revengerat | bd1b202a5eed029524ad2a9947c6bf796352d4da36b43bf738ab833df3ecdaea

Analysis

max time kernel
149s
max time network
152s
platform
windows10_x64
resource
win10
submitted
16/09/2020, 13:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91KeVjpU.exe
Size 179KB
Sample200916-see7nb136x
SHA256 bd1b202a5eed029524ad2a9947c6bf796352d4da36b43bf738ab833df3ecdaea
MD5 3c550bc74a78425b2f57365650d938cb
SHA1 349efaa739a9eb5e80c12d3fc269c5ac7642f3ee
SHA512 1ffaa1a27968220cc98778ae2513f51564a35ecd4efebbe78797bde6be4d533a4a4063f6f47104b5761d204e8fffebbb3c934a4efb8f08d964e94699e1ce33f7
MD5 SHA1 SHA512

Score

10^/10

persistence trojan revengerat

Malware Config

Extracted

Family

revengerat

Botnet

Guest

dk0004-60011.portmap.io:60011

Mutex

RV_MUTEX

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

Executes dropped EXE 3 IoCs

pid	Process
1364	Client.exe
2344	Client.exe
2572	Client.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Client.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Client.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Client.exe"	Client.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2108	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2148	powershell.exe
2148	powershell.exe
2148	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3768	91KeVjpU.exe
Token: SeDebugPrivilege	1364	Client.exe
Token: SeDebugPrivilege	2148	powershell.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 1364	3768	91KeVjpU.exe	76
PID 3768 wrote to memory of 1364	3768	91KeVjpU.exe	76
PID 1364 wrote to memory of 2108	1364	Client.exe	77
PID 1364 wrote to memory of 2108	1364	Client.exe	77
PID 1364 wrote to memory of 2148	1364	Client.exe	79
PID 1364 wrote to memory of 2148	1364	Client.exe	79
PID 1364 wrote to memory of 3272	1364	Client.exe	81
PID 1364 wrote to memory of 3272	1364	Client.exe	81
PID 3272 wrote to memory of 3844	3272	vbc.exe	83
PID 3272 wrote to memory of 3844	3272	vbc.exe	83
PID 1364 wrote to memory of 1040	1364	Client.exe	84
PID 1364 wrote to memory of 1040	1364	Client.exe	84
PID 1040 wrote to memory of 980	1040	vbc.exe	86
PID 1040 wrote to memory of 980	1040	vbc.exe	86
PID 1364 wrote to memory of 1876	1364	Client.exe	87
PID 1364 wrote to memory of 1876	1364	Client.exe	87
PID 1876 wrote to memory of 1264	1876	vbc.exe	89
PID 1876 wrote to memory of 1264	1876	vbc.exe	89
PID 1364 wrote to memory of 2540	1364	Client.exe	90
PID 1364 wrote to memory of 2540	1364	Client.exe	90
PID 2540 wrote to memory of 1736	2540	vbc.exe	92
PID 2540 wrote to memory of 1736	2540	vbc.exe	92
PID 1364 wrote to memory of 2064	1364	Client.exe	93
PID 1364 wrote to memory of 2064	1364	Client.exe	93
PID 2064 wrote to memory of 1312	2064	vbc.exe	95
PID 2064 wrote to memory of 1312	2064	vbc.exe	95
PID 1364 wrote to memory of 2872	1364	Client.exe	96
PID 1364 wrote to memory of 2872	1364	Client.exe	96
PID 2872 wrote to memory of 3316	2872	vbc.exe	98
PID 2872 wrote to memory of 3316	2872	vbc.exe	98

C:\Users\Admin\AppData\Local\Temp\91KeVjpU.exe
"C:\Users\Admin\AppData\Local\Temp\91KeVjpU.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe"
  2⤵
  - Executes dropped EXE
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Client" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe"
    3⤵
    - Creates scheduled task(s)
    PID:2108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -Command [System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms'); [System.Windows.Forms.MessageBox]::Show('Hello World!','Hello!',0,64)
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2148
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pc1u3g1v.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3272
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES18C8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1EBC352CADC44BAF8F3563F3CADA3B.TMP"
      4⤵
      PID:3844
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\n-ewql6a.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1040
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1A11.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc92F90203C584677A1DDAB24CD7F657.TMP"
      4⤵
      PID:980
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\plaj4mfb.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1876
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1D2D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBEB294F4FCA2494794F521485FE79ED.TMP"
      4⤵
      PID:1264
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yopi9pgd.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1D9B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc86488CC628B24BD581561236AE44513.TMP"
      4⤵
      PID:1736
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mxazewcg.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2064
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1E08.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc971E9D246BC446E3926B2E722E211531.TMP"
      4⤵
      PID:1312
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\sybzgobm.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2872
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1E85.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc783E54BBA2DB4444A34E6424DC53F63.TMP"
      4⤵
      PID:3316

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe"
1⤵
- Executes dropped EXE
PID:2344

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe"
1⤵
- Executes dropped EXE
PID:2572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1364-4-0x00007FFA44590000-0x00007FFA44F30000-memory.dmp

Download

memory/2148-8-0x00007FFA41C10000-0x00007FFA425FC000-memory.dmp

Download

memory/2148-10-0x0000023255860000-0x0000023255861000-memory.dmp

Download

memory/2148-12-0x000002326F560000-0x000002326F561000-memory.dmp

Download

memory/2344-47-0x00007FFA44590000-0x00007FFA44F30000-memory.dmp

Download

memory/2572-50-0x00007FFA44590000-0x00007FFA44F30000-memory.dmp

Download

memory/3768-0-0x00007FFA44590000-0x00007FFA44F30000-memory.dmp

Download