Analysis
-
max time kernel
55s -
max time network
57s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
26-09-2024 23:26
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
5d0adbde7a56ddf190fbba91ec48e096bf1564d183367e2bf1168c41e842d72d.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
11 signatures
120 seconds
General
-
Target
5d0adbde7a56ddf190fbba91ec48e096bf1564d183367e2bf1168c41e842d72d.exe
-
Size
952KB
-
MD5
af60ab5ec8679c02f41649410e9bdbaa
-
SHA1
419c4d943495ee76add69255e7297457bcdc07fd
-
SHA256
5d0adbde7a56ddf190fbba91ec48e096bf1564d183367e2bf1168c41e842d72d
-
SHA512
4c8b00a283ab2ed9ffe9849d237958ce2d9771d7dd7e6fbca793f019f9179afcf028086c960aace237ba827b72f5ebdf4bcbe936e9d2b5217c5cd5d7bb05e50f
-
SSDEEP
24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5q:Rh+ZkldDPK8YaKjq
Score
10/10
Malware Config
Extracted
Family
revengerat
Botnet
Marzo26
C2
marzorevenger.duckdns.org:4230
Mutex
RV_MUTEX-PiGGjjtnxDpn
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Drops startup file 2 IoCs
Processes:
taskmgr.exe5d0adbde7a56ddf190fbba91ec48e096bf1564d183367e2bf1168c41e842d72d.exedescription ioc Process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\audiohandlers.url taskmgr.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AudioHandlers.url 5d0adbde7a56ddf190fbba91ec48e096bf1564d183367e2bf1168c41e842d72d.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/2804-0-0x0000000000D60000-0x0000000000E53000-memory.dmp autoit_exe behavioral1/memory/2804-22-0x0000000000D60000-0x0000000000E53000-memory.dmp autoit_exe behavioral1/memory/2804-30-0x0000000000D60000-0x0000000000E53000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5d0adbde7a56ddf190fbba91ec48e096bf1564d183367e2bf1168c41e842d72d.exedescription pid Process procid_target PID 2804 set thread context of 4724 2804 5d0adbde7a56ddf190fbba91ec48e096bf1564d183367e2bf1168c41e842d72d.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
5d0adbde7a56ddf190fbba91ec48e096bf1564d183367e2bf1168c41e842d72d.exeRegAsm.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5d0adbde7a56ddf190fbba91ec48e096bf1564d183367e2bf1168c41e842d72d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 57 IoCs
Processes:
taskmgr.exepid Process 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
RegAsm.exetaskmgr.exedescription pid Process Token: SeDebugPrivilege 4724 RegAsm.exe Token: SeDebugPrivilege 4580 taskmgr.exe Token: SeSystemProfilePrivilege 4580 taskmgr.exe Token: SeCreateGlobalPrivilege 4580 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
5d0adbde7a56ddf190fbba91ec48e096bf1564d183367e2bf1168c41e842d72d.exetaskmgr.exepid Process 2804 5d0adbde7a56ddf190fbba91ec48e096bf1564d183367e2bf1168c41e842d72d.exe 2804 5d0adbde7a56ddf190fbba91ec48e096bf1564d183367e2bf1168c41e842d72d.exe 2804 5d0adbde7a56ddf190fbba91ec48e096bf1564d183367e2bf1168c41e842d72d.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
5d0adbde7a56ddf190fbba91ec48e096bf1564d183367e2bf1168c41e842d72d.exetaskmgr.exepid Process 2804 5d0adbde7a56ddf190fbba91ec48e096bf1564d183367e2bf1168c41e842d72d.exe 2804 5d0adbde7a56ddf190fbba91ec48e096bf1564d183367e2bf1168c41e842d72d.exe 2804 5d0adbde7a56ddf190fbba91ec48e096bf1564d183367e2bf1168c41e842d72d.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
5d0adbde7a56ddf190fbba91ec48e096bf1564d183367e2bf1168c41e842d72d.exedescription pid Process procid_target PID 2804 wrote to memory of 4724 2804 5d0adbde7a56ddf190fbba91ec48e096bf1564d183367e2bf1168c41e842d72d.exe 83 PID 2804 wrote to memory of 4724 2804 5d0adbde7a56ddf190fbba91ec48e096bf1564d183367e2bf1168c41e842d72d.exe 83 PID 2804 wrote to memory of 4724 2804 5d0adbde7a56ddf190fbba91ec48e096bf1564d183367e2bf1168c41e842d72d.exe 83 PID 2804 wrote to memory of 4724 2804 5d0adbde7a56ddf190fbba91ec48e096bf1564d183367e2bf1168c41e842d72d.exe 83 PID 2804 wrote to memory of 4724 2804 5d0adbde7a56ddf190fbba91ec48e096bf1564d183367e2bf1168c41e842d72d.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d0adbde7a56ddf190fbba91ec48e096bf1564d183367e2bf1168c41e842d72d.exe"C:\Users\Admin\AppData\Local\Temp\5d0adbde7a56ddf190fbba91ec48e096bf1564d183367e2bf1168c41e842d72d.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4724
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops startup file
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4580
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
85B
MD5c2c2a91c1fb848a7e70290cda896ac0e
SHA1d9f12467aa13d055221b79d46ae47ee717e20494
SHA256606cc1c837d48e5dc511109e2d3410926b3ac940d645ae278bb41ac55ba65c9c
SHA512b0b97c84b095d287d83cf34ed817eec21a7a4d7aa61900235b46b3e71708f897442422cbbf07c8fa94e093829d5c6dc5d7fbc82bb1a23b95c235f9d8beb3fd57