Analysis
-
max time kernel
157s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02-01-2025 14:21
Behavioral task
behavioral1
Sample
3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe
Resource
win7-20240729-en
windows7-x64
15 signatures
300 seconds
Behavioral task
behavioral2
Sample
3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
18 signatures
300 seconds
General
-
Target
3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe
-
Size
1.1MB
-
MD5
56ac9e72644a8dae8c1968d63a26e58a
-
SHA1
d0349d04f33400541898426438d9e036d21decc5
-
SHA256
3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c
-
SHA512
d4f5c176b3e4fda2a318fde3ec3702d9bf102bd752ee42b4549b9fd6630fdcbee20de63fc7a403f60768ac7c0a7d780bc542c8d60f4e2b9eeb19a40aba49ddc1
-
SSDEEP
24576:mq5TfcdHj4fmbi2q+0MmV0VMXeyrtoT1GokHTQoCwsC+Y:mUTsamOx9RoBVoCwT
Score
10/10
Malware Config
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Revengerat family
-
RevengeRat Executable 1 IoCs
resource yara_rule behavioral2/files/0x000a000000023b83-6.dat revengerat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe -
Executes dropped EXE 1 IoCs
pid Process 3124 dmr_72.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/1640-20-0x0000000000230000-0x00000000004A6000-memory.dmp autoit_exe -
resource yara_rule behavioral2/memory/1640-0-0x0000000000230000-0x00000000004A6000-memory.dmp upx behavioral2/memory/1640-20-0x0000000000230000-0x00000000004A6000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1640 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe 900 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3124 dmr_72.exe Token: SeDebugPrivilege 900 taskmgr.exe Token: SeSystemProfilePrivilege 900 taskmgr.exe Token: SeCreateGlobalPrivilege 900 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1640 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe 1640 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe 1640 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1640 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe 1640 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe 1640 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe 900 taskmgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3124 dmr_72.exe 3124 dmr_72.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1640 wrote to memory of 3124 1640 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe 83 PID 1640 wrote to memory of 3124 1640 3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe"C:\Users\Admin\AppData\Local\Temp\3db0e385eb53a32d61a5a35908a99317868b571e4cf7079db67fd68604da662c.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe"C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe" -install -72189998 -chipde -e37278fe332e42d1af33e4480ad52248 - -BLUB2 -pyiiyygqpuuqycei -16402⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3124
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:900
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
373KB
MD51b81fa48134378f2b8d54a41fcfcf0ca
SHA1ff6fd97bcc603890c9bdffebe992a8b95d4f2686
SHA2565e2931d27098e63b67126ec2e036d8e2f4e46814d8c777c0307e3eec3b947707
SHA512b0a9ae05da6e73729cf61ba7e58015630bd69c508fbfaa8cd6d9d116b63def1c67e7298680aa8d6d99f20d77e91dd14d880466ba21a1062498fdf3687518c8cf
-
Filesize
163B
MD58c934b48a05955c6cc934925f4c01e7d
SHA1b6300c8e23a440e85637a6e8f028ff25bee676d6
SHA25651be55dd44a7d2c782ef432971878a64040aec99c5ec0b53ac92d72bb2645992
SHA512199896d1482d91a24d896452b1a81b4c717a2781b0261aa7b32bd5fc38cdf84bf000d9487efa6bd799ae5b9b04019f5dd64bb174f5eec285d76aa9d8f3d1aa69