Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2024 17:34
Static task
static1
Behavioral task
behavioral1
Sample
1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe
Resource
win10v2004-20240709-en
General
-
Target
1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe
-
Size
155KB
-
MD5
e769b63b22a914d5fe9722716257e3b6
-
SHA1
d69e65bcb3959724ccf02e6f1d2319163c2593f1
-
SHA256
1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c
-
SHA512
e901dfc8ede587b76997c5e98b576d12c5762176fc23501f404c195732a36d532b9fea97a79b68005150ca444d9cb1d8ecc5386698f3f4e8d6038d62bd773182
-
SSDEEP
1536:DwVCOKVP+JC+ZzmSd1vpCaTjjbDOcAT5D8V0HOQb89NmnJAO1yqrg0Yz:DLP2rP5ppJAT5YVCA9NmnJAO1yq0r
Malware Config
Extracted
revengerat
MAYO24
karmina113.sytes.net:3333
karmina117.sytes.net:3333
karmina118.sytes.net:3333
karmina119.sytes.net:3333
nibiru3.duckdns.org:3333
nibiru4.duckdns.org:3333
nibiru5.duckdns.org:3333
nibiru6.duckdns.org:3333
WSCollect
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe -
Drops startup file 2 IoCs
Processes:
WSCollect.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WSCollect.exe WSCollect.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WSCollect.exe WSCollect.exe -
Executes dropped EXE 2 IoCs
Processes:
WSCollect.exeWSCollect.exepid process 1788 WSCollect.exe 2072 WSCollect.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exeWSCollect.exedescription pid process target process PID 1928 set thread context of 4556 1928 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe PID 1788 set thread context of 2072 1788 WSCollect.exe WSCollect.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exeWSCollect.exeWSCollect.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSCollect.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSCollect.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exeWSCollect.exedescription pid process Token: SeDebugPrivilege 4556 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe Token: SeDebugPrivilege 2072 WSCollect.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exeWSCollect.exedescription pid process target process PID 1928 wrote to memory of 4556 1928 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe PID 1928 wrote to memory of 4556 1928 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe PID 1928 wrote to memory of 4556 1928 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe PID 1928 wrote to memory of 4556 1928 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe PID 1928 wrote to memory of 4556 1928 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe PID 1928 wrote to memory of 4556 1928 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe PID 1928 wrote to memory of 4556 1928 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe PID 1928 wrote to memory of 4556 1928 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe PID 4556 wrote to memory of 1788 4556 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe WSCollect.exe PID 4556 wrote to memory of 1788 4556 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe WSCollect.exe PID 4556 wrote to memory of 1788 4556 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe WSCollect.exe PID 1788 wrote to memory of 2072 1788 WSCollect.exe WSCollect.exe PID 1788 wrote to memory of 2072 1788 WSCollect.exe WSCollect.exe PID 1788 wrote to memory of 2072 1788 WSCollect.exe WSCollect.exe PID 1788 wrote to memory of 2072 1788 WSCollect.exe WSCollect.exe PID 1788 wrote to memory of 2072 1788 WSCollect.exe WSCollect.exe PID 1788 wrote to memory of 2072 1788 WSCollect.exe WSCollect.exe PID 1788 wrote to memory of 2072 1788 WSCollect.exe WSCollect.exe PID 1788 wrote to memory of 2072 1788 WSCollect.exe WSCollect.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe"C:\Users\Admin\AppData\Local\Temp\1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe"C:\Users\Admin\AppData\Local\Temp\1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\Documents\WSCollect.exe"C:\Users\Admin\Documents\WSCollect.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\Documents\WSCollect.exe"C:\Users\Admin\Documents\WSCollect.exe"4⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2072
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe.log
Filesize128B
MD5a5dcc7c9c08af7dddd82be5b036a4416
SHA14f998ca1526d199e355ffb435bae111a2779b994
SHA256e24033ceec97fd03402b03acaaabd1d1e378e83bb1683afbccac760e00f8ead5
SHA51256035de734836c0c39f0b48641c51c26adb6e79c6c65e23ca96603f71c95b8673e2ef853146e87efc899dd1878d0bbc2c82d91fbf0fce81c552048e986f9bb5a
-
Filesize
155KB
MD5e769b63b22a914d5fe9722716257e3b6
SHA1d69e65bcb3959724ccf02e6f1d2319163c2593f1
SHA2561e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c
SHA512e901dfc8ede587b76997c5e98b576d12c5762176fc23501f404c195732a36d532b9fea97a79b68005150ca444d9cb1d8ecc5386698f3f4e8d6038d62bd773182