Analysis
-
max time kernel
133s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
07-05-2024 11:58
General
-
Target
win.exe
-
Size
21KB
-
MD5
bc8e22ec9436819dfb6a581c1b106ce6
-
SHA1
a7320722aed02d6671fe08c8b9951f1fd14b4b23
-
SHA256
3d579a26aaa523f141c22cf94f00dd27163fda2ecbb724c2962bdff4d5b2838f
-
SHA512
c59387c6cb2f44e10dccc1f882008bf18aaebfc7931a434a5892d6717d3b5fd65c9a5cf3ab30d6c2b31a5165c53d8dfa0f5991a2415a1566fd409d26f8a15b8c
-
SSDEEP
384:kLNzO2fP3ZiQqoZYddYtvihtYBlX7KeLTMfspTSms6Aj:yNFikZYdYvqtYCblt
Score
10/10
Malware Config
Extracted
Family
revengerat
Botnet
LimeBuilder
C2
chutiyahaitu.duckdns.org:8080
Mutex
RV_MUTEX-FZMONFueOciq
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\win.exe"C:\Users\Admin\AppData\Local\Temp\win.exe"1⤵
- Maps connected drives based on registry
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
48KB
-
Filesize
5.6MB
-
Filesize
624KB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB