revengerat | 2bbaca2a87764bc28c643709da48f8460c2144b22faf750fefcaa9d7307f26b4

General

Target

2bbaca2a87764bc28c643709da48f8460c2144b22faf750fefcaa9d7307f26b4.exe
Size

69KB
MD5

7a8741e0e7279c649172efbfeae3735b
SHA1

7087c77fc72af28a5a72afcc1a16f7b56c84cb27
SHA256

2bbaca2a87764bc28c643709da48f8460c2144b22faf750fefcaa9d7307f26b4
SHA512

1b9359cc3638412919b3bb5d6dabe7c5b5014eeb36bea5bf94cbd8cbf25d1a20804f4c0ee9ec46d0480549955d24aebdd93e0839b46a9eb51a93d6aea2e86488

Score

10^/10

revengerat stealer trojan

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 4 IoCs

stealer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Hqgklhovvqvg.exe	revengerat
C:\Users\Admin\AppData\Local\Temp\Hqgklhovvqvg.exe	revengerat
behavioral2/memory/2700-140-0x0000000000400000-0x0000000000416000-memory.dmp	revengerat
behavioral2/memory/2700-142-0x0000000000400000-0x0000000000416000-memory.dmp	revengerat

Executes dropped EXE 1 IoCs

Processes:

Hqgklhovvqvg.exe

pid process

4256 Hqgklhovvqvg.exe

pid	process
4256	Hqgklhovvqvg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2bbaca2a87764bc28c643709da48f8460c2144b22faf750fefcaa9d7307f26b4.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	2bbaca2a87764bc28c643709da48f8460c2144b22faf750fefcaa9d7307f26b4.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

Hqgklhovvqvg.exeRegAsm.exe

description	pid	process	target process
PID 4256 set thread context of 2700	4256	Hqgklhovvqvg.exe	RegAsm.exe
PID 2700 set thread context of 176	2700	RegAsm.exe	RegAsm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 3 IoCs

Processes:

2bbaca2a87764bc28c643709da48f8460c2144b22faf750fefcaa9d7307f26b4.exeRegAsm.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings	2bbaca2a87764bc28c643709da48f8460c2144b22faf750fefcaa9d7307f26b4.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings	RegAsm.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

1076 NOTEPAD.EXE
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Hqgklhovvqvg.exeRegAsm.exe

description pid process

Token: SeDebugPrivilege 4256 Hqgklhovvqvg.exe
Token: SeDebugPrivilege 2700 RegAsm.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

3244 OpenWith.exe

pid	process
1076	NOTEPAD.EXE

description	pid	process
Token: SeDebugPrivilege	4256	Hqgklhovvqvg.exe
Token: SeDebugPrivilege	2700	RegAsm.exe

pid	process
3244	OpenWith.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

2bbaca2a87764bc28c643709da48f8460c2144b22faf750fefcaa9d7307f26b4.exeHqgklhovvqvg.exeRegAsm.exe

description	pid	process	target process
PID 4408 wrote to memory of 1076	4408	2bbaca2a87764bc28c643709da48f8460c2144b22faf750fefcaa9d7307f26b4.exe	NOTEPAD.EXE
PID 4408 wrote to memory of 1076	4408	2bbaca2a87764bc28c643709da48f8460c2144b22faf750fefcaa9d7307f26b4.exe	NOTEPAD.EXE
PID 4408 wrote to memory of 1076	4408	2bbaca2a87764bc28c643709da48f8460c2144b22faf750fefcaa9d7307f26b4.exe	NOTEPAD.EXE
PID 4408 wrote to memory of 4256	4408	2bbaca2a87764bc28c643709da48f8460c2144b22faf750fefcaa9d7307f26b4.exe	Hqgklhovvqvg.exe
PID 4408 wrote to memory of 4256	4408	2bbaca2a87764bc28c643709da48f8460c2144b22faf750fefcaa9d7307f26b4.exe	Hqgklhovvqvg.exe
PID 4408 wrote to memory of 4256	4408	2bbaca2a87764bc28c643709da48f8460c2144b22faf750fefcaa9d7307f26b4.exe	Hqgklhovvqvg.exe
PID 4256 wrote to memory of 2700	4256	Hqgklhovvqvg.exe	RegAsm.exe
PID 4256 wrote to memory of 2700	4256	Hqgklhovvqvg.exe	RegAsm.exe
PID 4256 wrote to memory of 2700	4256	Hqgklhovvqvg.exe	RegAsm.exe
PID 4256 wrote to memory of 2700	4256	Hqgklhovvqvg.exe	RegAsm.exe
PID 4256 wrote to memory of 2700	4256	Hqgklhovvqvg.exe	RegAsm.exe
PID 4256 wrote to memory of 2700	4256	Hqgklhovvqvg.exe	RegAsm.exe
PID 4256 wrote to memory of 2700	4256	Hqgklhovvqvg.exe	RegAsm.exe
PID 4256 wrote to memory of 2700	4256	Hqgklhovvqvg.exe	RegAsm.exe
PID 4256 wrote to memory of 2700	4256	Hqgklhovvqvg.exe	RegAsm.exe
PID 2700 wrote to memory of 176	2700	RegAsm.exe	RegAsm.exe
PID 2700 wrote to memory of 176	2700	RegAsm.exe	RegAsm.exe
PID 2700 wrote to memory of 176	2700	RegAsm.exe	RegAsm.exe
PID 2700 wrote to memory of 176	2700	RegAsm.exe	RegAsm.exe
PID 2700 wrote to memory of 176	2700	RegAsm.exe	RegAsm.exe
PID 2700 wrote to memory of 176	2700	RegAsm.exe	RegAsm.exe
PID 2700 wrote to memory of 176	2700	RegAsm.exe	RegAsm.exe
PID 2700 wrote to memory of 176	2700	RegAsm.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\2bbaca2a87764bc28c643709da48f8460c2144b22faf750fefcaa9d7307f26b4.exe
"C:\Users\Admin\AppData\Local\Temp\2bbaca2a87764bc28c643709da48f8460c2144b22faf750fefcaa9d7307f26b4.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4408

