Analysis
-
max time kernel
93s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-01-2025 09:56
General
-
Target
81bb81260c6182c6209baa19c4c6b0fc852c7db66850d10bc442f923f43be8dfN.exe
-
Size
1.4MB
-
MD5
8d61b160122f042623818b6b04a75330
-
SHA1
3db6b0029721bb9d8ef8171cd9247e107802ce5d
-
SHA256
81bb81260c6182c6209baa19c4c6b0fc852c7db66850d10bc442f923f43be8df
-
SHA512
92874240826994b6126305df63299041405258342e70d0956274e3460e807b52b57e0aa758c44fa6943ec794b074ef803e2a0f91d4bfeb1735f527b3a69dc539
-
SSDEEP
24576:2q5TfcdHj4fmbqOw2qdS0smVkVMyvLlnhWEzKJ9TtLvgl/piakl3Jro0zQJ9TtDT:2UTsamVwxUlC53akl325/
Malware Config
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Revengerat family
-
RevengeRat Executable 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\81bb81260c6182c6209baa19c4c6b0fc852c7db66850d10bc442f923f43be8dfN.exe"C:\Users\Admin\AppData\Local\Temp\81bb81260c6182c6209baa19c4c6b0fc852c7db66850d10bc442f923f43be8dfN.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe"C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe" -install -54458834 -chipderedesign -30b3a4f7f5aa457aa22c7c289e14df87 - -BLUB2 -rxglnupbozqoosyk -50602⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
504KB
MD525bbe781403dbd685377647a982df817
SHA15b5ea2f5cec496f99d245a68c884c09f5849e037
SHA256ca718f45191351cdda8ed5ca2c8074c899d32837dd019d325c72e4123b5edbfc
SHA512595644e2542194371d2f3acb27932717464aa9b6e661bc71e5058b8189a433cd1938b49a9c3f241c3a6a675e93cfed97b336a125e2437358a37b0fb6f9714aa2
-
Filesize
159B
MD5a33b52a6f0de169aa48c8cad63a9bb68
SHA19f0ea39425fc5006543255becb8a96e46972aab8
SHA25680920af8710cb61b7764b31328d550b3dd9b5aa817b083477983ff9eda016549
SHA51288042f7771ac76c937fdf5448312f261d5fd28e1d26497d8aa2b2ded1884e41b7bf66a875097173c45b736f8940b124cfb635ca7d4ccb31beff4dae900fadaee
-
Filesize
8KB
-
Filesize
520KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
7.3MB
-
Filesize
10.8MB
-
Filesize
3.0MB
-
Filesize
3.0MB