Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/07/2024, 22:41

General

  • Target

    18ba918243440fb9eb6c0e1d92c25580N.exe

  • Size

    951KB

  • MD5

    18ba918243440fb9eb6c0e1d92c25580

  • SHA1

    36d00d14464dd8f93456ba0b55eee334937c7817

  • SHA256

    e2273aa10612011a3e3ec99a1541affaba6b42eabc6e1946c18dd8f212902834

  • SHA512

    8d79e106e4d8726589ecf6bf993f0eab2d210f0b6c0ab932f7a9fccd291e2bd618fe5504d62b2d712473e7d660e7711cd6c34a85e12137cc7730906516b3ffd4

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5p:Rh+ZkldDPK8YaKjp

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

  • Drops startup file 1 IoCs
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\18ba918243440fb9eb6c0e1d92c25580N.exe
    "C:\Users\Admin\AppData\Local\Temp\18ba918243440fb9eb6c0e1d92c25580N.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:220
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/220-0-0x0000000000030000-0x0000000000123000-memory.dmp

    Filesize

    972KB

  • memory/220-1-0x0000000002150000-0x0000000002151000-memory.dmp

    Filesize

    4KB

  • memory/220-12-0x0000000000030000-0x0000000000123000-memory.dmp

    Filesize

    972KB

  • memory/3116-2-0x00000000003E0000-0x00000000003E8000-memory.dmp

    Filesize

    32KB

  • memory/3116-6-0x0000000073742000-0x0000000073743000-memory.dmp

    Filesize

    4KB

  • memory/3116-7-0x0000000073740000-0x0000000073CF1000-memory.dmp

    Filesize

    5.7MB

  • memory/3116-8-0x0000000073740000-0x0000000073CF1000-memory.dmp

    Filesize

    5.7MB

  • memory/3116-13-0x0000000073740000-0x0000000073CF1000-memory.dmp

    Filesize

    5.7MB

  • memory/3116-14-0x0000000073742000-0x0000000073743000-memory.dmp

    Filesize

    4KB