Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31-10-2024 01:46
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-31_8987cdb78358227903ac805abf0b7e29_hiddentear_hijackloader.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-31_8987cdb78358227903ac805abf0b7e29_hiddentear_hijackloader.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-31_8987cdb78358227903ac805abf0b7e29_hiddentear_hijackloader.exe
-
Size
324KB
-
MD5
8987cdb78358227903ac805abf0b7e29
-
SHA1
27a75f960fe463e2e8cd462a338786ead98b9fef
-
SHA256
64e3b5bc412e502c4aea2ff4fba56e9b575a5de09b3c7130015ce37e329a5739
-
SHA512
57ae471fa454542f04a1b181223e4b6f17b4003b9b3fbbe2ad0a8a152a5a8bfaa9999c951a7351db6a7ca7ec623f41bcc13e99a6e051908ff4cd2dec81506eef
-
SSDEEP
3072:J0bsJI99LGBLmjiWOZQvlt2OuDaH9vQH8AFbtTjjJjdRpFxzu2l+Rp9542M+lmsf:bqjix7xmOH8E9JzwRxO+lDAAt
Malware Config
Extracted
revengerat
SPAM
kilimanjaro.cloudns.nz:8809
kilimanjaro.run.place:8809
kilimanjaro.crabdance.com:8809
kilimanjaro.bigmoney.biz:8809
kilimanjaro.theworkpc.com:8809
burkinafaso.duckdns.org:8809
RV_MUTEX-GYuaWVCGnhpCsG
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Revengerat family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2528 set thread context of 2368 2528 2024-10-31_8987cdb78358227903ac805abf0b7e29_hiddentear_hijackloader.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-31_8987cdb78358227903ac805abf0b7e29_hiddentear_hijackloader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-31_8987cdb78358227903ac805abf0b7e29_hiddentear_hijackloader.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2528 wrote to memory of 2368 2528 2024-10-31_8987cdb78358227903ac805abf0b7e29_hiddentear_hijackloader.exe 30 PID 2528 wrote to memory of 2368 2528 2024-10-31_8987cdb78358227903ac805abf0b7e29_hiddentear_hijackloader.exe 30 PID 2528 wrote to memory of 2368 2528 2024-10-31_8987cdb78358227903ac805abf0b7e29_hiddentear_hijackloader.exe 30 PID 2528 wrote to memory of 2368 2528 2024-10-31_8987cdb78358227903ac805abf0b7e29_hiddentear_hijackloader.exe 30 PID 2528 wrote to memory of 2368 2528 2024-10-31_8987cdb78358227903ac805abf0b7e29_hiddentear_hijackloader.exe 30 PID 2528 wrote to memory of 2368 2528 2024-10-31_8987cdb78358227903ac805abf0b7e29_hiddentear_hijackloader.exe 30 PID 2528 wrote to memory of 2368 2528 2024-10-31_8987cdb78358227903ac805abf0b7e29_hiddentear_hijackloader.exe 30 PID 2528 wrote to memory of 2368 2528 2024-10-31_8987cdb78358227903ac805abf0b7e29_hiddentear_hijackloader.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-31_8987cdb78358227903ac805abf0b7e29_hiddentear_hijackloader.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-31_8987cdb78358227903ac805abf0b7e29_hiddentear_hijackloader.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\2024-10-31_8987cdb78358227903ac805abf0b7e29_hiddentear_hijackloader.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-31_8987cdb78358227903ac805abf0b7e29_hiddentear_hijackloader.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2368
-