Malware Analysis Report

2025-01-18 04:54

Sample ID 241023-hfwz8swdmc
Target RevengeRAT_v3_NYANxCAT.zip
SHA256 2cf26e5fe9f31386d57170cc51ec46d6e4b73e4760826d65ca1a7afc8c82acc2
Tags
discovery upx revengerat nyancatrevenge trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2cf26e5fe9f31386d57170cc51ec46d6e4b73e4760826d65ca1a7afc8c82acc2

Threat Level: Known bad

The file RevengeRAT_v3_NYANxCAT.zip was found to be: Known bad.

Malicious Activity Summary

discovery upx revengerat nyancatrevenge trojan

RevengeRAT

Executes dropped EXE

Loads dropped DLL

Drops desktop.ini file(s)

UPX packed file

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SendNotifyMessage

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-23 06:41

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral29

Detonation Overview

Submitted

2024-10-23 06:41

Reported

2024-10-23 06:44

Platform

win7-20240903-en

Max time kernel

121s

Max time network

123s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\IconLib.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\IconLib.dll",#1

Network

N/A

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-10-23 06:41

Reported

2024-10-23 06:44

Platform

win7-20240903-en

Max time kernel

122s

Max time network

125s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\AForge.Video.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\AForge.Video.dll",#1

Network

N/A

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-10-23 06:41

Reported

2024-10-23 06:44

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\Aut2Exe\upx.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\Aut2Exe\upx.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\Aut2Exe\upx.exe

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\Aut2Exe\upx.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 72.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 28.73.42.20.in-addr.arpa udp

Files

memory/3336-0-0x0000000000400000-0x000000000059C000-memory.dmp

memory/3336-1-0x0000000000400000-0x000000000059C000-memory.dmp

Analysis: behavioral20

Detonation Overview

Submitted

2024-10-23 06:41

Reported

2024-10-23 06:44

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\GoRC.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\GoRC.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\GoRC.exe

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\GoRC.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 75.209.201.84.in-addr.arpa udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 103.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 101.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 27.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-10-23 06:41

Reported

2024-10-23 06:44

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\assembly C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000 C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 72.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 73.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 67.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 27.173.189.20.in-addr.arpa udp

Files

memory/4308-0-0x0000000074C62000-0x0000000074C63000-memory.dmp

memory/4308-1-0x0000000074C60000-0x0000000075211000-memory.dmp

memory/4308-2-0x0000000074C60000-0x0000000075211000-memory.dmp

memory/4308-15-0x0000000074C60000-0x0000000075211000-memory.dmp

memory/4308-16-0x0000000074C60000-0x0000000075211000-memory.dmp

C:\Users\Admin\AppData\Local\SkinSoft\dotNET_Reactor\x86\ssapihook.dll

MD5 bc6887aa21e7794a2c27e3ffd3dc3ed0
SHA1 2b845941c93094d7203553582f69d0c61a9fcee4
SHA256 919130e16d33fd58d0370b06b7fb0fc253f5b571fc33ad5c21eb8dafe4760c94
SHA512 9e952ae72851ba081809ea5d7a86108b0355f0882bae912e0ecf931fde2e878994142b6c16094473305392981439e49d9a32aa6aaf94edd07238a0ecb787e834

memory/4308-23-0x0000000000010000-0x0000000000011000-memory.dmp

memory/4308-24-0x0000000000020000-0x0000000000021000-memory.dmp

memory/4308-25-0x0000000000030000-0x0000000000031000-memory.dmp

memory/4308-26-0x0000000000040000-0x0000000000041000-memory.dmp

memory/4308-27-0x0000000000050000-0x0000000000051000-memory.dmp

memory/4308-28-0x0000000000060000-0x0000000000061000-memory.dmp

memory/4308-29-0x0000000000070000-0x0000000000071000-memory.dmp

memory/4308-30-0x0000000000080000-0x0000000000081000-memory.dmp

memory/4308-31-0x0000000000090000-0x0000000000091000-memory.dmp

memory/4308-34-0x0000000074C60000-0x0000000075211000-memory.dmp

memory/4308-35-0x0000000074C62000-0x0000000074C63000-memory.dmp

memory/4308-36-0x0000000074C60000-0x0000000075211000-memory.dmp

memory/4308-37-0x0000000074C60000-0x0000000075211000-memory.dmp

memory/4308-38-0x0000000074C60000-0x0000000075211000-memory.dmp

memory/4308-39-0x0000000074C60000-0x0000000075211000-memory.dmp

memory/4308-40-0x0000000074C60000-0x0000000075211000-memory.dmp

memory/4308-41-0x0000000074C60000-0x0000000075211000-memory.dmp

memory/4308-42-0x0000000074C60000-0x0000000075211000-memory.dmp

memory/4308-43-0x0000000074C60000-0x0000000075211000-memory.dmp

memory/4308-44-0x0000000074C60000-0x0000000075211000-memory.dmp

memory/4308-45-0x0000000074C60000-0x0000000075211000-memory.dmp

memory/4308-46-0x0000000074C60000-0x0000000075211000-memory.dmp

Analysis: behavioral17

Detonation Overview

Submitted

2024-10-23 06:41

Reported

2024-10-23 06:44

Platform

win7-20240903-en

Max time kernel

117s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\Aut2Exe\upx.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\Aut2Exe\upx.exe

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\Aut2Exe\upx.exe"

Network

N/A

Files

memory/1956-0-0x0000000000400000-0x000000000059C000-memory.dmp

memory/1956-2-0x0000000000400000-0x000000000059C000-memory.dmp

Analysis: behavioral32

Detonation Overview

Submitted

2024-10-23 06:41

Reported

2024-10-23 06:44

Platform

win10v2004-20241007-en

Max time kernel

140s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Plugin Compiler.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Plugin Compiler.exe

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Plugin Compiler.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 104.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

memory/3632-0-0x00007FFE58A95000-0x00007FFE58A96000-memory.dmp

memory/3632-1-0x000000001BB40000-0x000000001BBE6000-memory.dmp

memory/3632-2-0x00007FFE587E0000-0x00007FFE59181000-memory.dmp

memory/3632-3-0x000000001C0C0000-0x000000001C58E000-memory.dmp

memory/3632-4-0x00007FFE587E0000-0x00007FFE59181000-memory.dmp

memory/3632-5-0x000000001C660000-0x000000001C6FC000-memory.dmp

memory/3632-6-0x0000000001500000-0x0000000001508000-memory.dmp

memory/3632-7-0x000000001C7C0000-0x000000001C80C000-memory.dmp

memory/3632-8-0x00007FFE587E0000-0x00007FFE59181000-memory.dmp

memory/3632-9-0x00007FFE58A95000-0x00007FFE58A96000-memory.dmp

memory/3632-10-0x00007FFE587E0000-0x00007FFE59181000-memory.dmp

memory/3632-11-0x00007FFE587E0000-0x00007FFE59181000-memory.dmp

Analysis: behavioral14

Detonation Overview

Submitted

2024-10-23 06:41

Reported

2024-10-23 06:44

Platform

win10v2004-20241007-en

Max time kernel

135s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\Aut2Exe\Aut2exe.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\Aut2Exe\Aut2exe.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\Aut2Exe\Aut2exe.exe

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\Aut2Exe\Aut2exe.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-10-23 06:41

Reported

2024-10-23 06:44

Platform

win7-20240903-en

Max time kernel

121s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\Aut2Exe\Aut2exe_x64.exe"

Signatures

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\Aut2Exe\Aut2exe_x64.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\Aut2Exe\Aut2exe_x64.exe

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\Aut2Exe\Aut2exe_x64.exe"

Network

N/A

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-10-23 06:41

Reported

2024-10-23 06:44

Platform

win7-20241010-en

Max time kernel

119s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\mpress.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\mpress.exe

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\mpress.exe"

Network

N/A

Files

memory/2844-0-0x0000000000400000-0x000000000043B000-memory.dmp

memory/2844-2-0x0000000000400000-0x000000000043B000-memory.dmp

Analysis: behavioral31

Detonation Overview

Submitted

2024-10-23 06:41

Reported

2024-10-23 06:44

Platform

win7-20241010-en

Max time kernel

122s

Max time network

130s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Plugin Compiler.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Plugin Compiler.exe

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Plugin Compiler.exe"

Network

N/A

Files

memory/2860-0-0x000007FEF53BE000-0x000007FEF53BF000-memory.dmp

memory/2860-1-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

memory/2860-2-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

memory/2860-3-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

memory/2860-4-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

memory/2860-5-0x000007FEF53BE000-0x000007FEF53BF000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-10-23 06:41

Reported

2024-10-23 06:44

Platform

win7-20240729-en

Max time kernel

141s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\AHK\Ahk2Exe.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\AHK\Ahk2Exe.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\AHK\Ahk2Exe.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\AHK\Ahk2Exe.exe

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\AHK\Ahk2Exe.exe"

Network

N/A

Files

memory/2124-0-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/2124-2-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/2124-3-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/2124-4-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/2124-5-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/2124-6-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/2124-7-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/2124-8-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/2124-9-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/2124-10-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/2124-11-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/2124-12-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/2124-13-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/2124-14-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/2124-15-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/2124-16-0x0000000000400000-0x00000000004E0000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2024-10-23 06:41

Reported

2024-10-23 06:44

Platform

win7-20240708-en

Max time kernel

15s

Max time network

17s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\AHK\AutoHotkeySC.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\AHK\AutoHotkeySC.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\AHK\AutoHotkeySC.exe

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\AHK\AutoHotkeySC.exe"

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-23 06:41

Reported

2024-10-23 06:44

Platform

win10v2004-20241007-en

Max time kernel

137s

Max time network

106s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\AForge.Video.DirectShow.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\AForge.Video.DirectShow.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 101.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 100.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-10-23 06:41

Reported

2024-10-23 06:44

Platform

win7-20240903-en

Max time kernel

144s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe"

Signatures

RevengeRAT

trojan revengerat

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Documents\Client.exe N/A
N/A N/A C:\Users\Admin\Documents\Client.exe N/A
N/A N/A C:\Users\Admin\Documents\Client.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Documents\Client.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Documents\Client.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Documents\Client.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\DllHost.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "4" C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1092616257" C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000 C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}" C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0" C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\LogicalViewMode = "1" C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\IconSize = "16" C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000 C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC} C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9} C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000200000030f125b7ef471a10a5f102608c9eebac0a0000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1" C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}" C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\11aewgyr\11aewgyr.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEEE2.tmp" "c:\Users\Admin\Documents\CSCEEE1.tmp"

C:\Windows\explorer.exe

"C:\Windows\explorer.exe"

C:\Users\Admin\Documents\Client.exe

"C:\Users\Admin\Documents\Client.exe"

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe"

C:\Users\Admin\Documents\Client.exe

"C:\Users\Admin\Documents\Client.exe"

C:\Users\Admin\Documents\Client.exe

"C:\Users\Admin\Documents\Client.exe"

Network

Country Destination Domain Proto
N/A 127.0.0.1:333 tcp
N/A 127.0.0.1:333 tcp
N/A 127.0.0.1:333 tcp
N/A 127.0.0.1:333 tcp
N/A 127.0.0.1:333 tcp
N/A 127.0.0.1:333 tcp
N/A 127.0.0.1:333 tcp
N/A 127.0.0.1:333 tcp
N/A 127.0.0.1:333 tcp
N/A 127.0.0.1:333 tcp
N/A 127.0.0.1:333 tcp
N/A 127.0.0.1:333 tcp
N/A 127.0.0.1:333 tcp
N/A 127.0.0.1:333 tcp
N/A 127.0.0.1:333 tcp
N/A 127.0.0.1:333 tcp
N/A 127.0.0.1:333 tcp
N/A 127.0.0.1:333 tcp
N/A 127.0.0.1:333 tcp
N/A 127.0.0.1:333 tcp

