revengerat | 1423053f90855d33858db47f354055b660943104c1c18f848c9b7b415979dc5f | Triage

Resubmissions

03/07/2024, 16:04

240703-thygmaycpc 10

01/07/2024, 18:12

240701-ws6xvswbkj 10

01/07/2024, 18:03

240701-wm5sls1gka 10

01/07/2024, 18:03

240701-wm39sa1gjf 10

01/07/2024, 18:03

240701-wm2e7avhkj 10

01/07/2024, 18:03

240701-wmzxcs1fre 10

01/07/2024, 18:02

240701-wmzats1frc 10

01/07/2024, 18:02

240701-wmvbwa1fqh 10

22/11/2023, 17:02

231122-vkac9adg64 10

Analysis

max time kernel
1801s
max time network
1811s
platform
windows10_x64
resource
win10v20201028
submitted
19/11/2020, 13:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe

Score

10^/10

revengerat victime persistence stealer trojan

Malware Config

Extracted

Family

revengerat

Botnet

Victime

C2

cocohack.dtdns.net:84

Mutex

RV_MUTEX-OKuSAtYBxGgZHx

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 2 IoCs

resource	yara_rule
behavioral15/files/0x000300000001a2df-2.dat	revengerat
behavioral15/files/0x000300000001a2df-3.dat	revengerat

Executes dropped EXE 1 IoCs

pid	Process
3980	Client.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client = "C:\\Users\\Admin\\AppData\\Roaming\\Client.exe"	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3944	948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Token: SeDebugPrivilege	3980	Client.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 3980	3944	948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe	78
PID 3944 wrote to memory of 3980	3944	948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe	78

C:\Users\Admin\AppData\Local\Temp\948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
"C:\Users\Admin\AppData\Local\Temp\948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Users\Admin\AppData\Roaming\Client.exe
  "C:\Users\Admin\AppData\Roaming\Client.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:3980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3944-0-0x00007FF81EAB0000-0x00007FF81F450000-memory.dmp

Filesize
9.6MB

Download
memory/3980-4-0x00007FF81EAB0000-0x00007FF81F450000-memory.dmp

Filesize
9.6MB

Download