Analysis
-
max time kernel
194s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
18-09-2024 03:23
Behavioral task
behavioral1
Sample
3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe
Resource
win7-20240729-en
windows7-x64
15 signatures
300 seconds
Behavioral task
behavioral2
Sample
3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
15 signatures
300 seconds
General
-
Target
3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe
-
Size
1.4MB
-
MD5
5673c04d81969a6603184069b6846213
-
SHA1
49fdd9c69f1c281d94486029dfaa5108dfc168bf
-
SHA256
3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446
-
SHA512
c381630f7c9c72ca538679bef37b9e966ec2f906bd5eb36a42069e3742ddd57bd958d867ede257edc3244e40fa3a6c65c10cddd07dddfd89cc2085eef13291cb
-
SSDEEP
24576:rq5TfcdHj4fmb9Ve9u2qTPIMeYyBMLlQjzCEzKJ9TtLzCwn1jAh0zQJ9TtDRli:rUTsamC9uxKjY5x1jAF5i
Score
10/10
Malware Config
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
RevengeRat Executable 1 IoCs
resource yara_rule behavioral1/files/0x0006000000019246-4.dat revengerat -
Executes dropped EXE 1 IoCs
pid Process 2804 dmr_72.exe -
Loads dropped DLL 4 IoCs
pid Process 1072 3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe 1072 3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe 1072 3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe 1072 3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe -
resource yara_rule behavioral1/memory/1072-0-0x0000000000330000-0x000000000062D000-memory.dmp upx behavioral1/memory/1072-24-0x0000000000330000-0x000000000062D000-memory.dmp upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1072-24-0x0000000000330000-0x000000000062D000-memory.dmp autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language 3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage 3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1072 3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1892 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2804 dmr_72.exe Token: SeDebugPrivilege 1892 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1072 3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe 1072 3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe 1072 3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1072 3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe 1072 3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe 1072 3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe 1892 taskmgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2804 dmr_72.exe 2804 dmr_72.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1072 wrote to memory of 2804 1072 3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe 30 PID 1072 wrote to memory of 2804 1072 3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe 30 PID 1072 wrote to memory of 2804 1072 3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe 30 PID 1072 wrote to memory of 2804 1072 3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe"C:\Users\Admin\AppData\Local\Temp\3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe"C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe" -install -54417509 -chipderedesign -a80c61fa351a416282afb39d6c109d6c - -BLUB2 -ifvajofydrtqgxxt -10722⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2804
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1892
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
161B
MD5c800879c1c73dbbb198fc42669646aa7
SHA1ab63307099961d43ebb2b64809b7f39d030bab7b
SHA2564c4dd62b579e43dc1c4cf859299df3023409492281f173bc5c3d2cc00bb782d7
SHA5120bc20e0c61f46a6c8eb0d8c276edc1f1901ac2f2800199d78490ba0b3c096e4cbf08a175ee19f663d7c13d56e7b6852f32478ea6c85f7829f6fd2880023213df
-
Filesize
508KB
MD5da9e9a98a7cf8da14f9e3c9973328fb7
SHA142e37cbfa37877d247ebd37d9553cb6224d6bee6
SHA256c1116053bbac19ab273dc120c2984c235d116cdcc9e3ac437951b55465fd7063
SHA512ce98f1984a3db301df7c1078dc6014fc1a03a1643c5635ef59775ee8019fbae4e07c16e99ec3d1998f45947d57493ada96e5116c359a590b14573833eec17343