Analysis
-
max time kernel
101s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
15-08-2024 16:34
Static task
static1
Behavioral task
behavioral1
Sample
5c6eec8232030b0cf70d1506ac82c660N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5c6eec8232030b0cf70d1506ac82c660N.exe
Resource
win10v2004-20240802-en
General
-
Target
5c6eec8232030b0cf70d1506ac82c660N.exe
-
Size
952KB
-
MD5
5c6eec8232030b0cf70d1506ac82c660
-
SHA1
fc733960d26713dbaf07789e45c0e5e5c518b076
-
SHA256
ee023dfd4df9a149956530e6e3e852d2cd92f3ea116211bb3e1ce6f5c6ef4957
-
SHA512
8d90d7acbd53de29668ce6c1bf69560910cfe18735f9aa9b94db79555285e171102b714956239d257e2790b52966905242022ad998653ea6f97b9654aab31547
-
SSDEEP
24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5y:Rh+ZkldDPK8YaKjy
Malware Config
Extracted
revengerat
Marzo26
marzorevenger.duckdns.org:4230
RV_MUTEX-PiGGjjtnxDpn
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Drops startup file 1 IoCs
Processes:
5c6eec8232030b0cf70d1506ac82c660N.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AudioHandlers.url 5c6eec8232030b0cf70d1506ac82c660N.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/4488-0-0x0000000000DD0000-0x0000000000EC3000-memory.dmp autoit_exe behavioral2/memory/4488-9-0x0000000000DD0000-0x0000000000EC3000-memory.dmp autoit_exe behavioral2/memory/4488-15-0x0000000000DD0000-0x0000000000EC3000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5c6eec8232030b0cf70d1506ac82c660N.exedescription pid process target process PID 4488 set thread context of 3504 4488 5c6eec8232030b0cf70d1506ac82c660N.exe RegAsm.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
5c6eec8232030b0cf70d1506ac82c660N.exeRegAsm.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5c6eec8232030b0cf70d1506ac82c660N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 3504 RegAsm.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
5c6eec8232030b0cf70d1506ac82c660N.exepid process 4488 5c6eec8232030b0cf70d1506ac82c660N.exe 4488 5c6eec8232030b0cf70d1506ac82c660N.exe 4488 5c6eec8232030b0cf70d1506ac82c660N.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
5c6eec8232030b0cf70d1506ac82c660N.exepid process 4488 5c6eec8232030b0cf70d1506ac82c660N.exe 4488 5c6eec8232030b0cf70d1506ac82c660N.exe 4488 5c6eec8232030b0cf70d1506ac82c660N.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
5c6eec8232030b0cf70d1506ac82c660N.exedescription pid process target process PID 4488 wrote to memory of 3504 4488 5c6eec8232030b0cf70d1506ac82c660N.exe RegAsm.exe PID 4488 wrote to memory of 3504 4488 5c6eec8232030b0cf70d1506ac82c660N.exe RegAsm.exe PID 4488 wrote to memory of 3504 4488 5c6eec8232030b0cf70d1506ac82c660N.exe RegAsm.exe PID 4488 wrote to memory of 3504 4488 5c6eec8232030b0cf70d1506ac82c660N.exe RegAsm.exe PID 4488 wrote to memory of 3504 4488 5c6eec8232030b0cf70d1506ac82c660N.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c6eec8232030b0cf70d1506ac82c660N.exe"C:\Users\Admin\AppData\Local\Temp\5c6eec8232030b0cf70d1506ac82c660N.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3504