revengerat | 86ff5481ed934d43bc54c3a0d9989958c0de24aec0fb74404dac36a594193ed2

General

Target

Inquiry for PR#4200027219 2.exe
Size

999KB
MD5

97ef10ac31850230463b782f6739b5b5
SHA1

4d371844e5961b734c69da1d51d288b295a40961
SHA256

86ff5481ed934d43bc54c3a0d9989958c0de24aec0fb74404dac36a594193ed2
SHA512

d465dcd228c6920e31030fa06b8168815081a9012f6c3fc45de853537058b13de716cebb1af6964dab0ecdfb33969ea3e247da9081c5b7e13f24e1d0c15c5a60

Score

10^/10

revengerat degrace trojan

Malware Config

Extracted

Family

revengerat

Botnet

DEGRACE

C2

77.247.110.178:5040

Mutex

RV_MUTEX-MB4S0YIGA6UFWH10GXQLHP

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Suspicious use of SetThreadContext 1 IoCs

Processes:

Inquiry for PR#4200027219 2.exe

description pid process target process

PID 856 set thread context of 1984 856 Inquiry for PR#4200027219 2.exe MSBuild.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 856 set thread context of 1984	856	Inquiry for PR#4200027219 2.exe	MSBuild.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3596 schtasks.exe

pid	process
3596	schtasks.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

Inquiry for PR#4200027219 2.exe

description	pid	process	target process
PID 856 wrote to memory of 3596	856	Inquiry for PR#4200027219 2.exe	schtasks.exe
PID 856 wrote to memory of 3596	856	Inquiry for PR#4200027219 2.exe	schtasks.exe
PID 856 wrote to memory of 3596	856	Inquiry for PR#4200027219 2.exe	schtasks.exe
PID 856 wrote to memory of 1984	856	Inquiry for PR#4200027219 2.exe	MSBuild.exe
PID 856 wrote to memory of 1984	856	Inquiry for PR#4200027219 2.exe	MSBuild.exe
PID 856 wrote to memory of 1984	856	Inquiry for PR#4200027219 2.exe	MSBuild.exe
PID 856 wrote to memory of 1984	856	Inquiry for PR#4200027219 2.exe	MSBuild.exe
PID 856 wrote to memory of 1984	856	Inquiry for PR#4200027219 2.exe	MSBuild.exe
PID 856 wrote to memory of 1984	856	Inquiry for PR#4200027219 2.exe	MSBuild.exe
PID 856 wrote to memory of 1984	856	Inquiry for PR#4200027219 2.exe	MSBuild.exe
PID 856 wrote to memory of 1984	856	Inquiry for PR#4200027219 2.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\Inquiry for PR#4200027219 2.exe
"C:\Users\Admin\AppData\Local\Temp\Inquiry for PR#4200027219 2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:856
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\viHuopmlnVpk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6221.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3596
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Checks processor information in registry
  PID:1984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6221.tmp

MD5
fe52556b2421e5c031bda3fea528a967

SHA1
5fc22707b795e0d6f9db9cf4faac91cebff3a992

SHA256
6c2af254a0334ed985123f9e56a1de67605bac05a1e8da4cc12eeb52280f5a47

SHA512
62da5afdb54b810f44603514dc33e7a9491b6215b4cfacb4821221043e63ad86e49d74e8f25a39a7268b03484f455a89e40f62dd292e4bce5ec91920b915e90f

Download Submit
memory/856-121-0x0000000005A70000-0x0000000005A8E000-memory.dmp

Filesize
120KB

Download
memory/856-123-0x0000000005C80000-0x0000000005C98000-memory.dmp

Filesize
96KB

Download
memory/856-118-0x00000000059A0000-0x00000000059A1000-memory.dmp

Filesize
4KB

Download
memory/856-119-0x00000000057A0000-0x0000000005C9E000-memory.dmp

Filesize
5.0MB

Download
memory/856-120-0x0000000005B20000-0x0000000005B21000-memory.dmp

Filesize
4KB

Download
memory/856-114-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/856-122-0x0000000005BC0000-0x0000000005C22000-memory.dmp

Filesize
392KB

Download
memory/856-117-0x0000000005840000-0x0000000005841000-memory.dmp

Filesize
4KB

Download
memory/856-116-0x0000000005CA0000-0x0000000005CA1000-memory.dmp

Filesize
4KB

Download
memory/1984-126-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1984-127-0x000000000040687E-mapping.dmp

Download
memory/1984-131-0x00000000057B0000-0x00000000057B1000-memory.dmp

Filesize
4KB

Download
memory/1984-132-0x00000000059D0000-0x00000000059D1000-memory.dmp

Filesize
4KB

Download
memory/3596-124-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads