Analysis
-
max time kernel
95s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-12-2024 04:50
General
-
Target
9ebcf4507e490de4a8bb35a0a5c9dcce7b7b8635ff80ed24eba17ffaf1041018N.exe
-
Size
1.4MB
-
MD5
3af39880dce1e8be58ebafc4e0841c90
-
SHA1
3d936d65074cc5818acdc017148a7d308f10a6ab
-
SHA256
9ebcf4507e490de4a8bb35a0a5c9dcce7b7b8635ff80ed24eba17ffaf1041018
-
SHA512
136da4ea89924af9708388ade8f8281ac3d4e9d5abbb34fcf15192630fa904603b15cd604fb91a130b80605b50e253c159199743ce3107b799fc3da347148d6f
-
SSDEEP
24576:Xq5TfcdHj4fmbe2qQEzKJ9TtrEzJwkWtIPpL0zQJ9TtFczJw2dVIP7sIb:XUTsamCxG55IPl5+IPfb
Malware Config
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Revengerat family
-
RevengeRat Executable 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ebcf4507e490de4a8bb35a0a5c9dcce7b7b8635ff80ed24eba17ffaf1041018N.exe"C:\Users\Admin\AppData\Local\Temp\9ebcf4507e490de4a8bb35a0a5c9dcce7b7b8635ff80ed24eba17ffaf1041018N.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe"C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe" -install -54404084 -chipderedesign -1e92d4da8c0742539d18be51f79e4a52 - -BLUB2 -cvbgbrjoeddxgykg -50802⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
165B
MD51dc6c9c100185411c85c0232de43dafc
SHA101c080148ce1077592ed7a2be597c7201216340a
SHA2560ce8c218583994d86c071fa4e73cf06aefe950c4abdecf2bc1f79af3addd7bf5
SHA5120df8c696a6e9f9af894b13a968f64386e96ddcb3a853f46916e2e228ef595ff1c6b40b2e3c1ab0405314fab2d4e981f8d8582402ef9e0b50abe39e94bfccb939
-
Filesize
519KB
MD5805ab85849f8437731411469e99c00e8
SHA19516be8df910ff582fe5b967c7c38be2ad334c2b
SHA256f0b28fe037ff167264b376772b78e2bf1b88cf10d3aa67527dccdf19777a2443
SHA5128a3eaeeacac3f0192dda08207901639dad163e32bc9878045498d7c34523144b136f0cd63fb44c7612fc37f39ce37dbbec9a99fe9f0b751b51b44c9f8adbfab9
-
Filesize
8KB
-
Filesize
544KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
7.3MB
-
Filesize
10.8MB
-
Filesize
3.0MB
-
Filesize
3.0MB