Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17-08-2024 14:25
Static task
static1
Behavioral task
behavioral1
Sample
df9270b7f6f6e49e581d8b1df4d24530N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
df9270b7f6f6e49e581d8b1df4d24530N.exe
Resource
win10v2004-20240802-en
General
-
Target
df9270b7f6f6e49e581d8b1df4d24530N.exe
-
Size
952KB
-
MD5
df9270b7f6f6e49e581d8b1df4d24530
-
SHA1
38fd2d9721ccfa758ff1b8dbde3fdc4936432ee9
-
SHA256
71a634addb3423ee2f636108ffb192121287ce0d23edaad8382bb8288602e18c
-
SHA512
6661e3d305bd7d36ed315030aea78b75204a438037d06dc3bc42411f12cf6b7169bd60e721d61dfbc4eaad146760e7083c20a6dc17b39f061bc1b98437d38940
-
SSDEEP
24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5z:Rh+ZkldDPK8YaKjz
Malware Config
Extracted
revengerat
Marzo26
marzorevenger.duckdns.org:4230
RV_MUTEX-PiGGjjtnxDpn
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Drops startup file 1 IoCs
Processes:
df9270b7f6f6e49e581d8b1df4d24530N.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AudioHandlers.url df9270b7f6f6e49e581d8b1df4d24530N.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/1856-0-0x0000000000240000-0x0000000000333000-memory.dmp autoit_exe behavioral2/memory/1856-9-0x0000000000240000-0x0000000000333000-memory.dmp autoit_exe behavioral2/memory/1856-15-0x0000000000240000-0x0000000000333000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
df9270b7f6f6e49e581d8b1df4d24530N.exedescription pid process target process PID 1856 set thread context of 2964 1856 df9270b7f6f6e49e581d8b1df4d24530N.exe RegAsm.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
df9270b7f6f6e49e581d8b1df4d24530N.exeRegAsm.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language df9270b7f6f6e49e581d8b1df4d24530N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 2964 RegAsm.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
df9270b7f6f6e49e581d8b1df4d24530N.exepid process 1856 df9270b7f6f6e49e581d8b1df4d24530N.exe 1856 df9270b7f6f6e49e581d8b1df4d24530N.exe 1856 df9270b7f6f6e49e581d8b1df4d24530N.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
df9270b7f6f6e49e581d8b1df4d24530N.exepid process 1856 df9270b7f6f6e49e581d8b1df4d24530N.exe 1856 df9270b7f6f6e49e581d8b1df4d24530N.exe 1856 df9270b7f6f6e49e581d8b1df4d24530N.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
df9270b7f6f6e49e581d8b1df4d24530N.exedescription pid process target process PID 1856 wrote to memory of 2964 1856 df9270b7f6f6e49e581d8b1df4d24530N.exe RegAsm.exe PID 1856 wrote to memory of 2964 1856 df9270b7f6f6e49e581d8b1df4d24530N.exe RegAsm.exe PID 1856 wrote to memory of 2964 1856 df9270b7f6f6e49e581d8b1df4d24530N.exe RegAsm.exe PID 1856 wrote to memory of 2964 1856 df9270b7f6f6e49e581d8b1df4d24530N.exe RegAsm.exe PID 1856 wrote to memory of 2964 1856 df9270b7f6f6e49e581d8b1df4d24530N.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\df9270b7f6f6e49e581d8b1df4d24530N.exe"C:\Users\Admin\AppData\Local\Temp\df9270b7f6f6e49e581d8b1df4d24530N.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2964