revengerat | 13b0485c0ee5eea064cb31da5761bba5c756a45e175f5455d9d03f172b5383bb

Analysis

max time kernel
139s
max time network
153s
platform
windows10_x64
resource
win10v20210408
submitted
19/05/2021, 03:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SwiftPaymentCopy.vbs
Size 359KB
Sample210519-edrzb8wwya
SHA256 13b0485c0ee5eea064cb31da5761bba5c756a45e175f5455d9d03f172b5383bb
MD5 8a97383c3eda5985e459dd533d29bdf4
SHA1 42fbb33fa072bb8cc5cd9b0ad5d4c5b2321f3740
SHA512 6bf46c5f5585919ba4a65ab3ba464a1e132fcfc74a9e29bcb87283265fdc858e518455f2ea67075e57bbf9917a8b8de025cbbadbf70db748643c4be030ff863e
MD5 SHA1 SHA512

Score

10^/10

revengerat nyancatrevenge persistence trojan

Malware Config

Extracted

Family

revengerat

Botnet

NyanCatRevenge

185.140.53.71:3436

Mutex

e245dd7522bf4525b

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

Blocklisted process makes network request 4 IoCs

flow	pid	Process
12	380	WScript.exe
18	380	WScript.exe
22	380	WScript.exe
25	380	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
1800	Client.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftPaymentCopy.vbs	WScript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftPaymentCopy.vbs	WScript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\software\microsoft\windows\currentversion\run	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SwiftPaymentCopy = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\SwiftPaymentCopy.vbs\""	WScript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SwiftPaymentCopy = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\SwiftPaymentCopy.vbs\""	WScript.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	ip-api.com
17	ip-api.com
20	ip-api.com
24	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 1800	380	WScript.exe	75
PID 380 wrote to memory of 1800	380	WScript.exe	75
PID 380 wrote to memory of 1800	380	WScript.exe	75

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SwiftPaymentCopy.vbs"
1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:380
- C:\Users\Admin\AppData\Local\Temp\Client.exe
  "C:\Users\Admin\AppData\Local\Temp\Client.exe"
  2⤵
  - Executes dropped EXE
  PID:1800

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1800-117-0x0000000001420000-0x0000000001421000-memory.dmp

Download