revengerat | 91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16

General

Target

91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16.exe
Size

99KB
MD5

2a63d88b403e251d2587eb0fa5972356
SHA1

d854b2e080cae641d50c09b5cc3e6bb2454c8ded
SHA256

91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16
SHA512

ffbcee55035f3c2c83e4d856c2a1badfc690e22cffdd14a4ead46990ee24baf96cda399ad6312e94d8ce0e05c00a91d2a25751370144f43743e6447fa54c21ce

Score

10^/10

revengerat stealer trojan

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 5 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/556-64-0x0000000000400000-0x0000000000416000-memory.dmp	revengerat
behavioral1/memory/556-66-0x0000000000400000-0x0000000000416000-memory.dmp	revengerat
behavioral1/memory/556-68-0x0000000000400000-0x0000000000416000-memory.dmp	revengerat
behavioral1/memory/556-70-0x0000000000400000-0x0000000000416000-memory.dmp	revengerat
behavioral1/memory/556-72-0x0000000000400000-0x0000000000416000-memory.dmp	revengerat

Suspicious use of SetThreadContext 1 IoCs

Processes:

91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16.exe

description	pid	process	target process
PID 1652 set thread context of 556	1652	91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16.exe	svchost.exe

Modifies Internet Explorer settings 1 TTPs 25 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FDBE0D10-9E17-11EC-AB0E-6E24649026A6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1236 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1236 iexplore.exe
1236 iexplore.exe
1880 IEXPLORE.EXE
1880 IEXPLORE.EXE
1880 IEXPLORE.EXE
1880 IEXPLORE.EXE

pid	process
1236	iexplore.exe

pid	process
1236	iexplore.exe
1236	iexplore.exe
1880	IEXPLORE.EXE
1880	IEXPLORE.EXE
1880	IEXPLORE.EXE
1880	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16.exesvchost.exeiexplore.exe

description	pid	process	target process
PID 1652 wrote to memory of 556	1652	91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16.exe	svchost.exe
PID 1652 wrote to memory of 556	1652	91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16.exe	svchost.exe
PID 1652 wrote to memory of 556	1652	91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16.exe	svchost.exe
PID 1652 wrote to memory of 556	1652	91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16.exe	svchost.exe
PID 1652 wrote to memory of 556	1652	91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16.exe	svchost.exe
PID 1652 wrote to memory of 556	1652	91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16.exe	svchost.exe
PID 1652 wrote to memory of 556	1652	91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16.exe	svchost.exe
PID 1652 wrote to memory of 556	1652	91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16.exe	svchost.exe
PID 1652 wrote to memory of 556	1652	91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16.exe	svchost.exe
PID 1652 wrote to memory of 556	1652	91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16.exe	svchost.exe
PID 556 wrote to memory of 1236	556	svchost.exe	iexplore.exe
PID 556 wrote to memory of 1236	556	svchost.exe	iexplore.exe
PID 556 wrote to memory of 1236	556	svchost.exe	iexplore.exe
PID 556 wrote to memory of 1236	556	svchost.exe	iexplore.exe
PID 1236 wrote to memory of 1880	1236	iexplore.exe	IEXPLORE.EXE
PID 1236 wrote to memory of 1880	1236	iexplore.exe	IEXPLORE.EXE
PID 1236 wrote to memory of 1880	1236	iexplore.exe	IEXPLORE.EXE
PID 1236 wrote to memory of 1880	1236	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16.exe
"C:\Users\Admin\AppData\Local\Temp\91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\svchost.exe
"{path}"
2⤵
- Suspicious use of WriteProcessMemory
PID:556

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1236

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1236 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1880

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\7w612sw\imagestore.dat
MD5
42792c14f0dcfdc45243d021a8fa0624

SHA1
2829b361df36f5008b40e3fe195df7a7042dee0d

SHA256
18d073fd1858688486490f61b28169c4cbd383ae81b4b9514741afc705f31287

SHA512
d2031fe222f9c3a26018aa3b25cf28197cf8f55fd7ee4e695b5140c08cd34daf698f0a7149f967832f3667d2abb6c2539f30e66c09bf3c870c01cec719cbf135

Download Submit
memory/556-68-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/556-60-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/556-62-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/556-64-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/556-66-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/556-70-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/556-72-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/556-73-0x0000000074EC1000-0x0000000074EC3000-memory.dmp

Filesize
8KB

Download
memory/1652-57-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/1652-58-0x0000000000450000-0x0000000000451000-memory.dmp

Filesize
4KB

Download
memory/1652-59-0x0000000000300000-0x000000000030C000-memory.dmp

Filesize
48KB

Download
memory/1652-55-0x00000000744D0000-0x0000000074BBE000-memory.dmp

Filesize
6.9MB

Download
memory/1652-56-0x0000000000960000-0x0000000000982000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads