Analysis

  • max time kernel
    35s
  • max time network
    38s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240709-en
  • resource tags

    arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    27-07-2024 20:51

General

  • Target

    Client.exe

  • Size

    5.0MB

  • MD5

    6663483929f325b3fe2f8a351787aebf

  • SHA1

    eaef70212f2f361a3167340d7c76e07246f1e427

  • SHA256

    cb9bb33d33ae493a7616a62cae19fb7c127c596a834543e78735e894d4225f42

  • SHA512

    12d51bd6328fd6a7572c97fdd3ac7b5d74dfd1379d5553f890af6c5a2effa65c61ecb78588fddac239881391ed9e2831f65a6f70e83a7047b980bcd4cb501eb9

  • SSDEEP

    3072:iEQ5B9LypBTl57/zzTx+feymDt9SYzOP+:iupBvLzTIf4Df7zOP+

Malware Config

Extracted

Family

revengerat

Botnet

Guest

C2

0.tcp.eu.ngrok.io:8848

Mutex

RV_MUTEX

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client.exe
    "C:\Users\Admin\AppData\Local\Temp\Client.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5104
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1956
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3676
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:2660

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\vwfRtNH.txt

      Filesize

      44B

      MD5

      bfbee1ccbe6981fafb1c7bff99680882

      SHA1

      3866c915b8a7e0592f8728c89faf6bb4d5ecf002

      SHA256

      74976c31c2c46d066f3d9a70fc73b3a7dd541d5a889a6644a59f09b53960a235

      SHA512

      6bb98708f97b426a6ef445681a9169671d084f1a876e6ff07b8c595add8f996509d5e003a04b1d58ca10332285df2686bec4e6b470f6b3f8a19e15be256dbd2e

    • memory/1956-7-0x0000000000400000-0x0000000000422000-memory.dmp

      Filesize

      136KB

    • memory/1956-19-0x0000000074690000-0x0000000074C41000-memory.dmp

      Filesize

      5.7MB

    • memory/1956-11-0x0000000074690000-0x0000000074C41000-memory.dmp

      Filesize

      5.7MB

    • memory/1956-10-0x0000000074690000-0x0000000074C41000-memory.dmp

      Filesize

      5.7MB

    • memory/1956-9-0x0000000074691000-0x0000000074692000-memory.dmp

      Filesize

      4KB

    • memory/3676-12-0x0000000000400000-0x000000000040C000-memory.dmp

      Filesize

      48KB

    • memory/3676-14-0x0000000074690000-0x0000000074C41000-memory.dmp

      Filesize

      5.7MB

    • memory/3676-15-0x0000000074690000-0x0000000074C41000-memory.dmp

      Filesize

      5.7MB

    • memory/3676-17-0x0000000074690000-0x0000000074C41000-memory.dmp

      Filesize

      5.7MB

    • memory/3676-18-0x0000000074690000-0x0000000074C41000-memory.dmp

      Filesize

      5.7MB

    • memory/5104-8-0x00007FFF9A1B0000-0x00007FFF9AB51000-memory.dmp

      Filesize

      9.6MB

    • memory/5104-5-0x000000001C940000-0x000000001C9A2000-memory.dmp

      Filesize

      392KB

    • memory/5104-4-0x000000001BDE0000-0x000000001BE86000-memory.dmp

      Filesize

      664KB

    • memory/5104-3-0x00007FFF9A1B0000-0x00007FFF9AB51000-memory.dmp

      Filesize

      9.6MB

    • memory/5104-2-0x000000001C3A0000-0x000000001C86E000-memory.dmp

      Filesize

      4.8MB

    • memory/5104-0-0x00007FFF9A465000-0x00007FFF9A466000-memory.dmp

      Filesize

      4KB

    • memory/5104-1-0x00007FFF9A1B0000-0x00007FFF9AB51000-memory.dmp

      Filesize

      9.6MB