Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2024 09:31
Static task
static1
Behavioral task
behavioral1
Sample
17d0b9ac75dfd038ac11c64940a5a6cb.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
17d0b9ac75dfd038ac11c64940a5a6cb.exe
Resource
win10v2004-20240412-en
General
-
Target
17d0b9ac75dfd038ac11c64940a5a6cb.exe
-
Size
397KB
-
MD5
17d0b9ac75dfd038ac11c64940a5a6cb
-
SHA1
fdf4a6d488ba2220c808a8e233ea0e219273c3b2
-
SHA256
c994b9d016129f8a1e36b1e1f3288ef1385c6453497fc50cf129195e9769b8a5
-
SHA512
0ffb63b421da1daa0ca2098ea35b6e5be5b8613b9b4855b723b2c6032bcf644f7d00ddb35ab1af443c5f765fa10c61cb5c28fe81734ea4e582b51ed56c1afecd
-
SSDEEP
6144:/IWyveo8OzcrumMozCE6+bIPEMMjAtUO3nDv4abP212gG7EXoiToLa:/IpvZDoruYeE6+EsPjA4a7mJWEZga
Malware Config
Extracted
revengerat
NyanCatRevenge
alice2019.myftp.biz:7777
a915f6c5466a49
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
17d0b9ac75dfd038ac11c64940a5a6cb.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation 17d0b9ac75dfd038ac11c64940a5a6cb.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 2272 svchost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
17d0b9ac75dfd038ac11c64940a5a6cb.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\"" 17d0b9ac75dfd038ac11c64940a5a6cb.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
svchost.exedescription pid process target process PID 2272 set thread context of 460 2272 svchost.exe regsvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
regsvcs.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 regsvcs.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString regsvcs.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4804 timeout.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
17d0b9ac75dfd038ac11c64940a5a6cb.exesvchost.exepid process 2640 17d0b9ac75dfd038ac11c64940a5a6cb.exe 2640 17d0b9ac75dfd038ac11c64940a5a6cb.exe 2640 17d0b9ac75dfd038ac11c64940a5a6cb.exe 2640 17d0b9ac75dfd038ac11c64940a5a6cb.exe 2640 17d0b9ac75dfd038ac11c64940a5a6cb.exe 2640 17d0b9ac75dfd038ac11c64940a5a6cb.exe 2640 17d0b9ac75dfd038ac11c64940a5a6cb.exe 2640 17d0b9ac75dfd038ac11c64940a5a6cb.exe 2640 17d0b9ac75dfd038ac11c64940a5a6cb.exe 2640 17d0b9ac75dfd038ac11c64940a5a6cb.exe 2640 17d0b9ac75dfd038ac11c64940a5a6cb.exe 2640 17d0b9ac75dfd038ac11c64940a5a6cb.exe 2640 17d0b9ac75dfd038ac11c64940a5a6cb.exe 2640 17d0b9ac75dfd038ac11c64940a5a6cb.exe 2640 17d0b9ac75dfd038ac11c64940a5a6cb.exe 2640 17d0b9ac75dfd038ac11c64940a5a6cb.exe 2640 17d0b9ac75dfd038ac11c64940a5a6cb.exe 2640 17d0b9ac75dfd038ac11c64940a5a6cb.exe 2640 17d0b9ac75dfd038ac11c64940a5a6cb.exe 2640 17d0b9ac75dfd038ac11c64940a5a6cb.exe 2640 17d0b9ac75dfd038ac11c64940a5a6cb.exe 2640 17d0b9ac75dfd038ac11c64940a5a6cb.exe 2272 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
17d0b9ac75dfd038ac11c64940a5a6cb.exesvchost.exedescription pid process Token: SeDebugPrivilege 2640 17d0b9ac75dfd038ac11c64940a5a6cb.exe Token: SeDebugPrivilege 2272 svchost.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