C:\Windows\SysWOW64\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Ptqrcicefw.txt
2⤵
- Opens file in notepad (likely ransom note)
PID:1076

C:\Users\Admin\AppData\Local\Temp\Hqgklhovvqvg.exe
"C:\Users\Admin\AppData\Local\Temp\Hqgklhovvqvg.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4256

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
4⤵
PID:176

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3244

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
Filesize
42B

MD5
84cfdb4b995b1dbf543b26b86c863adc

SHA1
d2f47764908bf30036cf8248b9ff5541e2711fa2

SHA256
d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b

SHA512
485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\AEKgHDMFLR.txt
Filesize
50B

MD5
2bc03073884a7c0f98af64ef7001d38f

SHA1
9577202e61e3f01bb85375e2f02786c49857405b

SHA256
5bc7c1cae73e66ed59145dbfdedd3d96f9c2a571305660ed726ac405acd9edd6

SHA512
92a4a34bbebdf5b7c929cf97371b3a80df7fbf34f539ab508a46f8e7e7dc2d51b7b703d92a223de51c6d3a43c0ca788d9ba577560e4da1d74e976a9e641a548d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Hqgklhovvqvg.exe
Filesize
59KB

MD5
ccf82f14b4a0ff65e19f4e82f08084bf

SHA1
25e36faea903fd90281e80e1603bd58de5206a39

SHA256
9810bd3836ddd9e29bead8d7312d33c611e120f49b9d3569a8d613121a956e17

SHA512
ea121df7e929bebf394fcfbfb895030810609a4b6541bbd373ec9127114faa38f9c63d79f2ca1b415e658effaebf9e7b4b045e016eb683f8b1fde42138770be2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Hqgklhovvqvg.exe
Filesize
59KB

MD5
ccf82f14b4a0ff65e19f4e82f08084bf

SHA1
25e36faea903fd90281e80e1603bd58de5206a39

SHA256
9810bd3836ddd9e29bead8d7312d33c611e120f49b9d3569a8d613121a956e17

SHA512
ea121df7e929bebf394fcfbfb895030810609a4b6541bbd373ec9127114faa38f9c63d79f2ca1b415e658effaebf9e7b4b045e016eb683f8b1fde42138770be2

Download Submit
memory/176-146-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/176-145-0x0000000000000000-mapping.dmp

Download
memory/1076-134-0x0000000000000000-mapping.dmp

Download
memory/2700-143-0x00000000054D0000-0x000000000556C000-memory.dmp

Filesize
624KB

Download
memory/2700-139-0x0000000000000000-mapping.dmp

Download
memory/2700-140-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2700-142-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2700-144-0x00000000055E0000-0x0000000005646000-memory.dmp

Filesize
408KB

Download
memory/4256-138-0x000000006F8D0000-0x000000006FE81000-memory.dmp

Filesize
5.7MB

Download
memory/4256-135-0x0000000000000000-mapping.dmp

Download
memory/4408-130-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4408-133-0x0000000005120000-0x000000000512A000-memory.dmp

Filesize
40KB

Download
memory/4408-132-0x0000000004930000-0x00000000049C2000-memory.dmp

Filesize
584KB

Download
memory/4408-131-0x0000000004A10000-0x0000000004FB4000-memory.dmp

Filesize
5.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads