Analysis
-
max time kernel
78s -
max time network
82s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
-
submitted
12-10-2024 06:19
General
-
Target
Revenge-RAT v3 - NYANxCAT.7z
-
Size
9.0MB
-
MD5
d0bdec0ca22aa6cdeae1abfb44f94ed9
-
SHA1
e5664aaf5b0cbaad33bbb6fb0389721cc863e51f
-
SHA256
8d8a9d8dbce44201be05da52db0c628c5ee06ae550dbf398c456316d7b58497d
-
SHA512
105fdf3867f2f56661756bc3356718b18fcf301584c126c9e68d1cdd2bc2b34b773325d0f8501fbb994001d6dc44a6e7765ff1286c0a55e9ff12b82602ba0a5a
-
SSDEEP
196608:CVxJlefNigwBUIiGrlLVM5c0h1Jfyc1LcORe:KJlefQl+IiGZVM5cK1J6uY1
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 37 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT.7z"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\Revenge-RAT v0.3\Revenge-RAT v0.3.exe"C:\Users\Admin\Desktop\Revenge-RAT v0.3\Revenge-RAT v0.3.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
361KB
MD5257440f1449c4505669d278bf431405c
SHA15235870185889ffa48234f1f4af14647634c19ef
SHA256a3c9e33dafb4c829a57a81ba8a6d94c2da9b343b6f9d6c933a4b5b88bbd96495
SHA512d99bf41a9017dcef261fc9886887fdeb3d3b6db806d92d8f76c783764caa7f94738b7258750a5fb26cb6069f471d1acfb55dc79db5855a5619e9d864e74761a7
-
Filesize
826B
MD54920b64e47ad467a5210ffebd862b907
SHA156cd7e8c92921dc26b042853d4e1efa5e5913e5f
SHA256baff51c6c633f762d68bea4822263572fc3a4569b94dd78716efbb5337e7c6d1
SHA512b33fe6e335d2c62db6f3d0f98f16e76186676c3802d4d6867348055ca2fd0a517d6c0b75ac02de5a995af4d919ece39db3ff4150a8bd3b718163752c15a9bd14
-
Filesize
826B
MD55650c1b32940bf34369662a34ccf3b34
SHA16e9b0668a6d92ad64315360ec81ae023b3f6adf3
SHA256bc59f5241d8db465ad9d3df2e3c4751d38f48997242c79301b95e7404b10ff58
SHA51226cd2a971ffb4103d089fb2977cc4a7dddba45ab2cf41f677e5c205965a03816a37d215092289788aa971a34c89a69143ef244f9a9b002ef584a577d179e440b
-
Filesize
1021KB
MD5953c073031a08211d72daeec0551a20d
SHA1de7441086bf49d7e590172ee07ca9ccc3d690298
SHA2566615e1e1d8e9ee5ae891dcc43fdd050787f28227369eed50ab3403b171a187f2
SHA512076de07d270878c4846c0d091a76cec925d57399bdf937791232a5363bee7bdc9f14418530593f1a509fe0df3db0454793635b70feb913413829e1bf2c85b8a3
-
Filesize
13.7MB
MD53a401ee7f0ebb09564f82891521b5e27
SHA147b8d2a42e4054b5dcac9f71454c9c3c285998d7
SHA256e2a3f5a0149222888c9e48ff828f35b3b4ace7d6b21e4d55a1bb7a7b3f76fd7f
SHA512b13556841b9db9f009d65b981abbb6690a6bfc6a7289c10c981d2303d66624ca8d80c2f545045409890cddc539794540db66dd520531bf17a4660c001efbee13
-
Filesize
288B
MD58236b11ddfa2da4eefdaea1fb5c5f055
SHA15c80687119c1b666af761b4504478581c156b535
SHA25613f89672439f33200d4356090fc568b7fe708b27a40b419ce3f63e7c83efa775
SHA51263cabfb5f2b369730b2380c6ad1004b0ac1a168a949804b9893cedd9cd12ebd5811595d7bd1a013f2b54362ffacef5fff1252f655a49d39c6475e984ad7e74c9
-
Filesize
13.7MB