Analysis
-
max time kernel
149s -
max time network
136s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
18/05/2024, 22:57
Behavioral task
behavioral1
Sample
asasdsad.exe
Resource
win10-20240404-en
windows10-1703-x64
12 signatures
150 seconds
General
-
Target
asasdsad.exe
-
Size
17KB
-
MD5
b15bf219864e1682be14c2844c35a995
-
SHA1
775179d5bb8e3b897a486acb374d0ca6763d215d
-
SHA256
be1f2949e93117724ed26c840b12bedd044d8a914286f80febaa23d71bcdbba7
-
SHA512
f783868da3063f57e355ff490e9e795197a24bddc04453907c19c36e4d938c48da47defafe027bb6b585334cce560e9ee45d718559f28af732edbfb381051a8f
-
SSDEEP
384:U0NvDUtGdDvownpo4oEIPJvnbisVK6ybLu2s2:U0NvDoGdEwppIRmBa2
Score
10/10
Malware Config
Extracted
Family
revengerat
Botnet
Guest
C2
127.0.0.1:333
Mutex
RV_MUTEX
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
RevengeRat Executable 1 IoCs
resource yara_rule behavioral1/files/0x000700000001ac4e-19.dat revengerat -
Executes dropped EXE 1 IoCs
pid Process 4008 Client.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3460 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3104 asasdsad.exe Token: SeDebugPrivilege 3460 taskmgr.exe Token: SeSystemProfilePrivilege 3460 taskmgr.exe Token: SeCreateGlobalPrivilege 3460 taskmgr.exe Token: SeDebugPrivilege 4008 Client.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3104 wrote to memory of 4008 3104 asasdsad.exe 74 PID 3104 wrote to memory of 4008 3104 asasdsad.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\asasdsad.exe"C:\Users\Admin\AppData\Local\Temp\asasdsad.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\Documents\Client.exe"C:\Users\Admin\Documents\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4008
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3460
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD5b15bf219864e1682be14c2844c35a995
SHA1775179d5bb8e3b897a486acb374d0ca6763d215d
SHA256be1f2949e93117724ed26c840b12bedd044d8a914286f80febaa23d71bcdbba7
SHA512f783868da3063f57e355ff490e9e795197a24bddc04453907c19c36e4d938c48da47defafe027bb6b585334cce560e9ee45d718559f28af732edbfb381051a8f