Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-07-2024 03:31

General

  • Target

    3d41513a6735c15a89e83be9108139c0N.exe

  • Size

    951KB

  • MD5

    3d41513a6735c15a89e83be9108139c0

  • SHA1

    35af4a7fa36cbb14ebb740e55959e66a8facf4ba

  • SHA256

    9d451b023aaac2a3ceb24cdadb5fb9f8c6b51ce803304805ca37e560e083e1c6

  • SHA512

    722d3bc819f40aeb0653ecd31d5947551b39a56d965a9e7a136825122cd72870ec44e44dc933401b988c1864dd6e6d96862a12fb02ddaeca7868d49bfc71f3ee

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5w:Rh+ZkldDPK8YaKjw

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

  • Drops startup file 1 IoCs
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3d41513a6735c15a89e83be9108139c0N.exe
    "C:\Users\Admin\AppData\Local\Temp\3d41513a6735c15a89e83be9108139c0N.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4000
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1008-2-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1008-6-0x0000000073512000-0x0000000073513000-memory.dmp

    Filesize

    4KB

  • memory/1008-7-0x0000000073510000-0x0000000073AC1000-memory.dmp

    Filesize

    5.7MB

  • memory/1008-8-0x0000000073510000-0x0000000073AC1000-memory.dmp

    Filesize

    5.7MB

  • memory/1008-13-0x0000000073512000-0x0000000073513000-memory.dmp

    Filesize

    4KB

  • memory/1008-14-0x0000000073510000-0x0000000073AC1000-memory.dmp

    Filesize

    5.7MB

  • memory/4000-0-0x00000000005B0000-0x00000000006A3000-memory.dmp

    Filesize

    972KB

  • memory/4000-1-0x00000000029E0000-0x00000000029E1000-memory.dmp

    Filesize

    4KB

  • memory/4000-12-0x00000000005B0000-0x00000000006A3000-memory.dmp

    Filesize

    972KB