17d0b9ac75dfd038ac11c64940a5a6cb.execmd.execmd.exesvchost.exedescription pid process target process PID 2640 wrote to memory of 4884 2640 17d0b9ac75dfd038ac11c64940a5a6cb.exe cmd.exe PID 2640 wrote to memory of 4884 2640 17d0b9ac75dfd038ac11c64940a5a6cb.exe cmd.exe PID 2640 wrote to memory of 2056 2640 17d0b9ac75dfd038ac11c64940a5a6cb.exe cmd.exe PID 2640 wrote to memory of 2056 2640 17d0b9ac75dfd038ac11c64940a5a6cb.exe cmd.exe PID 2056 wrote to memory of 4804 2056 cmd.exe timeout.exe PID 2056 wrote to memory of 4804 2056 cmd.exe timeout.exe PID 4884 wrote to memory of 4724 4884 cmd.exe schtasks.exe PID 4884 wrote to memory of 4724 4884 cmd.exe schtasks.exe PID 2056 wrote to memory of 2272 2056 cmd.exe svchost.exe PID 2056 wrote to memory of 2272 2056 cmd.exe svchost.exe PID 2272 wrote to memory of 460 2272 svchost.exe regsvcs.exe PID 2272 wrote to memory of 460 2272 svchost.exe regsvcs.exe PID 2272 wrote to memory of 460 2272 svchost.exe regsvcs.exe PID 2272 wrote to memory of 460 2272 svchost.exe regsvcs.exe PID 2272 wrote to memory of 460 2272 svchost.exe regsvcs.exe PID 2272 wrote to memory of 460 2272 svchost.exe regsvcs.exe PID 2272 wrote to memory of 460 2272 svchost.exe regsvcs.exe PID 2272 wrote to memory of 460 2272 svchost.exe regsvcs.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\17d0b9ac75dfd038ac11c64940a5a6cb.exe"C:\Users\Admin\AppData\Local\Temp\17d0b9ac75dfd038ac11c64940a5a6cb.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp6ADF.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"4⤵
- Checks processor information in registry
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp6ADF.tmp.batFilesize
151B
MD5f386b30017dfc0ed6c79ad520a9c344b
SHA1c61a12554cef7e3d839a30ba0ebc2990ea290eec
SHA256cfc99423b7505cc1b3793c5b64ae75cad4d0bc6ae58a28a18dd52c246e2ea4e2
SHA5127f32af7118a728a28818558295904cf6a557539edb591e29bd52e4db032753de6b5927229aa906f93d9451ad59ef418a25e337c53559e30097e71ee6a9fcda78
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
397KB
MD517d0b9ac75dfd038ac11c64940a5a6cb
SHA1fdf4a6d488ba2220c808a8e233ea0e219273c3b2
SHA256c994b9d016129f8a1e36b1e1f3288ef1385c6453497fc50cf129195e9769b8a5
SHA5120ffb63b421da1daa0ca2098ea35b6e5be5b8613b9b4855b723b2c6032bcf644f7d00ddb35ab1af443c5f765fa10c61cb5c28fe81734ea4e582b51ed56c1afecd
-
memory/460-18-0x0000000005A20000-0x0000000005FC4000-memory.dmpFilesize
5.6MB
-
memory/460-21-0x0000000005960000-0x00000000059FC000-memory.dmpFilesize
624KB
-
memory/460-24-0x00000000055B0000-0x00000000055C0000-memory.dmpFilesize
64KB
-
memory/460-23-0x0000000075430000-0x0000000075BE0000-memory.dmpFilesize
7.7MB
-
memory/460-22-0x0000000005FD0000-0x0000000006036000-memory.dmpFilesize
408KB
-
memory/460-20-0x00000000055B0000-0x00000000055C0000-memory.dmpFilesize
64KB
-
memory/460-17-0x0000000075430000-0x0000000075BE0000-memory.dmpFilesize
7.7MB
-
memory/460-16-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2272-15-0x00007FFA9AD90000-0x00007FFA9B851000-memory.dmpFilesize
10.8MB
-
memory/2272-19-0x00007FFA9AD90000-0x00007FFA9B851000-memory.dmpFilesize
10.8MB
-
memory/2640-1-0x0000027D39150000-0x0000027D391C6000-memory.dmpFilesize
472KB
-
memory/2640-0-0x0000027D1ED50000-0x0000027D1ED5C000-memory.dmpFilesize
48KB
-
memory/2640-11-0x00007FFA9B440000-0x00007FFA9BF01000-memory.dmpFilesize
10.8MB
-
memory/2640-3-0x0000027D392E0000-0x0000027D392F0000-memory.dmpFilesize
64KB
-
memory/2640-2-0x00007FFA9B440000-0x00007FFA9BF01000-memory.dmpFilesize
10.8MB
-
memory/2640-5-0x0000027D20910000-0x0000027D20970000-memory.dmpFilesize
384KB
-
memory/2640-4-0x0000027D208F0000-0x0000027D2090E000-memory.dmpFilesize
120KB