Analysis
-
max time kernel
299s -
max time network
275s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
22-03-2024 10:29
Behavioral task
behavioral1
Sample
3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe
Resource
win10v2004-20240226-en
General
-
Target
3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe
-
Size
1.1MB
-
MD5
56ac9e72644a8dae8c1968d63a26e58a
-
SHA1
d0349d04f33400541898426438d9e036d21decc5
-
SHA256
3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c
-
SHA512
d4f5c176b3e4fda2a318fde3ec3702d9bf102bd752ee42b4549b9fd6630fdcbee20de63fc7a403f60768ac7c0a7d780bc542c8d60f4e2b9eeb19a40aba49ddc1
-
SSDEEP
24576:mq5TfcdHj4fmbi2q+0MmV0VMXeyrtoT1GokHTQoCwsC+Y:mUTsamOx9RoBVoCwT
Malware Config
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
RevengeRat Executable 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe revengerat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe -
Executes dropped EXE 1 IoCs
Processes:
dmr_72.exepid process 1952 dmr_72.exe -
Processes:
resource yara_rule behavioral2/memory/2684-0-0x00000000000B0000-0x0000000000326000-memory.dmp upx behavioral2/memory/2684-19-0x00000000000B0000-0x0000000000326000-memory.dmp upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/2684-19-0x00000000000B0000-0x0000000000326000-memory.dmp autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exepid process 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exetaskmgr.exepid process 2684 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe 3388 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
dmr_72.exetaskmgr.exedescription pid process Token: SeDebugPrivilege 1952 dmr_72.exe Token: SeDebugPrivilege 3388 taskmgr.exe Token: SeSystemProfilePrivilege 3388 taskmgr.exe Token: SeCreateGlobalPrivilege 3388 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exetaskmgr.exepid process 2684 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe 2684 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe 2684 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exetaskmgr.exepid process 2684 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe 2684 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe 2684 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe 3388 taskmgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
dmr_72.exepid process 1952 dmr_72.exe 1952 dmr_72.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exedescription pid process target process PID 2684 wrote to memory of 1952 2684 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe dmr_72.exe PID 2684 wrote to memory of 1952 2684 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe dmr_72.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe"C:\Users\Admin\AppData\Local\Temp\3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe"1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe"C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe" -install -72189998 -chipde -e37278fe332e42d1af33e4480ad52248 - -BLUB2 -irujtystudddgcxp -26842⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exeFilesize
373KB
MD51b81fa48134378f2b8d54a41fcfcf0ca
SHA1ff6fd97bcc603890c9bdffebe992a8b95d4f2686
SHA2565e2931d27098e63b67126ec2e036d8e2f4e46814d8c777c0307e3eec3b947707
SHA512b0a9ae05da6e73729cf61ba7e58015630bd69c508fbfaa8cd6d9d116b63def1c67e7298680aa8d6d99f20d77e91dd14d880466ba21a1062498fdf3687518c8cf
-
C:\Users\Admin\AppData\Local\Temp\DMR\irujtystudddgcxp.datFilesize
163B
MD58c934b48a05955c6cc934925f4c01e7d
SHA1b6300c8e23a440e85637a6e8f028ff25bee676d6
SHA25651be55dd44a7d2c782ef432971878a64040aec99c5ec0b53ac92d72bb2645992
SHA512199896d1482d91a24d896452b1a81b4c717a2781b0261aa7b32bd5fc38cdf84bf000d9487efa6bd799ae5b9b04019f5dd64bb174f5eec285d76aa9d8f3d1aa69
-
memory/1952-13-0x0000000000530000-0x0000000000592000-memory.dmpFilesize
392KB
-
memory/1952-14-0x00007FF811580000-0x00007FF812041000-memory.dmpFilesize
10.8MB
-
memory/1952-16-0x00000000027D0000-0x00000000027E0000-memory.dmpFilesize
64KB
-
memory/1952-17-0x00000000027D0000-0x00000000027E0000-memory.dmpFilesize
64KB
-
memory/1952-18-0x00000000027D0000-0x00000000027E0000-memory.dmpFilesize
64KB
-
memory/1952-21-0x00007FF811580000-0x00007FF812041000-memory.dmpFilesize
10.8MB
-
memory/2684-0-0x00000000000B0000-0x0000000000326000-memory.dmpFilesize
2.5MB
-
memory/2684-19-0x00000000000B0000-0x0000000000326000-memory.dmpFilesize
2.5MB
-
memory/3388-22-0x0000027D253C0000-0x0000027D253C1000-memory.dmpFilesize
4KB
-
memory/3388-23-0x0000027D253C0000-0x0000027D253C1000-memory.dmpFilesize
4KB
-
memory/3388-24-0x0000027D253C0000-0x0000027D253C1000-memory.dmpFilesize
4KB
-
memory/3388-28-0x0000027D253C0000-0x0000027D253C1000-memory.dmpFilesize
4KB
-
memory/3388-29-0x0000027D253C0000-0x0000027D253C1000-memory.dmpFilesize
4KB
-
memory/3388-30-0x0000027D253C0000-0x0000027D253C1000-memory.dmpFilesize
4KB
-
memory/3388-32-0x0000027D253C0000-0x0000027D253C1000-memory.dmpFilesize
4KB
-
memory/3388-31-0x0000027D253C0000-0x0000027D253C1000-memory.dmpFilesize
4KB
-
memory/3388-34-0x0000027D253C0000-0x0000027D253C1000-memory.dmpFilesize
4KB
-
memory/3388-33-0x0000027D253C0000-0x0000027D253C1000-memory.dmpFilesize
4KB