Analysis
- max time kernel
60s - max time network
19s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
22/03/2024, 10:29
Behavioral task
behavioral1
Sample
3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe
Resource
win7-20240221-en
windows7-x64
14 signatures
300 seconds
Behavioral task
behavioral2
Sample
3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
13 signatures
300 seconds
General
- Target 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe
- Size 1.1MB
- Sample240322-mjk5csbb29
- SHA256 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c
- MD5 56ac9e72644a8dae8c1968d63a26e58a
- SHA1 d0349d04f33400541898426438d9e036d21decc5
- SHA512 d4f5c176b3e4fda2a318fde3ec3702d9bf102bd752ee42b4549b9fd6630fdcbee20de63fc7a403f60768ac7c0a7d780bc542c8d60f4e2b9eeb19a40aba49ddc1
- SSDEEP 24576:mq5TfcdHj4fmbi2q+0MmV0VMXeyrtoT1GokHTQoCwsC+Y:mUTsamOx9RoBVoCwT
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- RevengeRAT
Remote-access trojan with a wide range of capabilities.
- RevengeRat Executable 1 IoCs
resource yara_rule behavioral1/files/0x000c0000000133d4-4.dat revengerat - Executes dropped EXE 1 IoCs
pid Process 2596 dmr_72.exe - Loads dropped DLL 4 IoCs
pid Process 1460 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe 1460 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe 1460 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe 1460 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe -
resource yara_rule behavioral1/memory/1460-0-0x0000000000300000-0x0000000000576000-memory.dmp upx behavioral1/memory/1460-24-0x0000000000300000-0x0000000000576000-memory.dmp upx - AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1460-24-0x0000000000300000-0x0000000000576000-memory.dmp autoit_exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1460 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe 2728 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2596 dmr_72.exe Token: SeDebugPrivilege 2728 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1460 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe 1460 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe 1460 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1460 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe 1460 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe 1460 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2596 dmr_72.exe 2596 dmr_72.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1460 wrote to memory of 2596 1460 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe 28 PID 1460 wrote to memory of 2596 1460 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe 28 PID 1460 wrote to memory of 2596 1460 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe 28 PID 1460 wrote to memory of 2596 1460 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe"C:\Users\Admin\AppData\Local\Temp\3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe"C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe" -install -72189998 -chipde -e37278fe332e42d1af33e4480ad52248 - -BLUB2 -wuqejmgiryzytanz -14602⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2596
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2728
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\DMR\wuqejmgiryzytanz.dat
- Size 163B
- SHA256 51be55dd44a7d2c782ef432971878a64040aec99c5ec0b53ac92d72bb2645992
- MD5 8c934b48a05955c6cc934925f4c01e7d
- SHA1 b6300c8e23a440e85637a6e8f028ff25bee676d6
- SHA512 199896d1482d91a24d896452b1a81b4c717a2781b0261aa7b32bd5fc38cdf84bf000d9487efa6bd799ae5b9b04019f5dd64bb174f5eec285d76aa9d8f3d1aa69
- MD5 SHA1 SHA512
- Path \Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe
- Size 373KB
- SHA256 5e2931d27098e63b67126ec2e036d8e2f4e46814d8c777c0307e3eec3b947707
- MD5 1b81fa48134378f2b8d54a41fcfcf0ca
- SHA1 ff6fd97bcc603890c9bdffebe992a8b95d4f2686
- SHA512 b0a9ae05da6e73729cf61ba7e58015630bd69c508fbfaa8cd6d9d116b63def1c67e7298680aa8d6d99f20d77e91dd14d880466ba21a1062498fdf3687518c8cf
- SSDEEP 6144:+wHmhAXIsYzuOmEhBaomW48bhvCTnPeO5hZ1k9QiEkQf99:+wHmhYE6NQoCwsC9
- MD5 SHA1 SHA512 SSDEEP