82.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
bee0b629d62b22ded860f4b4b727aa82.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings bee0b629d62b22ded860f4b4b727aa82.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
bee0b629d62b22ded860f4b4b727aa82.exepowershell.exepid process 3488 bee0b629d62b22ded860f4b4b727aa82.exe 3488 bee0b629d62b22ded860f4b4b727aa82.exe 3488 bee0b629d62b22ded860f4b4b727aa82.exe 3488 bee0b629d62b22ded860f4b4b727aa82.exe 3488 bee0b629d62b22ded860f4b4b727aa82.exe 3488 bee0b629d62b22ded860f4b4b727aa82.exe 3488 bee0b629d62b22ded860f4b4b727aa82.exe 3488 bee0b629d62b22ded860f4b4b727aa82.exe 3488 bee0b629d62b22ded860f4b4b727aa82.exe 3488 bee0b629d62b22ded860f4b4b727aa82.exe 3488 bee0b629d62b22ded860f4b4b727aa82.exe 3488 bee0b629d62b22ded860f4b4b727aa82.exe 3488 bee0b629d62b22ded860f4b4b727aa82.exe 3488 bee0b629d62b22ded860f4b4b727aa82.exe 3488 bee0b629d62b22ded860f4b4b727aa82.exe 3488 bee0b629d62b22ded860f4b4b727aa82.exe 3488 bee0b629d62b22ded860f4b4b727aa82.exe 3488 bee0b629d62b22ded860f4b4b727aa82.exe 3488 bee0b629d62b22ded860f4b4b727aa82.exe 3488 bee0b629d62b22ded860f4b4b727aa82.exe 3488 bee0b629d62b22ded860f4b4b727aa82.exe 3488 bee0b629d62b22ded860f4b4b727aa82.exe 3488 bee0b629d62b22ded860f4b4b727aa82.exe 3488 bee0b629d62b22ded860f4b4b727aa82.exe 936 powershell.exe 936 powershell.exe 936 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
bee0b629d62b22ded860f4b4b727aa82.exepowershell.exedescription pid process Token: SeDebugPrivilege 3488 bee0b629d62b22ded860f4b4b727aa82.exe Token: SeDebugPrivilege 936 powershell.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
bee0b629d62b22ded860f4b4b727aa82.exeWScript.exedescription pid process target process PID 3488 wrote to memory of 3920 3488 bee0b629d62b22ded860f4b4b727aa82.exe WScript.exe PID 3488 wrote to memory of 3920 3488 bee0b629d62b22ded860f4b4b727aa82.exe WScript.exe PID 3488 wrote to memory of 3920 3488 bee0b629d62b22ded860f4b4b727aa82.exe WScript.exe PID 3488 wrote to memory of 2728 3488 bee0b629d62b22ded860f4b4b727aa82.exe bee0b629d62b22ded860f4b4b727aa82.exe PID 3488 wrote to memory of 2728 3488 bee0b629d62b22ded860f4b4b727aa82.exe bee0b629d62b22ded860f4b4b727aa82.exe PID 3488 wrote to memory of 2728 3488 bee0b629d62b22ded860f4b4b727aa82.exe bee0b629d62b22ded860f4b4b727aa82.exe PID 3488 wrote to memory of 2728 3488 bee0b629d62b22ded860f4b4b727aa82.exe bee0b629d62b22ded860f4b4b727aa82.exe PID 3488 wrote to memory of 2728 3488 bee0b629d62b22ded860f4b4b727aa82.exe bee0b629d62b22ded860f4b4b727aa82.exe PID 3488 wrote to memory of 2728 3488 bee0b629d62b22ded860f4b4b727aa82.exe bee0b629d62b22ded860f4b4b727aa82.exe PID 3488 wrote to memory of 2728 3488 bee0b629d62b22ded860f4b4b727aa82.exe bee0b629d62b22ded860f4b4b727aa82.exe PID 3488 wrote to memory of 2728 3488 bee0b629d62b22ded860f4b4b727aa82.exe bee0b629d62b22ded860f4b4b727aa82.exe PID 3920 wrote to memory of 936 3920 WScript.exe powershell.exe PID 3920 wrote to memory of 936 3920 WScript.exe powershell.exe PID 3920 wrote to memory of 936 3920 WScript.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bee0b629d62b22ded860f4b4b727aa82.exe"C:\Users\Admin\AppData\Local\Temp\bee0b629d62b22ded860f4b4b727aa82.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Vgxhnhj.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Local\svchost\Services.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\bee0b629d62b22ded860f4b4b727aa82.exeC:\Users\Admin\AppData\Local\Temp\bee0b629d62b22ded860f4b4b727aa82.exe2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_Vgxhnhj.vbsFilesize
