Analysis
- max time kernel
105s - max time network
114s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
08/09/2024, 09:37
General
- Target 35fe14ca48ab0b792b3f8934988512e0N.exe
- Size 147KB
- Sample240908-llql7aycql
- SHA256 62414879eaa4f41a799b2e08dc86aa8375055c9d731a587f8e3a78c29957dc29
Malware Config
Extracted
-
revengerat
-
Guest
-
127.0.0.1:4444
-
127.0.0.1:1337
-
192.168.1.3:4444
-
192.168.1.3:1337
-
192.168.137.1:4444
-
192.168.137.1:1337
-
192.168.1.2:4444
-
192.168.1.2:1337
-
RV_MUTEX
Signatures
- RevengeRAT
Remote-access trojan with a wide range of capabilities.
- RevengeRat Executable 1 IoCs
- Executes dropped EXE 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\35fe14ca48ab0b792b3f8934988512e0N.exe"C:\Users\Admin\AppData\Local\Temp\35fe14ca48ab0b792b3f8934988512e0N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\file1.exeC:\Users\Admin\AppData\Local\Temp\\file1.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
file1.exe
memory/3252-4-0x0000000005430000-0x00000000054C2000-memory.dmp
memory/3252-19-0x00000000749D0000-0x0000000075180000-memory.dmp
memory/3252-3-0x00000000059E0000-0x0000000005F84000-memory.dmp
memory/3252-0-0x00000000749DE000-0x00000000749DF000-memory.dmp
memory/3252-5-0x0000000005360000-0x000000000536A000-memory.dmp
memory/3252-6-0x0000000005530000-0x0000000005586000-memory.dmp
memory/3252-7-0x00000000749D0000-0x0000000075180000-memory.dmp
memory/3252-1-0x0000000000980000-0x000000000098A000-memory.dmp
memory/3252-2-0x0000000005390000-0x000000000542C000-memory.dmp
memory/3492-13-0x000000001C310000-0x000000001C7DE000-memory.dmp
memory/3492-12-0x00007FFB17995000-0x00007FFB17996000-memory.dmp
memory/3492-16-0x00007FFB176E0000-0x00007FFB18081000-memory.dmp
memory/3492-15-0x000000001C890000-0x000000001C936000-memory.dmp
memory/3492-17-0x000000001CA70000-0x000000001CAD2000-memory.dmp
memory/3492-14-0x00007FFB176E0000-0x00007FFB18081000-memory.dmp
memory/3492-20-0x00007FFB17995000-0x00007FFB17996000-memory.dmp
memory/3492-21-0x00007FFB176E0000-0x00007FFB18081000-memory.dmp