Analysis
-
max time kernel
95s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10-11-2024 01:40
General
-
Target
cfd4319b50d6bfdad23a68f089b3d97dee2806360e9dee3816cc37cd2a99fe99N.exe
-
Size
1.3MB
-
MD5
7942a88fb9b1069ff48db470aeef7090
-
SHA1
ec41b9cda8700220886a1ac028709c6ae69cf93c
-
SHA256
cfd4319b50d6bfdad23a68f089b3d97dee2806360e9dee3816cc37cd2a99fe99
-
SHA512
0bdfd75db63f69648ce7bd5f9ee32efa030d3741dbbc23c0d81868ae3b0380b6a88b0f3109c250d740ad6fe67b65c3cd1f40a1af59c57f6f2194f77bd3649d1e
-
SSDEEP
24576:kq5TfcdHj4fmbpD2qB+Vf3oVGUG5y6zl8O3uXWVpA4yozB11:kUTsamRxAf3oVGUGfuXYAg
Malware Config
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Revengerat family
-
RevengeRat Executable 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfd4319b50d6bfdad23a68f089b3d97dee2806360e9dee3816cc37cd2a99fe99N.exe"C:\Users\Admin\AppData\Local\Temp\cfd4319b50d6bfdad23a68f089b3d97dee2806360e9dee3816cc37cd2a99fe99N.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe"C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe" -install -170038961 -chipderedesign -95b74d3ff5dd40ef8f0a0ce960ef14a9 - -BLUB2 -wcgnbooqjauqyxwb -23602⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
448KB
MD5b4a0146baa90f5492ab02e870e85c409
SHA17b0ea47c654d906ae28fcb182eeb5a8c3bef4978
SHA256d6587abcdb9ef01d5b6106566648a2a22fa900d1af7adb5f9fa0db831a01ee5a
SHA5120fadeb7c52088cb7cafc0a1300ffb41ab18dfcfd50a17bfac07d8581964835af89b72188162f2c080b2da9ca9f0dd83733632b857fa6d6b388bee12be697bee2
-
Filesize
260B
MD542e1d178a19796b2736775c165eee77d
SHA1531db50df6ef26c8efbeace2ca56671b9e0ab6ba
SHA2569060d97a561641d6e45f5aa2812df97d07c5f46bc3e6b1e7781467a6aa665bf7
SHA5124a1f6808cfb8bec624c7634fe80c0a22d062fee48f536c2edc74462458359d094372d1e09c1a5850b800a9c5670b93f6e904e404e58aa544cd9be118331bbd16
-
Filesize
8KB
-
Filesize
464KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB