Analysis
-
max time kernel
117s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
16-05-2024 18:55
General
-
Target
Lime-Worm-0.5.8D\database32.exe
-
Size
2.8MB
-
MD5
7028559abf0ccebf9692eb24651b4be1
-
SHA1
474e96eb203f4978c9c6e7568f4b7a9b20c329af
-
SHA256
b437592443e6c798ac25566400e1a1b4f29ef76a63bc5cd112316f5f4f34e45e
-
SHA512
3d0d22d68dda3fb8b27a31216c9a31387e8937645cd0bce7ca5e89f91b4f3addc6d05244cd9617acbecd26547adb563f7e40e516d398d4c741eefb295ff10f3e
-
SSDEEP
24576:1dTuyaUzkI/oMi5QNCRzJ4ZBoPUDmJbedDxCPEicdjFhu8bU:1dTuyaU/or+AkyNyXicdjFhuC
Score
10/10
Malware Config
Extracted
Family
revengerat
Mutex
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
RevengeRat Executable 1 IoCs
-
Modifies registry class 3 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lime-Worm-0.5.8D\database32.exe"C:\Users\Admin\AppData\Local\Temp\Lime-Worm-0.5.8D\database32.exe"1⤵
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2212-0-0x000007FEF5E7E000-0x000007FEF5E7F000-memory.dmpFilesize
4KB
-
memory/2212-1-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmpFilesize
9.6MB
-
memory/2212-2-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmpFilesize
9.6MB
-
memory/2212-3-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmpFilesize
9.6MB
-
memory/2212-4-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmpFilesize
9.6MB
-
memory/2212-5-0x000000001AFF0000-0x000000001B048000-memory.dmpFilesize
352KB
-
memory/2212-9-0x00000000002B0000-0x00000000002B8000-memory.dmpFilesize
32KB
-
memory/2212-10-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmpFilesize
9.6MB