revengerat | 36e41f411caa8c2bcdb0d95ef65363f6a5c3aece45d1b2ff476a7d806b779386

General

Target

36e41f411caa8c2bcdb0d95ef65363f6a5c3aece45d1b2ff476a7d806b779386.exe
Size

1022KB
MD5

000df32a4515aeedb77f7e2968c4d7b9
SHA1

715e7348aba3664c789f6375b728373ec1c185aa
SHA256

36e41f411caa8c2bcdb0d95ef65363f6a5c3aece45d1b2ff476a7d806b779386
SHA512

74e07b60d942f8907b66e6eb74e1984e05111c87db085bfae5df02dea94bc409de82df54bb1b4cab7313cc052a614331c067f0852c5cbdee581fb21bdd3f578e

Score

10^/10

revengerat ene20 stealer trojan

Malware Config

Extracted

Family

revengerat

Botnet

ENE20

C2

rever2019.duckdns.org:4230

Mutex

RV_MUTEX-GaKuSAtYBxGgZ

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 4 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/1308-60-0x0000000000400000-0x0000000000408000-memory.dmp	revengerat
behavioral1/memory/1308-64-0x0000000000405DEE-mapping.dmp	revengerat
behavioral1/memory/1308-65-0x0000000000400000-0x0000000000408000-memory.dmp	revengerat
behavioral1/memory/1308-66-0x0000000000400000-0x0000000000408000-memory.dmp	revengerat

Suspicious use of SetThreadContext 1 IoCs

Processes:

36e41f411caa8c2bcdb0d95ef65363f6a5c3aece45d1b2ff476a7d806b779386.exe

description	pid	process	target process
PID 332 set thread context of 1308	332	36e41f411caa8c2bcdb0d95ef65363f6a5c3aece45d1b2ff476a7d806b779386.exe	RegAsm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1244 schtasks.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 1308 RegAsm.exe

pid	process
1244	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	1308	RegAsm.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

36e41f411caa8c2bcdb0d95ef65363f6a5c3aece45d1b2ff476a7d806b779386.exe

description	pid	process	target process
PID 332 wrote to memory of 1308	332	36e41f411caa8c2bcdb0d95ef65363f6a5c3aece45d1b2ff476a7d806b779386.exe	RegAsm.exe
PID 332 wrote to memory of 1308	332	36e41f411caa8c2bcdb0d95ef65363f6a5c3aece45d1b2ff476a7d806b779386.exe	RegAsm.exe
PID 332 wrote to memory of 1308	332	36e41f411caa8c2bcdb0d95ef65363f6a5c3aece45d1b2ff476a7d806b779386.exe	RegAsm.exe
PID 332 wrote to memory of 1308	332	36e41f411caa8c2bcdb0d95ef65363f6a5c3aece45d1b2ff476a7d806b779386.exe	RegAsm.exe
PID 332 wrote to memory of 1308	332	36e41f411caa8c2bcdb0d95ef65363f6a5c3aece45d1b2ff476a7d806b779386.exe	RegAsm.exe
PID 332 wrote to memory of 1308	332	36e41f411caa8c2bcdb0d95ef65363f6a5c3aece45d1b2ff476a7d806b779386.exe	RegAsm.exe
PID 332 wrote to memory of 1308	332	36e41f411caa8c2bcdb0d95ef65363f6a5c3aece45d1b2ff476a7d806b779386.exe	RegAsm.exe
PID 332 wrote to memory of 1308	332	36e41f411caa8c2bcdb0d95ef65363f6a5c3aece45d1b2ff476a7d806b779386.exe	RegAsm.exe
PID 332 wrote to memory of 1308	332	36e41f411caa8c2bcdb0d95ef65363f6a5c3aece45d1b2ff476a7d806b779386.exe	RegAsm.exe
PID 332 wrote to memory of 1244	332	36e41f411caa8c2bcdb0d95ef65363f6a5c3aece45d1b2ff476a7d806b779386.exe	schtasks.exe
PID 332 wrote to memory of 1244	332	36e41f411caa8c2bcdb0d95ef65363f6a5c3aece45d1b2ff476a7d806b779386.exe	schtasks.exe
PID 332 wrote to memory of 1244	332	36e41f411caa8c2bcdb0d95ef65363f6a5c3aece45d1b2ff476a7d806b779386.exe	schtasks.exe
PID 332 wrote to memory of 1244	332	36e41f411caa8c2bcdb0d95ef65363f6a5c3aece45d1b2ff476a7d806b779386.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\36e41f411caa8c2bcdb0d95ef65363f6a5c3aece45d1b2ff476a7d806b779386.exe
"C:\Users\Admin\AppData\Local\Temp\36e41f411caa8c2bcdb0d95ef65363f6a5c3aece45d1b2ff476a7d806b779386.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:332

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1308

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\SysWOW64\schtasks.exe" /create /tn /tr "C:\Users\Admin\AppData\Roaming\findstr\BdeSysprep.exe" /sc minute /mo 1 /F
2⤵
- Creates scheduled task(s)
PID:1244

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/332-59-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

Filesize
8KB

Download
memory/332-68-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/1244-69-0x0000000000000000-mapping.dmp

Download
memory/1308-60-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1308-64-0x0000000000405DEE-mapping.dmp

Download
memory/1308-65-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1308-66-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1308-70-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads