Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
06-12-2024 03:24
General
-
Target
243accf84fe12f5240a208450e2a7731754c371e7ec4ba5a029f1f276d7f149b.exe
-
Size
1.4MB
-
MD5
a0327a3dfc3fde27d2f30aac93738df4
-
SHA1
687e6c50b2bd9b363a6ba369ae912093fd64f3ad
-
SHA256
243accf84fe12f5240a208450e2a7731754c371e7ec4ba5a029f1f276d7f149b
-
SHA512
009a9ca43a785a29adf84d79997bcd7e5b565e9bc0d49f61ac2ec1603636e18184fc378abcaebfe322c9d49f8b147e3430e8096353ad1c4ee1723e871aab130a
-
SSDEEP
24576:kq5TfcdHj4fmb9Ve9l2qEK26wQzLMnUAFFIfHWEzKJ9TtrWgXiFurFtW0zQJ9Ttw:kUTsamC9lx6FB5lFI5w
Malware Config
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Revengerat family
-
RevengeRat Executable 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\243accf84fe12f5240a208450e2a7731754c371e7ec4ba5a029f1f276d7f149b.exe"C:\Users\Admin\AppData\Local\Temp\243accf84fe12f5240a208450e2a7731754c371e7ec4ba5a029f1f276d7f149b.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe"C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe" -install -54389916 -chipderedesign -e3f92df32818495caaad10520d2023a2 - -BLUB2 -crqzkiqeuvvzuzaj -19882⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
165B
MD59f32b66140d7e278806ce97686f5d45a
SHA124cbef0687b7201842b605c7e705bfeb799dd303
SHA2565e9e8d8211e8dd39e195b59a866838572e355cdb615a54b041633f74e06e2e2e
SHA512eec4d5966dd0f914eb5fb9d26880e398cd03e8b3bcb15f4a6ac2561f4718328ceefc34cee7693c90d7a2569ae824ef54569777835dced583cd95226a48bb7701
-
Filesize
508KB
MD53c6bc1b7a85f5fda2926b0b3b3548e30
SHA1928a536fbff196495b90e4bd51b932485b84a099
SHA2565a681e3de52b6d99d3ed2d106df0d9d70f51c38abc380d7fadd9b89756487375
SHA512e893d9c5423a4dce106844e85c10131ae57677369f9b34dca181f5110d7611e6c4a1d5eaf14e0ae19b1fa506f69eedc99a56bb06a17ab4c5b4c6451e49c382dc
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
4KB
-
Filesize
528KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB