Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06-09-2024 08:13
Static task
static1
Behavioral task
behavioral1
Sample
c850ead2fbea82ad60fe4248208602c0N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c850ead2fbea82ad60fe4248208602c0N.exe
Resource
win10v2004-20240802-en
General
-
Target
c850ead2fbea82ad60fe4248208602c0N.exe
-
Size
904KB
-
MD5
c850ead2fbea82ad60fe4248208602c0
-
SHA1
6ccced0687ca2afa68cf66b59ec4dcfbaf9768ad
-
SHA256
bdeba897bffa038fb03b098889c6a9b2a43e7307386084f56d1dae38d8e19042
-
SHA512
54e671858f5392347c418fc11a2763ab5f9338f60e6673c80f8a5c6be20e2e5939714518191e12d1b6be13f6c474859c1b1419c1befa68a76f78a56f2c3dea5b
-
SSDEEP
24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5f:gh+ZkldoPK8YaKGf
Malware Config
Extracted
revengerat
Marzo26
marzorevenger.duckdns.org:4230
RV_MUTEX-PiGGjjtnxDpn
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Drops startup file 1 IoCs
Processes:
c850ead2fbea82ad60fe4248208602c0N.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AudioHandlers.url c850ead2fbea82ad60fe4248208602c0N.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c850ead2fbea82ad60fe4248208602c0N.exedescription pid process target process PID 2664 set thread context of 2240 2664 c850ead2fbea82ad60fe4248208602c0N.exe RegAsm.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
c850ead2fbea82ad60fe4248208602c0N.exeRegAsm.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c850ead2fbea82ad60fe4248208602c0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 2240 RegAsm.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
c850ead2fbea82ad60fe4248208602c0N.exepid process 2664 c850ead2fbea82ad60fe4248208602c0N.exe 2664 c850ead2fbea82ad60fe4248208602c0N.exe 2664 c850ead2fbea82ad60fe4248208602c0N.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
c850ead2fbea82ad60fe4248208602c0N.exepid process 2664 c850ead2fbea82ad60fe4248208602c0N.exe 2664 c850ead2fbea82ad60fe4248208602c0N.exe 2664 c850ead2fbea82ad60fe4248208602c0N.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
c850ead2fbea82ad60fe4248208602c0N.exedescription pid process target process PID 2664 wrote to memory of 2240 2664 c850ead2fbea82ad60fe4248208602c0N.exe RegAsm.exe PID 2664 wrote to memory of 2240 2664 c850ead2fbea82ad60fe4248208602c0N.exe RegAsm.exe PID 2664 wrote to memory of 2240 2664 c850ead2fbea82ad60fe4248208602c0N.exe RegAsm.exe PID 2664 wrote to memory of 2240 2664 c850ead2fbea82ad60fe4248208602c0N.exe RegAsm.exe PID 2664 wrote to memory of 2240 2664 c850ead2fbea82ad60fe4248208602c0N.exe RegAsm.exe PID 2664 wrote to memory of 2240 2664 c850ead2fbea82ad60fe4248208602c0N.exe RegAsm.exe PID 2664 wrote to memory of 2240 2664 c850ead2fbea82ad60fe4248208602c0N.exe RegAsm.exe PID 2664 wrote to memory of 2240 2664 c850ead2fbea82ad60fe4248208602c0N.exe RegAsm.exe PID 2664 wrote to memory of 2240 2664 c850ead2fbea82ad60fe4248208602c0N.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c850ead2fbea82ad60fe4248208602c0N.exe"C:\Users\Admin\AppData\Local\Temp\c850ead2fbea82ad60fe4248208602c0N.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2240