Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
21-07-2024 11:43
Static task
static1
Behavioral task
behavioral1
Sample
bb28d0fc75c252d0bd869b5e865d2f30N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
bb28d0fc75c252d0bd869b5e865d2f30N.exe
Resource
win10v2004-20240709-en
General
-
Target
bb28d0fc75c252d0bd869b5e865d2f30N.exe
-
Size
951KB
-
MD5
bb28d0fc75c252d0bd869b5e865d2f30
-
SHA1
dde7696d13730daa6555748e414ebf5d461b519f
-
SHA256
228ec81f7e3a092dce8f0b33e87871ce6426137c25617a231b8d2cc1eaa26d37
-
SHA512
ebd4c4fe179b3fd07c26041fe4cded117a160801bc55a4f7656182605483a7f5e3bb7b5cd854def593ae245cc5a64f352bf841358859a60fec8119f7e3a45c22
-
SSDEEP
24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5M:Rh+ZkldDPK8YaKjM
Malware Config
Extracted
revengerat
Marzo26
marzorevenger.duckdns.org:4230
RV_MUTEX-PiGGjjtnxDpn
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Drops startup file 1 IoCs
Processes:
bb28d0fc75c252d0bd869b5e865d2f30N.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AudioHandlers.url bb28d0fc75c252d0bd869b5e865d2f30N.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/1824-0-0x0000000000140000-0x0000000000233000-memory.dmp autoit_exe behavioral1/memory/1824-14-0x0000000000140000-0x0000000000233000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
bb28d0fc75c252d0bd869b5e865d2f30N.exedescription pid process target process PID 1824 set thread context of 2740 1824 bb28d0fc75c252d0bd869b5e865d2f30N.exe RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 2740 RegAsm.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
bb28d0fc75c252d0bd869b5e865d2f30N.exepid process 1824 bb28d0fc75c252d0bd869b5e865d2f30N.exe 1824 bb28d0fc75c252d0bd869b5e865d2f30N.exe 1824 bb28d0fc75c252d0bd869b5e865d2f30N.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
bb28d0fc75c252d0bd869b5e865d2f30N.exepid process 1824 bb28d0fc75c252d0bd869b5e865d2f30N.exe 1824 bb28d0fc75c252d0bd869b5e865d2f30N.exe 1824 bb28d0fc75c252d0bd869b5e865d2f30N.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
bb28d0fc75c252d0bd869b5e865d2f30N.exedescription pid process target process PID 1824 wrote to memory of 2740 1824 bb28d0fc75c252d0bd869b5e865d2f30N.exe RegAsm.exe PID 1824 wrote to memory of 2740 1824 bb28d0fc75c252d0bd869b5e865d2f30N.exe RegAsm.exe PID 1824 wrote to memory of 2740 1824 bb28d0fc75c252d0bd869b5e865d2f30N.exe RegAsm.exe PID 1824 wrote to memory of 2740 1824 bb28d0fc75c252d0bd869b5e865d2f30N.exe RegAsm.exe PID 1824 wrote to memory of 2740 1824 bb28d0fc75c252d0bd869b5e865d2f30N.exe RegAsm.exe PID 1824 wrote to memory of 2740 1824 bb28d0fc75c252d0bd869b5e865d2f30N.exe RegAsm.exe PID 1824 wrote to memory of 2740 1824 bb28d0fc75c252d0bd869b5e865d2f30N.exe RegAsm.exe PID 1824 wrote to memory of 2740 1824 bb28d0fc75c252d0bd869b5e865d2f30N.exe RegAsm.exe PID 1824 wrote to memory of 2740 1824 bb28d0fc75c252d0bd869b5e865d2f30N.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb28d0fc75c252d0bd869b5e865d2f30N.exe"C:\Users\Admin\AppData\Local\Temp\bb28d0fc75c252d0bd869b5e865d2f30N.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1824-0-0x0000000000140000-0x0000000000233000-memory.dmpFilesize
972KB
-
memory/1824-7-0x0000000000120000-0x0000000000121000-memory.dmpFilesize
4KB
-
memory/1824-14-0x0000000000140000-0x0000000000233000-memory.dmpFilesize
972KB
-
memory/2740-1-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/2740-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2740-9-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/2740-8-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/2740-2-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/2740-10-0x0000000073A12000-0x0000000073A14000-memory.dmpFilesize
8KB