Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
16/05/2024, 18:55 UTC
General
-
Target
Lime-Worm-0.5.8D\database32.exe
-
Size
2.8MB
-
MD5
7028559abf0ccebf9692eb24651b4be1
-
SHA1
474e96eb203f4978c9c6e7568f4b7a9b20c329af
-
SHA256
b437592443e6c798ac25566400e1a1b4f29ef76a63bc5cd112316f5f4f34e45e
-
SHA512
3d0d22d68dda3fb8b27a31216c9a31387e8937645cd0bce7ca5e89f91b4f3addc6d05244cd9617acbecd26547adb563f7e40e516d398d4c741eefb295ff10f3e
-
SSDEEP
24576:1dTuyaUzkI/oMi5QNCRzJ4ZBoPUDmJbedDxCPEicdjFhu8bU:1dTuyaU/or+AkyNyXicdjFhuC
Score
10/10
Malware Config
Extracted
Family
revengerat
Mutex
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
RevengeRat Executable 1 IoCs
-
Modifies registry class 3 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lime-Worm-0.5.8D\database32.exe"C:\Users\Admin\AppData\Local\Temp\Lime-Worm-0.5.8D\database32.exe"1⤵
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
-
DNSupdrive.ddnsking.comRemote address:8.8.8.8:53Requestupdrive.ddnsking.comIN AResponse
No results found
-
8.8.8.8:53updrive.ddnsking.comdns
DNS Request
updrive.ddnsking.com
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
352KB
-
Filesize
32KB
-
Filesize
9.6MB