Analysis
-
max time kernel
130s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26-07-2024 17:34
Static task
static1
Behavioral task
behavioral1
Sample
1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe
Resource
win10v2004-20240709-en
General
-
Target
1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe
-
Size
155KB
-
MD5
e769b63b22a914d5fe9722716257e3b6
-
SHA1
d69e65bcb3959724ccf02e6f1d2319163c2593f1
-
SHA256
1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c
-
SHA512
e901dfc8ede587b76997c5e98b576d12c5762176fc23501f404c195732a36d532b9fea97a79b68005150ca444d9cb1d8ecc5386698f3f4e8d6038d62bd773182
-
SSDEEP
1536:DwVCOKVP+JC+ZzmSd1vpCaTjjbDOcAT5D8V0HOQb89NmnJAO1yqrg0Yz:DLP2rP5ppJAT5YVCA9NmnJAO1yq0r
Malware Config
Extracted
revengerat
MAYO24
karmina113.sytes.net:3333
karmina117.sytes.net:3333
karmina118.sytes.net:3333
karmina119.sytes.net:3333
nibiru3.duckdns.org:3333
nibiru4.duckdns.org:3333
nibiru5.duckdns.org:3333
nibiru6.duckdns.org:3333
WSCollect
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Drops startup file 2 IoCs
Processes:
WSCollect.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WSCollect.exe WSCollect.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WSCollect.exe WSCollect.exe -
Executes dropped EXE 2 IoCs
Processes:
WSCollect.exeWSCollect.exepid process 2196 WSCollect.exe 3036 WSCollect.exe -
Loads dropped DLL 2 IoCs
Processes:
1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exeWSCollect.exepid process 2760 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe 2196 WSCollect.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exeWSCollect.exedescription pid process target process PID 2096 set thread context of 2760 2096 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe PID 2196 set thread context of 3036 2196 WSCollect.exe WSCollect.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exeWSCollect.exeWSCollect.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSCollect.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSCollect.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exeWSCollect.exedescription pid process Token: SeDebugPrivilege 2760 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe Token: SeDebugPrivilege 3036 WSCollect.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exeWSCollect.exedescription pid process target process PID 2096 wrote to memory of 2760 2096 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe PID 2096 wrote to memory of 2760 2096 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe PID 2096 wrote to memory of 2760 2096 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe PID 2096 wrote to memory of 2760 2096 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe PID 2096 wrote to memory of 2760 2096 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe PID 2096 wrote to memory of 2760 2096 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe PID 2096 wrote to memory of 2760 2096 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe PID 2096 wrote to memory of 2760 2096 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe PID 2096 wrote to memory of 2760 2096 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe PID 2760 wrote to memory of 2196 2760 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe WSCollect.exe PID 2760 wrote to memory of 2196 2760 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe WSCollect.exe PID 2760 wrote to memory of 2196 2760 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe WSCollect.exe PID 2760 wrote to memory of 2196 2760 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe WSCollect.exe PID 2196 wrote to memory of 3036 2196 WSCollect.exe WSCollect.exe PID 2196 wrote to memory of 3036 2196 WSCollect.exe WSCollect.exe PID 2196 wrote to memory of 3036 2196 WSCollect.exe WSCollect.exe PID 2196 wrote to memory of 3036 2196 WSCollect.exe WSCollect.exe PID 2196 wrote to memory of 3036 2196 WSCollect.exe WSCollect.exe PID 2196 wrote to memory of 3036 2196 WSCollect.exe WSCollect.exe PID 2196 wrote to memory of 3036 2196 WSCollect.exe WSCollect.exe PID 2196 wrote to memory of 3036 2196 WSCollect.exe WSCollect.exe PID 2196 wrote to memory of 3036 2196 WSCollect.exe WSCollect.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe"C:\Users\Admin\AppData\Local\Temp\1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe"C:\Users\Admin\AppData\Local\Temp\1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\Documents\WSCollect.exe"C:\Users\Admin\Documents\WSCollect.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\Documents\WSCollect.exe"C:\Users\Admin\Documents\WSCollect.exe"4⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3036
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
155KB
MD5e769b63b22a914d5fe9722716257e3b6
SHA1d69e65bcb3959724ccf02e6f1d2319163c2593f1
SHA2561e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c
SHA512e901dfc8ede587b76997c5e98b576d12c5762176fc23501f404c195732a36d532b9fea97a79b68005150ca444d9cb1d8ecc5386698f3f4e8d6038d62bd773182