revengerat | c5d1c57f289c7f9f692ad7971b08ec1392082eda028916ff33c27da1c8c3326b

General

Target

TENDER_N.EXE
Size

742KB
MD5

868ca3e861260b5080c62eda3880c425
SHA1

8d1dd70950daa651261a429baa0f63332bc690ca
SHA256

c125ad338e09169f93f9ba82a8eb533619ae2087dd2a84563da1c6a3ef68e3d1
SHA512

5ac65a3230f465a2fccad3101261500a2fe923d6ee67990e235b255a8f85529250a93fdbac5a304c93207605f8186bbd4500fb8febb6ffd0e8a8e44b159b19af

Score

10^/10

revengerat nyancatrevenge evasion persistence trojan

Malware Config

Extracted

Family

revengerat

Botnet

NyanCatRevenge

C2

hpdndbnb.duckdns.org:2404

Mutex

10eef43648e54083

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

TENDER_N.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TENDER_N.EXE\""	TENDER_N.EXE

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Drops startup file 2 IoCs

Processes:

TENDER_N.EXE

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TENDER_N.EXE	TENDER_N.EXE
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TENDER_N.EXE	TENDER_N.EXE

Windows security modification 2 TTPs 9 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

TENDER_N.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	TENDER_N.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TENDER_N.EXE = "0"	TENDER_N.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	TENDER_N.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	TENDER_N.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	TENDER_N.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions	TENDER_N.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\TENDER_N.EXE = "0"	TENDER_N.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection	TENDER_N.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	TENDER_N.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

TENDER_N.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TENDER_N.EXE"	TENDER_N.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\TENDER_N.EXE = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TENDER_N.EXE"	TENDER_N.EXE

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of SetThreadContext 1 IoCs

Processes:

TENDER_N.EXE

description pid process target process

PID 1832 set thread context of 824 1832 TENDER_N.EXE TENDER_N.EXE

description	pid	process	target process
PID 1832 set thread context of 824	1832	TENDER_N.EXE	TENDER_N.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

TENDER_N.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0	TENDER_N.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	TENDER_N.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid	process
1988	powershell.exe
1364	powershell.exe
1860	powershell.exe
1280	powershell.exe
1860	powershell.exe
1280	powershell.exe
1364	powershell.exe
1988	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

TENDER_N.EXEpowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1832	TENDER_N.EXE
Token: SeDebugPrivilege	1988	powershell.exe
Token: SeDebugPrivilege	1364	powershell.exe
Token: SeDebugPrivilege	1860	powershell.exe
Token: SeDebugPrivilege	1280	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

TENDER_N.EXE

description	pid	process	target process
PID 1832 wrote to memory of 1364	1832	TENDER_N.EXE	powershell.exe
PID 1832 wrote to memory of 1364	1832	TENDER_N.EXE	powershell.exe
PID 1832 wrote to memory of 1364	1832	TENDER_N.EXE	powershell.exe
PID 1832 wrote to memory of 1364	1832	TENDER_N.EXE	powershell.exe
PID 1832 wrote to memory of 1988	1832	TENDER_N.EXE	powershell.exe
PID 1832 wrote to memory of 1988	1832	TENDER_N.EXE	powershell.exe
PID 1832 wrote to memory of 1988	1832	TENDER_N.EXE	powershell.exe
PID 1832 wrote to memory of 1988	1832	TENDER_N.EXE	powershell.exe
PID 1832 wrote to memory of 1280	1832	TENDER_N.EXE	powershell.exe
PID 1832 wrote to memory of 1280	1832	TENDER_N.EXE	powershell.exe
PID 1832 wrote to memory of 1280	1832	TENDER_N.EXE	powershell.exe
PID 1832 wrote to memory of 1280	1832	TENDER_N.EXE	powershell.exe
PID 1832 wrote to memory of 1860	1832	TENDER_N.EXE	powershell.exe
PID 1832 wrote to memory of 1860	1832	TENDER_N.EXE	powershell.exe
PID 1832 wrote to memory of 1860	1832	TENDER_N.EXE	powershell.exe
PID 1832 wrote to memory of 1860	1832	TENDER_N.EXE	powershell.exe
PID 1832 wrote to memory of 824	1832	TENDER_N.EXE	TENDER_N.EXE
PID 1832 wrote to memory of 824	1832	TENDER_N.EXE	TENDER_N.EXE
PID 1832 wrote to memory of 824	1832	TENDER_N.EXE	TENDER_N.EXE
PID 1832 wrote to memory of 824	1832	TENDER_N.EXE	TENDER_N.EXE
PID 1832 wrote to memory of 824	1832	TENDER_N.EXE	TENDER_N.EXE
PID 1832 wrote to memory of 824	1832	TENDER_N.EXE	TENDER_N.EXE
PID 1832 wrote to memory of 824	1832	TENDER_N.EXE	TENDER_N.EXE
PID 1832 wrote to memory of 824	1832	TENDER_N.EXE	TENDER_N.EXE
PID 1832 wrote to memory of 824	1832	TENDER_N.EXE	TENDER_N.EXE

