Analysis
-
max time kernel
24s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02-12-2024 03:23
General
-
Target
48051e73118beb48417e5484a478fa1df44e9f94f757cae5f6448abe4f676d12.exe
-
Size
1.4MB
-
MD5
8d98d71d93845f9fa1edc56640df9119
-
SHA1
882baec67afd390ebf57181c5e87be83834d0307
-
SHA256
48051e73118beb48417e5484a478fa1df44e9f94f757cae5f6448abe4f676d12
-
SHA512
317dfa66137828227f5ab7b4815d8c84282ec1c24293e599dd60536d44d273c3e404c5bb9e716fb8e27ad2d7bdc3f8c13f6d29951afd4845993c72f480dab933
-
SSDEEP
24576:wq5TfcdHj4fmb9Ve9y2qrmIMeYyBMLVzjrKEzKJ9TtL3/7/ij+O0zQJ9TtD5ld:wUTsamC9yxqjw53ij+25N
Malware Config
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Revengerat family
-
RevengeRat Executable 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\48051e73118beb48417e5484a478fa1df44e9f94f757cae5f6448abe4f676d12.exe"C:\Users\Admin\AppData\Local\Temp\48051e73118beb48417e5484a478fa1df44e9f94f757cae5f6448abe4f676d12.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe"C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe" -install -54391261 -chipderedesign -b92b8e377bf743d698566c711a916b38 - -BLUB2 -smdtligyofwxjjay -27642⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
145B
MD54d26a15fba51cdc4b7668e501f65f487
SHA13d89568a11f53c3728901f6194de6039b55f6519
SHA256f4daf02c798691a08a0d1eb3a8b390d5cabee2dfa3736735d47a25fa0f3e2495
SHA512e2d38013f092ea6562194b0c7519ae0b4aec598d1f136720c73294049f48a18a8f5a0d762a1a3f6e4a1af0eebb42adfc69d46bc21b0acca38b2d5ada94d8d826
-
Filesize
508KB
MD5b65551132bca2fbdf2abbf4f73c4c457
SHA1c1c66aa7ffd537df1720dd63e3be4e009b0793f2
SHA2564b93ad5de51d187c10465421d9bf83491d35ad7ca74c4ea066ac0dc0ed9a07e0
SHA5127232c84ef8775322fbddc27603d34f0025a07503f00099c7cffa8ff0689f131f01dd38fb542cbb75d12157090824d2631a573196f2b19c8b34a3f3b4d4b46323
-
Filesize
9.9MB
-
Filesize
528KB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
3.0MB
-
Filesize
3.0MB