Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31-12-2024 23:51
General
-
Target
d57b4964f5bd056d62883c322bdd6ba03b6378256f2338c17afdb07bd05197ed.exe
-
Size
1.4MB
-
MD5
fadb7bce05967086092f5b763a567823
-
SHA1
b8f791a06531e2ad48aec8cbb76f4ed00e47acea
-
SHA256
d57b4964f5bd056d62883c322bdd6ba03b6378256f2338c17afdb07bd05197ed
-
SHA512
67503f7be55361f45ca9452c6f4a95ce3463083f34e205b74fab809e1cddb0071ddfb1c62de666e9a336b36946e6d1c3323b0a45f0b23c9bc818871b4612e791
-
SSDEEP
24576:kq5TfcdHj4fmbO2qVEzKJ9Ttr8LnUA8WYtWYzYPVR0zQJ9TtFaLnUMvkYtWYnYPR:kUTsamSxP52YtWYzYPz5DYtWYnYPR
Malware Config
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Revengerat family
-
RevengeRat Executable 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d57b4964f5bd056d62883c322bdd6ba03b6378256f2338c17afdb07bd05197ed.exe"C:\Users\Admin\AppData\Local\Temp\d57b4964f5bd056d62883c322bdd6ba03b6378256f2338c17afdb07bd05197ed.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe"C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe" -install -54426677 -dhtechradar -84eb196484af4669a0e795936befce01 - -landingpage -hqykbvppiiyzrgya -43562⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
519KB
MD5d2731d6a0df7de11fdaa97324d9cf441
SHA1be01761e55b4d67abbea5b942f7928f192eacae8
SHA2565c6d2335c09d95442f681cf58c6010287b241054c1ce9497f04b1504550e4661
SHA512e25391ba10917cbdbcafc1d94472a93d62782173b5dd90dc820ecd5063edd6ae3dd00c1075b1d10830ec7d5877aff828717e56b46d1d16262189cb9a8df621e0
-
Filesize
91B
MD5d6763236e5d0fd663c7532f5f8f36a98
SHA1735e0fb871ef67e608d7c5338ca5b595a8999997
SHA256e661c9b1344b95461ed96227401473ec20950c59c2882f8b51d523d976079a02
SHA512fc64b31bb77a8fb97ed0618919b2bd375611c5e0f189d571d30cdfca1c90eaba82472d36a74f965de1eafefb99d51b4083fcca2dcc7b20d4fe7ab7638862f4e4
-
Filesize
8KB
-
Filesize
544KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
3.0MB
-
Filesize
3.0MB