revengerat | e6eda9918b257e317e921d294b903f9488929fe7ef2efc0955bd141d19e15855

General

Target

e6eda9918b257e317e921d294b903f9488929fe7ef2efc0955bd141d19e15855.exe
Size

17KB
MD5

64c4cdba4768bc1ad90f0061037d4328
SHA1

411b304ae5aac0e7fe27bd17b8c50f081bca3654
SHA256

e6eda9918b257e317e921d294b903f9488929fe7ef2efc0955bd141d19e15855
SHA512

591c8a5613c7888199adf80bce31141a77a0ce9cb260d96a5dd8d40dfd764ebaa9846fa9020cee19c2766685cbbf7d28c57007888076bb03c0dcaec83ad60f50

Score

10^/10

revengerat 2sp force dz persistence stealer trojan

Malware Config

Extracted

Family

revengerat

Botnet

2SP Force DZ

C2

imaneblueyesvpn.ddns.net:333

Mutex

RV_MUTEX-jpnFwUnoWrUUg

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 2 IoCs

stealer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe	revengerat
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe	revengerat

Executes dropped EXE 1 IoCs

Processes:

Client.exe

pid process

1204 Client.exe

pid	process
1204	Client.exe

Drops startup file 2 IoCs

Processes:

Client.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Client.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Client.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Client.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Client.exe"	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

e6eda9918b257e317e921d294b903f9488929fe7ef2efc0955bd141d19e15855.exeClient.exe

description	pid	process
Token: SeDebugPrivilege	1624	e6eda9918b257e317e921d294b903f9488929fe7ef2efc0955bd141d19e15855.exe
Token: SeDebugPrivilege	1204	Client.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

e6eda9918b257e317e921d294b903f9488929fe7ef2efc0955bd141d19e15855.exe

description	pid	process	target process
PID 1624 wrote to memory of 1204	1624	e6eda9918b257e317e921d294b903f9488929fe7ef2efc0955bd141d19e15855.exe	Client.exe
PID 1624 wrote to memory of 1204	1624	e6eda9918b257e317e921d294b903f9488929fe7ef2efc0955bd141d19e15855.exe	Client.exe
PID 1624 wrote to memory of 1204	1624	e6eda9918b257e317e921d294b903f9488929fe7ef2efc0955bd141d19e15855.exe	Client.exe

C:\Users\Admin\AppData\Local\Temp\e6eda9918b257e317e921d294b903f9488929fe7ef2efc0955bd141d19e15855.exe
"C:\Users\Admin\AppData\Local\Temp\e6eda9918b257e317e921d294b903f9488929fe7ef2efc0955bd141d19e15855.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1204

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe
MD5
64c4cdba4768bc1ad90f0061037d4328

SHA1
411b304ae5aac0e7fe27bd17b8c50f081bca3654

SHA256
e6eda9918b257e317e921d294b903f9488929fe7ef2efc0955bd141d19e15855

SHA512
591c8a5613c7888199adf80bce31141a77a0ce9cb260d96a5dd8d40dfd764ebaa9846fa9020cee19c2766685cbbf7d28c57007888076bb03c0dcaec83ad60f50

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Client.exe
MD5
64c4cdba4768bc1ad90f0061037d4328

SHA1
411b304ae5aac0e7fe27bd17b8c50f081bca3654

SHA256
e6eda9918b257e317e921d294b903f9488929fe7ef2efc0955bd141d19e15855

SHA512
591c8a5613c7888199adf80bce31141a77a0ce9cb260d96a5dd8d40dfd764ebaa9846fa9020cee19c2766685cbbf7d28c57007888076bb03c0dcaec83ad60f50

Download Submit
memory/1204-58-0x000007FEF28D0000-0x000007FEF3966000-memory.dmp

Filesize
16.6MB

Download
memory/1204-59-0x0000000000AF0000-0x0000000000AF2000-memory.dmp

Filesize
8KB

Download
memory/1624-54-0x00000000020A0000-0x00000000020A2000-memory.dmp

Filesize
8KB

Download
memory/1624-55-0x000007FEF2A60000-0x000007FEF3AF6000-memory.dmp

Filesize
16.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads