revengerat | bd1b202a5eed029524ad2a9947c6bf796352d4da36b43bf738ab833df3ecdaea

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7v200722
submitted
16/09/2020, 13:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91KeVjpU.exe
Size 179KB
Sample200916-see7nb136x
SHA256 bd1b202a5eed029524ad2a9947c6bf796352d4da36b43bf738ab833df3ecdaea
MD5 3c550bc74a78425b2f57365650d938cb
SHA1 349efaa739a9eb5e80c12d3fc269c5ac7642f3ee
SHA512 1ffaa1a27968220cc98778ae2513f51564a35ecd4efebbe78797bde6be4d533a4a4063f6f47104b5761d204e8fffebbb3c934a4efb8f08d964e94699e1ce33f7
MD5 SHA1 SHA512

Score

10^/10

trojan revengerat persistence

Malware Config

Extracted

Family

revengerat

Botnet

Guest

dk0004-60011.portmap.io:60011

Mutex

RV_MUTEX

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

Executes dropped EXE 1 IoCs

pid	Process
1556	Client.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Client.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Client.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Client.exe"	Client.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
932	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2028	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1108	91KeVjpU.exe
Token: SeDebugPrivilege	1556	Client.exe
Token: SeDebugPrivilege	2028	powershell.exe

Suspicious use of WriteProcessMemory 69 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 1556	1108	91KeVjpU.exe	28
PID 1108 wrote to memory of 1556	1108	91KeVjpU.exe	28
PID 1108 wrote to memory of 1556	1108	91KeVjpU.exe	28
PID 1556 wrote to memory of 932	1556	Client.exe	29
PID 1556 wrote to memory of 932	1556	Client.exe	29
PID 1556 wrote to memory of 932	1556	Client.exe	29
PID 1556 wrote to memory of 2028	1556	Client.exe	30
PID 1556 wrote to memory of 2028	1556	Client.exe	30
PID 1556 wrote to memory of 2028	1556	Client.exe	30
PID 1556 wrote to memory of 1224	1556	Client.exe	33
PID 1556 wrote to memory of 1224	1556	Client.exe	33
PID 1556 wrote to memory of 1224	1556	Client.exe	33
PID 1224 wrote to memory of 952	1224	vbc.exe	35
PID 1224 wrote to memory of 952	1224	vbc.exe	35
PID 1224 wrote to memory of 952	1224	vbc.exe	35
PID 1556 wrote to memory of 1492	1556	Client.exe	36
PID 1556 wrote to memory of 1492	1556	Client.exe	36
PID 1556 wrote to memory of 1492	1556	Client.exe	36
PID 1492 wrote to memory of 1544	1492	vbc.exe	38
PID 1492 wrote to memory of 1544	1492	vbc.exe	38
PID 1492 wrote to memory of 1544	1492	vbc.exe	38
PID 1556 wrote to memory of 1756	1556	Client.exe	39
PID 1556 wrote to memory of 1756	1556	Client.exe	39
PID 1556 wrote to memory of 1756	1556	Client.exe	39
PID 1756 wrote to memory of 1636	1756	vbc.exe	41
PID 1756 wrote to memory of 1636	1756	vbc.exe	41
PID 1756 wrote to memory of 1636	1756	vbc.exe	41
PID 1556 wrote to memory of 1688	1556	Client.exe	42
PID 1556 wrote to memory of 1688	1556	Client.exe	42
PID 1556 wrote to memory of 1688	1556	Client.exe	42
PID 1688 wrote to memory of 1508	1688	vbc.exe	44
PID 1688 wrote to memory of 1508	1688	vbc.exe	44
PID 1688 wrote to memory of 1508	1688	vbc.exe	44
PID 1556 wrote to memory of 1196	1556	Client.exe	45
PID 1556 wrote to memory of 1196	1556	Client.exe	45
PID 1556 wrote to memory of 1196	1556	Client.exe	45
PID 1196 wrote to memory of 1044	1196	vbc.exe	47
PID 1196 wrote to memory of 1044	1196	vbc.exe	47
PID 1196 wrote to memory of 1044	1196	vbc.exe	47
PID 1556 wrote to memory of 1664	1556	Client.exe	48
PID 1556 wrote to memory of 1664	1556	Client.exe	48
PID 1556 wrote to memory of 1664	1556	Client.exe	48
PID 1664 wrote to memory of 1992	1664	vbc.exe	50
PID 1664 wrote to memory of 1992	1664	vbc.exe	50
PID 1664 wrote to memory of 1992	1664	vbc.exe	50
PID 1556 wrote to memory of 1908	1556	Client.exe	51
PID 1556 wrote to memory of 1908	1556	Client.exe	51
PID 1556 wrote to memory of 1908	1556	Client.exe	51
PID 1908 wrote to memory of 2036	1908	vbc.exe	53
PID 1908 wrote to memory of 2036	1908	vbc.exe	53
PID 1908 wrote to memory of 2036	1908	vbc.exe	53
PID 1556 wrote to memory of 1572	1556	Client.exe	54
PID 1556 wrote to memory of 1572	1556	Client.exe	54
PID 1556 wrote to memory of 1572	1556	Client.exe	54
PID 1572 wrote to memory of 276	1572	vbc.exe	56
PID 1572 wrote to memory of 276	1572	vbc.exe	56
PID 1572 wrote to memory of 276	1572	vbc.exe	56
PID 1556 wrote to memory of 868	1556	Client.exe	57
PID 1556 wrote to memory of 868	1556	Client.exe	57
PID 1556 wrote to memory of 868	1556	Client.exe	57
PID 868 wrote to memory of 1788	868	vbc.exe	59
PID 868 wrote to memory of 1788	868	vbc.exe	59
PID 868 wrote to memory of 1788	868	vbc.exe	59
PID 1556 wrote to memory of 1076	1556	Client.exe	60
PID 1556 wrote to memory of 1076	1556	Client.exe	60
PID 1556 wrote to memory of 1076	1556	Client.exe	60
PID 1076 wrote to memory of 948	1076	vbc.exe	62
PID 1076 wrote to memory of 948	1076	vbc.exe	62
PID 1076 wrote to memory of 948	1076	vbc.exe	62

C:\Users\Admin\AppData\Local\Temp\91KeVjpU.exe
"C:\Users\Admin\AppData\Local\Temp\91KeVjpU.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe"
  2⤵
  - Executes dropped EXE
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1556
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Client" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe"
    3⤵
    - Creates scheduled task(s)
    PID:932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -Command [System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms'); [System.Windows.Forms.MessageBox]::Show('Hello World!','Hello!',0,64)
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2028
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\sveqahvp.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1224
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES34C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc34B.tmp"
      4⤵
      PID:952
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\llpzy_ah.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1492
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3E8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3E7.tmp"
      4⤵
      PID:1544
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\8oidx0wt.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1756
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4D2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4D1.tmp"
      4⤵
      PID:1636
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\owryz6fm.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1688
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES58D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc58C.tmp"
      4⤵
      PID:1508
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tssnp5jz.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1196
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES61A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc619.tmp"
      4⤵
      PID:1044
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dxhrsmuf.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1664
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6D5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6D4.tmp"
      4⤵
      PID:1992
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jp2e3vti.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1908
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7CF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7CE.tmp"
      4⤵
      PID:2036
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\z5qojyol.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1572
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES88A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc879.tmp"
      4⤵
      PID:276
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hbekrg6x.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:868
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8F7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8F6.tmp"
      4⤵
      PID:1788
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yxqt51aa.cmdline"
    3⤵
    PID:1076
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES964.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc963.tmp"
      4⤵
      PID:948

C:\Windows\system32\taskeng.exe
taskeng.exe {4D100772-FAC5-4C85-93C5-B5C4B249B838} S-1-5-21-2090973689-680783404-4292415065-1000:UCQFZDUI\Admin:Interactive:[1]
1⤵
PID:1636

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1108-1-0x000007FEF5D00000-0x000007FEF669D000-memory.dmp

Download

memory/1108-0-0x000007FEF5D00000-0x000007FEF669D000-memory.dmp

Download

memory/1556-6-0x000007FEF5D00000-0x000007FEF669D000-memory.dmp

Download

memory/1556-5-0x000007FEF5D00000-0x000007FEF669D000-memory.dmp

Download

memory/2028-14-0x0000000002590000-0x0000000002591000-memory.dmp

Download

memory/2028-18-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/2028-17-0x00000000025D0000-0x00000000025D1000-memory.dmp

Download

memory/2028-15-0x000000001AA90000-0x000000001AA91000-memory.dmp

Download

memory/2028-11-0x000007FEF1510000-0x000007FEF1EFC000-memory.dmp

Download