144B
MD57bb2b51c1da92c48a49ceb6cf0b7d733
SHA1c269c09621dc5e6a0e26a457ed8fcc3eacd7d13b
SHA256b30811a023ecaa08ac8ce3ebef5984221bb853ea64fe09caac7e713fe4642b3f
SHA512623963b5fd47d359e6d4f5fda1fb1fb6e24602f2e6d1e1c94eeda4413a9e41b34c9dc8a30dab901c36f1a44d2433c72c32e34cf4b5a4f295aed94332cd845a8d
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r4iqchb0.zs3.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/936-2541-0x0000000007260000-0x000000000726E000-memory.dmpFilesize
56KB
-
memory/936-2501-0x0000000004740000-0x0000000004776000-memory.dmpFilesize
216KB
-
memory/936-2545-0x00000000072B0000-0x00000000072B8000-memory.dmpFilesize
32KB
-
memory/936-2544-0x0000000007370000-0x000000000738A000-memory.dmpFilesize
104KB
-
memory/936-2543-0x0000000007270000-0x0000000007284000-memory.dmpFilesize
80KB
-
memory/936-2524-0x0000000070270000-0x00000000702BC000-memory.dmpFilesize
304KB
-
memory/936-2522-0x000000007F0D0000-0x000000007F0E0000-memory.dmpFilesize
64KB
-
memory/936-2540-0x0000000007230000-0x0000000007241000-memory.dmpFilesize
68KB
-
memory/936-2539-0x00000000072D0000-0x0000000007366000-memory.dmpFilesize
600KB
-
memory/936-2538-0x00000000070A0000-0x00000000070AA000-memory.dmpFilesize
40KB
-
memory/936-2537-0x0000000007030000-0x000000000704A000-memory.dmpFilesize
104KB
-
memory/936-2536-0x0000000007670000-0x0000000007CEA000-memory.dmpFilesize
6.5MB
-
memory/936-2535-0x0000000006F10000-0x0000000006FB3000-memory.dmpFilesize
652KB
-
memory/936-2534-0x00000000062C0000-0x00000000062DE000-memory.dmpFilesize
120KB
-
memory/936-2523-0x0000000006CD0000-0x0000000006D02000-memory.dmpFilesize
200KB
-
memory/936-2546-0x00000000744B0000-0x0000000074C60000-memory.dmpFilesize
7.7MB
-
memory/936-2549-0x00000000744B0000-0x0000000074C60000-memory.dmpFilesize
7.7MB
-
memory/936-2521-0x00000000048F0000-0x0000000004900000-memory.dmpFilesize
64KB
-
memory/936-2520-0x0000000005D40000-0x0000000005D8C000-memory.dmpFilesize
304KB
-
memory/936-2518-0x0000000004A50000-0x0000000004A6E000-memory.dmpFilesize
120KB
-
memory/936-2502-0x00000000744B0000-0x0000000074C60000-memory.dmpFilesize
7.7MB
-
memory/936-2517-0x00000000057D0000-0x0000000005B24000-memory.dmpFilesize
3.3MB
-
memory/936-2503-0x00000000048F0000-0x0000000004900000-memory.dmpFilesize
64KB
-
memory/936-2507-0x0000000004EC0000-0x0000000004F26000-memory.dmpFilesize
408KB
-
memory/936-2506-0x0000000004DA0000-0x0000000004DC2000-memory.dmpFilesize
136KB
-
memory/936-2505-0x0000000004F30000-0x0000000005558000-memory.dmpFilesize
6.2MB
-
memory/936-2504-0x00000000048F0000-0x0000000004900000-memory.dmpFilesize
64KB
-
memory/2728-2550-0x0000000005040000-0x0000000005050000-memory.dmpFilesize
64KB
-
memory/2728-2519-0x0000000005040000-0x0000000005050000-memory.dmpFilesize
64KB
-
memory/2728-2497-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2728-2498-0x00000000744B0000-0x0000000074C60000-memory.dmpFilesize
7.7MB
-
memory/2728-2542-0x00000000744B0000-0x0000000074C60000-memory.dmpFilesize
7.7MB
-
memory/3488-28-0x0000000006B70000-0x0000000006BEC000-memory.dmpFilesize
496KB
-
memory/3488-33-0x0000000005480000-0x0000000005490000-memory.dmpFilesize
64KB
-
memory/3488-63-0x0000000006B70000-0x0000000006BEC000-memory.dmpFilesize