C:\Users\Admin\AppData\Local\Temp\TENDER_N.EXE
"C:\Users\Admin\AppData\Local\Temp\TENDER_N.EXE"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TENDER_N.EXE" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1364

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TENDER_N.EXE" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1988

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TENDER_N.EXE" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1280

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\TENDER_N.EXE" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1860

C:\Users\Admin\AppData\Local\Temp\TENDER_N.EXE
"C:\Users\Admin\AppData\Local\Temp\TENDER_N.EXE"
2⤵
- Checks processor information in registry
PID:824

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

5

T1112

Disabling Security Tools

3

T1089

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
a55c6ab2fb93a26310b4abbe44a6c713

SHA1
bc30f2c3420719828b22c860a57b30e86438acd2

SHA256
6daf1441a30c731070e4ea0e529736e1c7863ebba5d232cb4102175001a87af2

SHA512
9e74574ebe52a4237d39b1fa4d098946f466577f73c3f010de8b463459393c9ae60b32b252e52913a1a1327d9178cf302cff3783208f8a5df5e4f9bd8695015d

Download Submit
memory/824-33-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/824-32-0x000000000040502E-mapping.dmp

Download
memory/824-31-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/824-35-0x0000000074900000-0x0000000074FEE000-memory.dmp

Filesize
6.9MB

Download
memory/824-34-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1280-13-0x0000000074900000-0x0000000074FEE000-memory.dmp

Filesize
6.9MB

Download
memory/1280-15-0x0000000001D80000-0x0000000001D81000-memory.dmp

Filesize
4KB

Download
memory/1280-8-0x0000000000000000-mapping.dmp

Download
memory/1280-19-0x0000000004840000-0x0000000004841000-memory.dmp

Filesize
4KB

Download
memory/1280-27-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/1364-11-0x0000000074900000-0x0000000074FEE000-memory.dmp

Filesize
6.9MB

Download
memory/1364-6-0x0000000000000000-mapping.dmp

Download
memory/1832-5-0x0000000000350000-0x000000000036B000-memory.dmp

Filesize
108KB

Download
memory/1832-2-0x0000000074900000-0x0000000074FEE000-memory.dmp

Filesize
6.9MB

Download
memory/1832-3-0x0000000000E00000-0x0000000000E01000-memory.dmp

Filesize
4KB

Download
memory/1860-9-0x0000000000000000-mapping.dmp

Download
memory/1860-23-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/1860-12-0x0000000074900000-0x0000000074FEE000-memory.dmp

Filesize
6.9MB

Download
memory/1860-40-0x0000000005650000-0x0000000005651000-memory.dmp

Filesize
4KB

Download
memory/1860-45-0x0000000005710000-0x0000000005711000-memory.dmp

Filesize
4KB

Download
memory/1860-46-0x0000000006130000-0x0000000006131000-memory.dmp

Filesize
4KB

Download
memory/1988-14-0x0000000074900000-0x0000000074FEE000-memory.dmp

Filesize
6.9MB

Download
memory/1988-7-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads