Analysis
-
max time kernel
103s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2024 18:37
Static task
static1
Behavioral task
behavioral1
Sample
40a768007e667b16890e329d55c86390N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
40a768007e667b16890e329d55c86390N.exe
Resource
win10v2004-20240709-en
General
-
Target
40a768007e667b16890e329d55c86390N.exe
-
Size
904KB
-
MD5
40a768007e667b16890e329d55c86390
-
SHA1
4077ace60339e7be66e74094d084f2ec2f7bb178
-
SHA256
a35ca0b701ebe1f4924cc33971c4c3256adba4f5d93ef5f6e369dd033a7e1a17
-
SHA512
bd8954681cb1dc4dcebfaf5052b11eaa47daf3d61e6830013ebb49946016e267195086490ced03722219e338c809fda96d700a6f884617da813a2a5d372d49c4
-
SSDEEP
24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5r:gh+ZkldoPK8YaKGr
Malware Config
Extracted
revengerat
Marzo26
marzorevenger.duckdns.org:4230
RV_MUTEX-PiGGjjtnxDpn
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Drops startup file 1 IoCs
Processes:
40a768007e667b16890e329d55c86390N.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AudioHandlers.url 40a768007e667b16890e329d55c86390N.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
40a768007e667b16890e329d55c86390N.exedescription pid process target process PID 4720 set thread context of 2116 4720 40a768007e667b16890e329d55c86390N.exe RegAsm.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
40a768007e667b16890e329d55c86390N.exeRegAsm.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40a768007e667b16890e329d55c86390N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 2116 RegAsm.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
40a768007e667b16890e329d55c86390N.exepid process 4720 40a768007e667b16890e329d55c86390N.exe 4720 40a768007e667b16890e329d55c86390N.exe 4720 40a768007e667b16890e329d55c86390N.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
40a768007e667b16890e329d55c86390N.exepid process 4720 40a768007e667b16890e329d55c86390N.exe 4720 40a768007e667b16890e329d55c86390N.exe 4720 40a768007e667b16890e329d55c86390N.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
40a768007e667b16890e329d55c86390N.exedescription pid process target process PID 4720 wrote to memory of 2116 4720 40a768007e667b16890e329d55c86390N.exe RegAsm.exe PID 4720 wrote to memory of 2116 4720 40a768007e667b16890e329d55c86390N.exe RegAsm.exe PID 4720 wrote to memory of 2116 4720 40a768007e667b16890e329d55c86390N.exe RegAsm.exe PID 4720 wrote to memory of 2116 4720 40a768007e667b16890e329d55c86390N.exe RegAsm.exe PID 4720 wrote to memory of 2116 4720 40a768007e667b16890e329d55c86390N.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\40a768007e667b16890e329d55c86390N.exe"C:\Users\Admin\AppData\Local\Temp\40a768007e667b16890e329d55c86390N.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2116-1-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/2116-5-0x0000000073A22000-0x0000000073A23000-memory.dmpFilesize
4KB
-
memory/2116-6-0x0000000073A20000-0x0000000073FD1000-memory.dmpFilesize
5.7MB
-
memory/2116-7-0x0000000073A20000-0x0000000073FD1000-memory.dmpFilesize
5.7MB
-
memory/2116-11-0x0000000073A22000-0x0000000073A23000-memory.dmpFilesize
4KB
-
memory/2116-12-0x0000000073A20000-0x0000000073FD1000-memory.dmpFilesize
5.7MB
-
memory/4720-0-0x00000000012A0000-0x00000000012A1000-memory.dmpFilesize
4KB