496KB
-
memory/3488-65-0x0000000006B70000-0x0000000006BEC000-memory.dmpFilesize
496KB
-
memory/3488-59-0x0000000006B70000-0x0000000006BEC000-memory.dmpFilesize
496KB
-
memory/3488-67-0x0000000006B70000-0x0000000006BEC000-memory.dmpFilesize
496KB
-
memory/3488-69-0x0000000006B70000-0x0000000006BEC000-memory.dmpFilesize
496KB
-
memory/3488-71-0x0000000006B70000-0x0000000006BEC000-memory.dmpFilesize
496KB
-
memory/3488-73-0x0000000006B70000-0x0000000006BEC000-memory.dmpFilesize
496KB
-
memory/3488-2490-0x0000000001210000-0x0000000001276000-memory.dmpFilesize
408KB
-
memory/3488-57-0x0000000006B70000-0x0000000006BEC000-memory.dmpFilesize
496KB
-
memory/3488-53-0x0000000006B70000-0x0000000006BEC000-memory.dmpFilesize
496KB
-
memory/3488-55-0x0000000006B70000-0x0000000006BEC000-memory.dmpFilesize
496KB
-
memory/3488-2500-0x00000000744B0000-0x0000000074C60000-memory.dmpFilesize
7.7MB
-
memory/3488-51-0x0000000006B70000-0x0000000006BEC000-memory.dmpFilesize
496KB
-
memory/3488-45-0x0000000006B70000-0x0000000006BEC000-memory.dmpFilesize
496KB
-
memory/3488-49-0x0000000006B70000-0x0000000006BEC000-memory.dmpFilesize
496KB
-
memory/3488-47-0x0000000006B70000-0x0000000006BEC000-memory.dmpFilesize
496KB
-
memory/3488-43-0x0000000006B70000-0x0000000006BEC000-memory.dmpFilesize
496KB
-
memory/3488-41-0x0000000006B70000-0x0000000006BEC000-memory.dmpFilesize
496KB
-
memory/3488-39-0x0000000006B70000-0x0000000006BEC000-memory.dmpFilesize
496KB
-
memory/3488-37-0x0000000006B70000-0x0000000006BEC000-memory.dmpFilesize
496KB
-
memory/3488-35-0x0000000006B70000-0x0000000006BEC000-memory.dmpFilesize
496KB
-
memory/3488-61-0x0000000006B70000-0x0000000006BEC000-memory.dmpFilesize
496KB
-
memory/3488-32-0x0000000006B70000-0x0000000006BEC000-memory.dmpFilesize
496KB
-
memory/3488-30-0x0000000006B70000-0x0000000006BEC000-memory.dmpFilesize
496KB
-
memory/3488-0-0x00000000744B0000-0x0000000074C60000-memory.dmpFilesize
7.7MB
-
memory/3488-26-0x0000000006B70000-0x0000000006BEC000-memory.dmpFilesize
496KB
-
memory/3488-24-0x0000000006B70000-0x0000000006BEC000-memory.dmpFilesize
496KB
-
memory/3488-22-0x0000000006B70000-0x0000000006BEC000-memory.dmpFilesize
496KB
-
memory/3488-20-0x0000000006B70000-0x0000000006BEC000-memory.dmpFilesize
496KB
-
memory/3488-18-0x0000000006B70000-0x0000000006BEC000-memory.dmpFilesize
496KB
-
memory/3488-16-0x0000000006B70000-0x0000000006BEC000-memory.dmpFilesize
496KB
-
memory/3488-14-0x0000000006B70000-0x0000000006BEC000-memory.dmpFilesize
496KB
-
memory/3488-12-0x0000000006B70000-0x0000000006BEC000-memory.dmpFilesize
496KB
-
memory/3488-10-0x0000000006B70000-0x0000000006BEC000-memory.dmpFilesize
496KB
-
memory/3488-9-0x0000000006B70000-0x0000000006BEC000-memory.dmpFilesize
496KB
-
memory/3488-8-0x0000000006B70000-0x0000000006BF2000-memory.dmpFilesize
520KB
-
memory/3488-7-0x00000000068B0000-0x00000000068FE000-memory.dmpFilesize
312KB
-
memory/3488-6-0x00000000744B0000-0x0000000074C60000-memory.dmpFilesize
7.7MB
-
memory/3488-5-0x0000000005440000-0x000000000544A000-memory.dmpFilesize
40KB
-
memory/3488-4-0x0000000005480000-0x0000000005490000-memory.dmpFilesize
64KB
-
memory/3488-3-0x0000000005490000-0x0000000005522000-memory.dmpFilesize
584KB
-
memory/3488-2-0x0000000005B00000-0x00000000060A4000-memory.dmpFilesize
5.6MB
-
memory/3488-1-0x00000000009F0000-0x0000000000A48000-memory.dmpFilesize
352KB