Analysis
-
max time kernel
111s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2024 09:33
Static task
static1
Behavioral task
behavioral1
Sample
17d0b9ac75dfd038ac11c64940a5a6cb.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
17d0b9ac75dfd038ac11c64940a5a6cb.exe
Resource
win10v2004-20240412-en
General
-
Target
17d0b9ac75dfd038ac11c64940a5a6cb.exe
-
Size
397KB
-
MD5
17d0b9ac75dfd038ac11c64940a5a6cb
-
SHA1
fdf4a6d488ba2220c808a8e233ea0e219273c3b2
-
SHA256
c994b9d016129f8a1e36b1e1f3288ef1385c6453497fc50cf129195e9769b8a5
-
SHA512
0ffb63b421da1daa0ca2098ea35b6e5be5b8613b9b4855b723b2c6032bcf644f7d00ddb35ab1af443c5f765fa10c61cb5c28fe81734ea4e582b51ed56c1afecd
-
SSDEEP
6144:/IWyveo8OzcrumMozCE6+bIPEMMjAtUO3nDv4abP212gG7EXoiToLa:/IpvZDoruYeE6+EsPjA4a7mJWEZga
Malware Config
Extracted
revengerat
NyanCatRevenge
alice2019.myftp.biz:7777
a915f6c5466a49
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
17d0b9ac75dfd038ac11c64940a5a6cb.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation 17d0b9ac75dfd038ac11c64940a5a6cb.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 4768 svchost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
17d0b9ac75dfd038ac11c64940a5a6cb.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\"" 17d0b9ac75dfd038ac11c64940a5a6cb.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
svchost.exedescription pid process target process PID 4768 set thread context of 664 4768 svchost.exe msbuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
msbuild.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 msbuild.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msbuild.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3696 timeout.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
17d0b9ac75dfd038ac11c64940a5a6cb.exesvchost.exepid process 4024 17d0b9ac75dfd038ac11c64940a5a6cb.exe 4024 17d0b9ac75dfd038ac11c64940a5a6cb.exe 4024 17d0b9ac75dfd038ac11c64940a5a6cb.exe 4024 17d0b9ac75dfd038ac11c64940a5a6cb.exe 4024 17d0b9ac75dfd038ac11c64940a5a6cb.exe 4024 17d0b9ac75dfd038ac11c64940a5a6cb.exe 4024 17d0b9ac75dfd038ac11c64940a5a6cb.exe 4024 17d0b9ac75dfd038ac11c64940a5a6cb.exe 4024 17d0b9ac75dfd038ac11c64940a5a6cb.exe 4024 17d0b9ac75dfd038ac11c64940a5a6cb.exe 4024 17d0b9ac75dfd038ac11c64940a5a6cb.exe 4024 17d0b9ac75dfd038ac11c64940a5a6cb.exe 4024 17d0b9ac75dfd038ac11c64940a5a6cb.exe 4024 17d0b9ac75dfd038ac11c64940a5a6cb.exe 4024 17d0b9ac75dfd038ac11c64940a5a6cb.exe 4024 17d0b9ac75dfd038ac11c64940a5a6cb.exe 4024 17d0b9ac75dfd038ac11c64940a5a6cb.exe 4024 17d0b9ac75dfd038ac11c64940a5a6cb.exe 4024 17d0b9ac75dfd038ac11c64940a5a6cb.exe 4024 17d0b9ac75dfd038ac11c64940a5a6cb.exe 4024 17d0b9ac75dfd038ac11c64940a5a6cb.exe 4024 17d0b9ac75dfd038ac11c64940a5a6cb.exe 4024 17d0b9ac75dfd038ac11c64940a5a6cb.exe 4024 17d0b9ac75dfd038ac11c64940a5a6cb.exe 4768 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
17d0b9ac75dfd038ac11c64940a5a6cb.exesvchost.exedescription pid process Token: SeDebugPrivilege 4024 17d0b9ac75dfd038ac11c64940a5a6cb.exe Token: SeDebugPrivilege 4768 svchost.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
