revengerat | c99d475a1d153a4e46829fa4c1cfebeb7ac73c3a5723d873fb5ff80ad32903b2

General

Target

c99d475a1d153a4e46829fa4c1cfebeb7ac73c3a5723d873fb5ff80ad32903b2.exe
Size

17KB
MD5

df66356151d4671e06f88a44b4c28dd3
SHA1

015f855ae32785eb9ea8ad1ecf252e3b6efaf88a
SHA256

c99d475a1d153a4e46829fa4c1cfebeb7ac73c3a5723d873fb5ff80ad32903b2
SHA512

bde5b8f19acca1dbec8516bfc9391173edad64315a8277c454e296807a2fae7cafdc644707e082c5f984e546893f6220651895665b4f0489aeb565457e0e4a83

Score

10^/10

revengerat m939 stealer trojan

Malware Config

Extracted

Family

revengerat

Botnet

M939

C2

landbo.ddns.net:2772

Mutex

RV_MUTEX-JRMSltdcKeYu

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 2 IoCs

stealer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\hlak.exe	revengerat
C:\Users\Admin\AppData\Roaming\hlak.exe	revengerat

Executes dropped EXE 1 IoCs

Processes:

hlak.exe

pid process

3964 hlak.exe

pid	process
3964	hlak.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

c99d475a1d153a4e46829fa4c1cfebeb7ac73c3a5723d873fb5ff80ad32903b2.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	c99d475a1d153a4e46829fa4c1cfebeb7ac73c3a5723d873fb5ff80ad32903b2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3344 schtasks.exe

pid	process
3344	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

c99d475a1d153a4e46829fa4c1cfebeb7ac73c3a5723d873fb5ff80ad32903b2.exehlak.exe

description	pid	process
Token: SeDebugPrivilege	3844	c99d475a1d153a4e46829fa4c1cfebeb7ac73c3a5723d873fb5ff80ad32903b2.exe
Token: SeDebugPrivilege	3964	hlak.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c99d475a1d153a4e46829fa4c1cfebeb7ac73c3a5723d873fb5ff80ad32903b2.exehlak.exe

description	pid	process	target process
PID 3844 wrote to memory of 3964	3844	c99d475a1d153a4e46829fa4c1cfebeb7ac73c3a5723d873fb5ff80ad32903b2.exe	hlak.exe
PID 3844 wrote to memory of 3964	3844	c99d475a1d153a4e46829fa4c1cfebeb7ac73c3a5723d873fb5ff80ad32903b2.exe	hlak.exe
PID 3964 wrote to memory of 3344	3964	hlak.exe	schtasks.exe
PID 3964 wrote to memory of 3344	3964	hlak.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\c99d475a1d153a4e46829fa4c1cfebeb7ac73c3a5723d873fb5ff80ad32903b2.exe
"C:\Users\Admin\AppData\Local\Temp\c99d475a1d153a4e46829fa4c1cfebeb7ac73c3a5723d873fb5ff80ad32903b2.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3844

C:\Users\Admin\AppData\Roaming\hlak.exe
"C:\Users\Admin\AppData\Roaming\hlak.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3964

C:\Windows\SYSTEM32\schtasks.exe
schtasks /create /sc minute /mo 5 /tn "hort" /tr "C:\Users\Admin\AppData\Roaming\hlak.exe"
3⤵
- Creates scheduled task(s)
PID:3344

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\hlak.exe

Filesize
17KB

MD5
df66356151d4671e06f88a44b4c28dd3

SHA1
015f855ae32785eb9ea8ad1ecf252e3b6efaf88a

SHA256
c99d475a1d153a4e46829fa4c1cfebeb7ac73c3a5723d873fb5ff80ad32903b2

SHA512
bde5b8f19acca1dbec8516bfc9391173edad64315a8277c454e296807a2fae7cafdc644707e082c5f984e546893f6220651895665b4f0489aeb565457e0e4a83

Download Submit
C:\Users\Admin\AppData\Roaming\hlak.exe

Filesize
17KB

MD5
df66356151d4671e06f88a44b4c28dd3

SHA1
015f855ae32785eb9ea8ad1ecf252e3b6efaf88a

SHA256
c99d475a1d153a4e46829fa4c1cfebeb7ac73c3a5723d873fb5ff80ad32903b2

SHA512
bde5b8f19acca1dbec8516bfc9391173edad64315a8277c454e296807a2fae7cafdc644707e082c5f984e546893f6220651895665b4f0489aeb565457e0e4a83

Download Submit
memory/3344-135-0x0000000000000000-mapping.dmp

Download
memory/3844-130-0x000000001BF30000-0x000000001C966000-memory.dmp

Filesize
10.2MB

Download
memory/3964-131-0x0000000000000000-mapping.dmp

Download
memory/3964-134-0x000000001C290000-0x000000001CCC6000-memory.dmp

Filesize
10.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads