Analysis
-
max time kernel
103s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
06-11-2024 01:31
General
-
Target
09605dc7fa490c072cac25d2d269ab07c58e099870657c9fbefcb7d3b8cb233dN.exe
-
Size
1.4MB
-
MD5
6eef1dc5a1688c72aa00481401d307b0
-
SHA1
3cd9b23fcbc55090698b358ed730f7ce15f58db9
-
SHA256
09605dc7fa490c072cac25d2d269ab07c58e099870657c9fbefcb7d3b8cb233d
-
SHA512
89aabe324f60bd659478d710873587c2678bdd3b9d77f572ad8a3d019d03a45bf9bec5ab3dab1563e7b0f5da50a2c19c8fc83b166594671c5bb9ad4fc85791ce
-
SSDEEP
24576:Wq5TfcdHj4fmbqOw2qBS0smVkVMyvLlnhWEzKJ9TtLvgl/piakl3Jro0zQJ9TtDs:WUTsamVwxolC53akl325A
Malware Config
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Revengerat family
-
RevengeRat Executable 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\09605dc7fa490c072cac25d2d269ab07c58e099870657c9fbefcb7d3b8cb233dN.exe"C:\Users\Admin\AppData\Local\Temp\09605dc7fa490c072cac25d2d269ab07c58e099870657c9fbefcb7d3b8cb233dN.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe"C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe" -install -54427628 -chipderedesign -a9254044700e472bb720a88324b810ec - -BLUB2 -frxzeavncumpmasz -41322⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
504KB
MD525bbe781403dbd685377647a982df817
SHA15b5ea2f5cec496f99d245a68c884c09f5849e037
SHA256ca718f45191351cdda8ed5ca2c8074c899d32837dd019d325c72e4123b5edbfc
SHA512595644e2542194371d2f3acb27932717464aa9b6e661bc71e5058b8189a433cd1938b49a9c3f241c3a6a675e93cfed97b336a125e2437358a37b0fb6f9714aa2
-
Filesize
163B
MD55ebfb0f0a54c8e5131f5ea941f4a958e
SHA1cb891032a42c724fd141d5e16600b59c356e305d
SHA256d5948348d9bf21f8231a0a9a7fb27935bfd76019f952e333515e799f57e54eb6
SHA512a5b8010cf022e66d4a4e9316ebec768653308b037287d634a07eb251ab4189b589b10632f91f3ebb9e3afc466c7b97fcaa3226fdda535abf68a35e79b0f64cc7
-
Filesize
8KB
-
Filesize
520KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
1.7MB
-
Filesize
10.8MB
-
Filesize
3.0MB
-
Filesize
3.0MB