17d0b9ac75dfd038ac11c64940a5a6cb.execmd.execmd.exesvchost.exedescription pid process target process PID 4024 wrote to memory of 2240 4024 17d0b9ac75dfd038ac11c64940a5a6cb.exe cmd.exe PID 4024 wrote to memory of 2240 4024 17d0b9ac75dfd038ac11c64940a5a6cb.exe cmd.exe PID 4024 wrote to memory of 2120 4024 17d0b9ac75dfd038ac11c64940a5a6cb.exe cmd.exe PID 4024 wrote to memory of 2120 4024 17d0b9ac75dfd038ac11c64940a5a6cb.exe cmd.exe PID 2120 wrote to memory of 3696 2120 cmd.exe timeout.exe PID 2120 wrote to memory of 3696 2120 cmd.exe timeout.exe PID 2240 wrote to memory of 3576 2240 cmd.exe schtasks.exe PID 2240 wrote to memory of 3576 2240 cmd.exe schtasks.exe PID 2120 wrote to memory of 4768 2120 cmd.exe svchost.exe PID 2120 wrote to memory of 4768 2120 cmd.exe svchost.exe PID 4768 wrote to memory of 664 4768 svchost.exe msbuild.exe PID 4768 wrote to memory of 664 4768 svchost.exe msbuild.exe PID 4768 wrote to memory of 664 4768 svchost.exe msbuild.exe PID 4768 wrote to memory of 664 4768 svchost.exe msbuild.exe PID 4768 wrote to memory of 664 4768 svchost.exe msbuild.exe PID 4768 wrote to memory of 664 4768 svchost.exe msbuild.exe PID 4768 wrote to memory of 664 4768 svchost.exe msbuild.exe PID 4768 wrote to memory of 664 4768 svchost.exe msbuild.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\17d0b9ac75dfd038ac11c64940a5a6cb.exe"C:\Users\Admin\AppData\Local\Temp\17d0b9ac75dfd038ac11c64940a5a6cb.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp54E6.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"4⤵
- Checks processor information in registry
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp54E6.tmp.batFilesize
151B
MD5d0adbf157c12b6acf4eef98d20931de3
SHA138539ead1ff72e190f2b5f70d1b0f6a130074fa6
SHA25680ecfb0abab11517f78efec306fcb1922834fb00d8ea082fdf55af3cfc953919
SHA512d1efb8b8c66dc6a4c03d4ba03a319b58d68eb7337af6e417551d432a6c4cfdeebec7273be6b9d98ed62c5ca7815e9284b4d9550324818dfdcfe4915b4f371658
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
397KB
MD517d0b9ac75dfd038ac11c64940a5a6cb
SHA1fdf4a6d488ba2220c808a8e233ea0e219273c3b2
SHA256c994b9d016129f8a1e36b1e1f3288ef1385c6453497fc50cf129195e9769b8a5
SHA5120ffb63b421da1daa0ca2098ea35b6e5be5b8613b9b4855b723b2c6032bcf644f7d00ddb35ab1af443c5f765fa10c61cb5c28fe81734ea4e582b51ed56c1afecd
-
memory/664-18-0x0000000005BB0000-0x0000000006154000-memory.dmpFilesize
5.6MB
-
memory/664-21-0x0000000005AC0000-0x0000000005B5C000-memory.dmpFilesize
624KB
-
memory/664-24-0x0000000005700000-0x0000000005710000-memory.dmpFilesize
64KB
-
memory/664-23-0x0000000074F70000-0x0000000075720000-memory.dmpFilesize
7.7MB
-
memory/664-22-0x0000000006160000-0x00000000061C6000-memory.dmpFilesize
408KB
-
memory/664-20-0x0000000005700000-0x0000000005710000-memory.dmpFilesize
64KB
-
memory/664-17-0x0000000074F70000-0x0000000075720000-memory.dmpFilesize
7.7MB
-
memory/664-16-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4024-1-0x0000025109A00000-0x0000025109A76000-memory.dmpFilesize
472KB
-
memory/4024-0-0x0000025107CB0000-0x0000025107CBC000-memory.dmpFilesize
48KB
-
memory/4024-2-0x00007FFE2D560000-0x00007FFE2E021000-memory.dmpFilesize
10.8MB
-
memory/4024-3-0x0000025108080000-0x000002510809E000-memory.dmpFilesize
120KB
-
memory/4024-10-0x00007FFE2D560000-0x00007FFE2E021000-memory.dmpFilesize
10.8MB
-
memory/4024-5-0x0000025109980000-0x00000251099E0000-memory.dmpFilesize
384KB
-
memory/4024-4-0x00000251223F0000-0x0000025122400000-memory.dmpFilesize
64KB
-
memory/4768-15-0x00007FFE2CA20000-0x00007FFE2D4E1000-memory.dmpFilesize
10.8MB
-
memory/4768-19-0x00007FFE2CA20000-0x00007FFE2D4E1000-memory.dmpFilesize
10.8MB