Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2024, 03:13 UTC

General

  • Target

    db9f5baf04d68ae315931edcd3b814ddc2e95f79847e5b52b94ec22ab926c065.exe

  • Size

    904KB

  • MD5

    19cd47e16fb3e9cdbad143f34b3e1fcf

  • SHA1

    04c303e9da2ee727cdec34ed1935b9ee4cc1e78a

  • SHA256

    db9f5baf04d68ae315931edcd3b814ddc2e95f79847e5b52b94ec22ab926c065

  • SHA512

    41512c3c233461d121ba5ba16b4ec77f38c3fb8fe2add286ad2ab4a501bac4fe3b7ddcbf59c2e98955c6fc144448be932def59bc60d94c6c94fe35c3d2007faf

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5B:gh+ZkldoPK8YaKGB

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

  • Drops startup file 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\db9f5baf04d68ae315931edcd3b814ddc2e95f79847e5b52b94ec22ab926c065.exe
    "C:\Users\Admin\AppData\Local\Temp\db9f5baf04d68ae315931edcd3b814ddc2e95f79847e5b52b94ec22ab926c065.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1624
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:3036

Network

  • flag-us
    DNS
    marzorevenger.duckdns.org
    RegAsm.exe
    Remote address:
    8.8.8.8:53
    Request
    marzorevenger.duckdns.org
    IN A
    Response
    marzorevenger.duckdns.org
    IN A
    186.85.86.137
  • flag-us
    DNS
    marzorevenger.duckdns.org
    RegAsm.exe
    Remote address:
    8.8.8.8:53
    Request
    marzorevenger.duckdns.org
    IN A
    Response
    marzorevenger.duckdns.org
    IN A
    186.85.86.137
  • flag-us
    DNS
    marzorevenger.duckdns.org
    RegAsm.exe
    Remote address:
    8.8.8.8:53
    Request
    marzorevenger.duckdns.org
    IN A
    Response
    marzorevenger.duckdns.org
    IN A
    186.85.86.137
  • 186.85.86.137:4230
    marzorevenger.duckdns.org
    RegAsm.exe
    152 B
    3
  • 186.85.86.137:4230
    marzorevenger.duckdns.org
    RegAsm.exe
    152 B
    3
  • 186.85.86.137:4230
    marzorevenger.duckdns.org
    RegAsm.exe
    152 B
    3
  • 186.85.86.137:4230
    marzorevenger.duckdns.org
    RegAsm.exe
    152 B
    3
  • 186.85.86.137:4230
    marzorevenger.duckdns.org
    RegAsm.exe
    152 B
    3
  • 186.85.86.137:4230
    marzorevenger.duckdns.org
    RegAsm.exe
    152 B
    3
  • 186.85.86.137:4230
    marzorevenger.duckdns.org
    RegAsm.exe
    104 B
    2
  • 8.8.8.8:53
    marzorevenger.duckdns.org
    dns
    RegAsm.exe
    71 B
    87 B
    1
    1

    DNS Request

    marzorevenger.duckdns.org

    DNS Response

    186.85.86.137

  • 8.8.8.8:53
    marzorevenger.duckdns.org
    dns
    RegAsm.exe
    71 B
    87 B
    1
    1

    DNS Request

    marzorevenger.duckdns.org

    DNS Response

    186.85.86.137

  • 8.8.8.8:53
    marzorevenger.duckdns.org
    dns
    RegAsm.exe
    71 B
    87 B
    1
    1

    DNS Request

    marzorevenger.duckdns.org

    DNS Response

    186.85.86.137

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1624-0-0x0000000000120000-0x0000000000121000-memory.dmp

    Filesize

    4KB

  • memory/3036-1-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3036-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/3036-2-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3036-7-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3036-8-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3036-9-0x0000000073F92000-0x0000000073F94000-memory.dmp

    Filesize

    8KB

  • memory/3036-10-0x0000000073F92000-0x0000000073F94000-memory.dmp

    Filesize

    8KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.