Files

memory/1884-0-0x000007FEF5283000-0x000007FEF5284000-memory.dmp

memory/1884-1-0x0000000001270000-0x000000000128E000-memory.dmp

memory/1884-2-0x000007FEF5280000-0x000007FEF5C6C000-memory.dmp

memory/1884-3-0x000007FEF5280000-0x000007FEF5C6C000-memory.dmp

memory/1884-4-0x000007FEF5283000-0x000007FEF5284000-memory.dmp

memory/1884-5-0x000007FEF5280000-0x000007FEF5C6C000-memory.dmp

memory/1884-6-0x000000001E770000-0x000000001E780000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\11aewgyr\11aewgyr.cmdline

MD5 893d2d007f21a5c872fd6ced6c8c541e
SHA1 360f7a1ca1a8f66435aa1070bce8bcd8c4853d88
SHA256 04f99a767049f1d38a14fa3cd4ad4b4e800fee764fc539b7d59580de389cf7bf
SHA512 e6f21bb25fb44b1ccb912f0cdea4eb4c3739d2c7c7f33ae554946255d65dafee808b1ab586c24a1f62931b7ebe63205216d28be001669a7316eed6337ce1ee6d

\??\c:\Users\Admin\AppData\Local\Temp\11aewgyr\11aewgyr.0.cs

MD5 2dcb363b969b7901b58efcc5856b2b4f
SHA1 4828eefea04a7682355c4453eab3a1273a3f4cf2
SHA256 76cbb8aa269c57bc565561e7b6c486fcf10f2e7c849f20b7b6fe102a0352e68b
SHA512 4d0368d4e6663788b9062e2abd2edb3e2be479229d9220b373cac54178c75f6ad8945d14b6f1757da5863679a1ebbf2f27fea778076527d39a84e7a9364f7f75

\??\c:\Users\Admin\Documents\CSCEEE1.tmp

MD5 23c5f6c5bb4e5de59ec5aa884ea098d3
SHA1 7240ba716de1d9ddaa3f9e3a0adcd7e00c4e6a83
SHA256 7e090465b6d810c988f61a89f11debded56b4bff54c07369c26ab8afd9e8ba27
SHA512 bef35b5af9bb58041f3783a43e85f204a088f44e19168815eea881c2864f9c9038f0e8ba2ab136b6514028e6c22652496cee61fe6dab467b56f0a31809ca1f51

C:\Users\Admin\AppData\Local\Temp\RESEEE2.tmp

MD5 5583c9e1d381e8762b090eec66616d78
SHA1 eeef0a0790d9190835f43725eba4663111d1ebb4
SHA256 6bff9d18728d6a7af628678d7107bac5d3fc5c4c0733e0fb7fe0121704cddcd7
SHA512 fb94f3055e10ecde54407ee7f8e32514465ad60267a8c38dc6e42000d43ed062f6dee212e11a7d7c51b45530dc670aa03fb66826000283f29a8d2e3c74a5763a

memory/1884-19-0x000007FEF5280000-0x000007FEF5C6C000-memory.dmp

C:\Users\Admin\Documents\Client.exe

MD5 798a8394a500da3f3d524d0f8686fdb4
SHA1 5cdb6f14ccd4da5291c5618d19b6494b851068a6
SHA256 03788a00cf1ce2f697f3d037ab667038a35c023c3f417738eeb499e932f52f76
SHA512 6dc102b59abd9578df1682080d0ce87aaaeeddf2a5020e41d4fb8d52913c31257344225bbfd82ad6ac688955d0673f351a51c713a21446bf480e6ab2ab8d2ce2

memory/1788-22-0x0000000140000000-0x00000001405E8000-memory.dmp

memory/1788-23-0x0000000140000000-0x00000001405E8000-memory.dmp

memory/1788-24-0x0000000140000000-0x00000001405E8000-memory.dmp

memory/1788-25-0x0000000140000000-0x00000001405E8000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2024-10-23 06:41

Reported

2024-10-23 06:44

Platform

win7-20240903-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\AHK\Unicode 32-bit.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\AHK\Unicode 32-bit.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\AHK\Unicode 32-bit.exe

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\AHK\Unicode 32-bit.exe"

Network

N/A

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-10-23 06:41

Reported

2024-10-23 06:44

Platform

win7-20240903-en

Max time kernel

120s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}" C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000 C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0" C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}" C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000 C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\dotNET_Reactor.exe"

Network

N/A

Files

memory/2240-0-0x0000000074201000-0x0000000074202000-memory.dmp

memory/2240-1-0x0000000074200000-0x00000000747AB000-memory.dmp

memory/2240-2-0x0000000074200000-0x00000000747AB000-memory.dmp

memory/2240-15-0x0000000074200000-0x00000000747AB000-memory.dmp

memory/2240-16-0x0000000074200000-0x00000000747AB000-memory.dmp

\Users\Admin\AppData\Local\SkinSoft\dotNET_Reactor\x86\ssapihook.dll

MD5 bc6887aa21e7794a2c27e3ffd3dc3ed0
SHA1 2b845941c93094d7203553582f69d0c61a9fcee4
SHA256 919130e16d33fd58d0370b06b7fb0fc253f5b571fc33ad5c21eb8dafe4760c94
SHA512 9e952ae72851ba081809ea5d7a86108b0355f0882bae912e0ecf931fde2e878994142b6c16094473305392981439e49d9a32aa6aaf94edd07238a0ecb787e834

memory/2240-20-0x00000000057C0000-0x00000000057C1000-memory.dmp

memory/2240-21-0x00000000058D0000-0x00000000058D1000-memory.dmp

memory/2240-22-0x00000000058E0000-0x00000000058E1000-memory.dmp

memory/2240-23-0x00000000058F0000-0x00000000058F1000-memory.dmp

memory/2240-24-0x0000000005BA0000-0x0000000005BA1000-memory.dmp

memory/2240-25-0x0000000005BB0000-0x0000000005BB1000-memory.dmp

memory/2240-26-0x0000000005C80000-0x0000000005C81000-memory.dmp

memory/2240-27-0x00000000061B0000-0x00000000061B1000-memory.dmp

memory/2240-28-0x00000000061C0000-0x00000000061C1000-memory.dmp

memory/2240-29-0x0000000074200000-0x00000000747AB000-memory.dmp

memory/2240-32-0x0000000074200000-0x00000000747AB000-memory.dmp

memory/2240-33-0x0000000009F80000-0x0000000009F82000-memory.dmp

memory/2240-34-0x0000000074200000-0x00000000747AB000-memory.dmp

Analysis: behavioral19

Detonation Overview

Submitted

2024-10-23 06:41

Reported

2024-10-23 06:44

Platform

win7-20241010-en

Max time kernel

11s

Max time network

19s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\GoRC.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\GoRC.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\GoRC.exe

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\GoRC.exe"

Network

N/A

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2024-10-23 06:41

Reported

2024-10-23 06:44

Platform

win10v2004-20241007-en

Max time kernel

138s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\mpress.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\mpress.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\mpress.exe

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\mpress.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

memory/3788-0-0x0000000000400000-0x000000000043B000-memory.dmp

memory/3788-1-0x0000000000400000-0x000000000043B000-memory.dmp

Analysis: behavioral28

Detonation Overview

Submitted

2024-10-23 06:41

Reported

2024-10-23 06:44

Platform

win10v2004-20241007-en

Max time kernel

134s

Max time network

125s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\FastColoredTextBox.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\FastColoredTextBox.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-10-23 06:41

Reported

2024-10-23 06:44

Platform

win10v2004-20241007-en

Max time kernel

138s

Max time network

111s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Builder.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

memory/384-0-0x00007FFD4F2A3000-0x00007FFD4F2A5000-memory.dmp

memory/384-1-0x0000000000680000-0x000000000069E000-memory.dmp

memory/384-2-0x00007FFD4F2A0000-0x00007FFD4FD61000-memory.dmp

memory/384-3-0x00007FFD4F2A3000-0x00007FFD4F2A5000-memory.dmp

memory/384-4-0x00007FFD4F2A0000-0x00007FFD4FD61000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-10-23 06:41

Reported

2024-10-23 06:44

Platform

win10v2004-20241007-en

Max time kernel

134s

Max time network

107s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\AHK\AutoHotkeySC.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\AHK\AutoHotkeySC.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\AHK\AutoHotkeySC.exe

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\AHK\AutoHotkeySC.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 72.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-10-23 06:41

Reported

2024-10-23 06:44

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\AHK\Unicode 32-bit.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\AHK\Unicode 32-bit.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\AHK\Unicode 32-bit.exe

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\AHK\Unicode 32-bit.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-10-23 06:41

Reported

2024-10-23 06:44

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\Aut2Exe\Aut2exe_x64.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\Aut2Exe\Aut2exe_x64.exe

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\Aut2Exe\Aut2exe_x64.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 75.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 70.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 69.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
US 8.8.8.8:53 168.117.168.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-10-23 06:41

Reported

2024-10-23 06:44

Platform

win10v2004-20241007-en

Max time kernel

140s

Max time network

153s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\IconLib.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\IconLib.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-10-23 06:41

Reported

2024-10-23 06:44

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

155s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\AForge.Video.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\AForge.Video.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 27.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-10-23 06:41

Reported

2024-10-23 06:44

Platform

win10v2004-20241007-en

Max time kernel

140s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\AHK\Ahk2Exe.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\AHK\Ahk2Exe.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\AHK\Ahk2Exe.exe

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\AHK\Ahk2Exe.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 103.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 67.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp

Files

memory/3468-0-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/3468-2-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/3468-3-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/3468-4-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/3468-5-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/3468-6-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/3468-7-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/3468-8-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/3468-9-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/3468-10-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/3468-11-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/3468-12-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/3468-13-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/3468-14-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/3468-15-0x0000000000400000-0x00000000004E0000-memory.dmp

Analysis: behavioral21

Detonation Overview

Submitted

2024-10-23 06:41

Reported

2024-10-23 06:44

Platform

win7-20240903-en

Max time kernel

141s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\Resource Hacker.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\Resource Hacker.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\Resource Hacker.exe

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\Resource Hacker.exe"

Network

N/A

Files

memory/2400-0-0x0000000000260000-0x0000000000261000-memory.dmp

memory/2400-2-0x0000000000260000-0x0000000000261000-memory.dmp

memory/2400-1-0x0000000000400000-0x000000000084A000-memory.dmp

Analysis: behavioral27

Detonation Overview

Submitted

2024-10-23 06:41

Reported

2024-10-23 06:44

Platform

win7-20240903-en

Max time kernel

121s

Max time network

124s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\FastColoredTextBox.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\FastColoredTextBox.dll",#1

Network

N/A

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-23 06:41

Reported

2024-10-23 06:44

Platform

win7-20240708-en

Max time kernel

119s

Max time network

121s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\AForge.Video.DirectShow.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\AForge.Video.DirectShow.dll",#1

Network

N/A

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-10-23 06:41

Reported

2024-10-23 06:44

Platform

win7-20241010-en

Max time kernel

118s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\Aut2Exe\Aut2exe.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\Aut2Exe\Aut2exe.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\Aut2Exe\Aut2exe.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\Aut2Exe\Aut2exe.exe

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\Aut2Exe\Aut2exe.exe"

Network

N/A

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-10-23 06:41

Reported

2024-10-23 06:44

Platform

win10v2004-20241007-en

Max time kernel

140s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\Resource Hacker.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\Resource Hacker.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\Resource Hacker.exe

"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v3 - NYANxCAT\Extensions\Resource Hacker.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

memory/5076-0-0x0000000002610000-0x0000000002611000-memory.dmp

memory/5076-2-0x0000000002610000-0x0000000002611000-memory.dmp

memory/5076-1-0x0000000000400000-0x000000000084A000-memory.dmp