Analysis
-
max time kernel
94s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
15-09-2024 11:42
General
-
Target
3a75d6962893903bdfc8558485df3e3166989bb5dd5d524d2c5c796f60221f3d_unsafe (copy 1).exe
-
Size
1.9MB
-
MD5
768a26a0fb582b456befa2e2c9f353e9
-
SHA1
5227ae7c346e4db17165e539a40710a3e3818590
-
SHA256
fb5a48d6b7e7a6d7c0eb8693ef3b69b56431529d393afce8b5d3e76308d70449
-
SHA512
66630f2df9d3a1341768c3573e90081412384a4317734afc5fa0d5cf258a6030a4e459f35f8c69dcc55718e9df0f80b734f2ff7dfd53a2d627e047445c51c66a
-
SSDEEP
24576:wtb20pkaCqT5TBWgNjVY10Vp70smVkVMyO7BlWEWEzKJ9TtLs4l0llFJ+o0zQJ9X:5Vg5tjVY1UUle52lF55c56
Malware Config
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
RevengeRat Executable 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a75d6962893903bdfc8558485df3e3166989bb5dd5d524d2c5c796f60221f3d_unsafe (copy 1).exe"C:\Users\Admin\AppData\Local\Temp\3a75d6962893903bdfc8558485df3e3166989bb5dd5d524d2c5c796f60221f3d_unsafe (copy 1).exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe"C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe" -install -56269414 -chipderedesign -fcb4fd7f2fd843e782da1aaa665f1fc2 - -mwchk -astsbowkxfecnger -37042⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153B
MD5ba1c0181a090c96f1f7c4d3a077abcf6
SHA12f7f350dd78c5c4e3aff4a1e68e5490726c956d9
SHA25660aa222b453f959eeacc90f0d7982f2231a97e9694873f27582d8ae62ec75465
SHA5124cc68fdbd1bcd0c92e8fb8ef3aa6e33d3db58b56d09c11f5004f05d0cc014745e0a9b6107dab8abe324f82e92da4b789223f08663218593b23adcbfd480e4753
-
Filesize
504KB
MD59b6c9b2660e2819352b9e9afa900eb68
SHA1a901074f923efa09a7e4413d55ef30c8fcbd0322
SHA256e7b27eb0b4e5ccfb97d68a125cb401b05939b8fd8010c57f72b04e9e841b6b5a
SHA5120eeff30dffd76732ef64cb450dd594628bfd2bd5439700f444317ccef001c145b02bc12aa16c8df41d5b64934ca2f642148bff17967b5b6a82fcd8fbae534599
-
Filesize
8KB
-
Filesize
520KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
1.9MB