revengerat | 94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6 | Triage

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220722-en
resource tags

arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system
submitted
24-07-2022 22:42

Sharing

Report Analysis Logs

General

Target

94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe
Size

136KB
MD5

e518aaf5bd01393f6ebd19d18544a2df
SHA1

8e5fe78c881d1251f7257a7cb6f9f82fb9a1a9e4
SHA256

94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6
SHA512

90a3313c8531da012972e9418d5ea64bb98b9df0d35b947b025664a47a4b928291f8b654f8f18b7a0a2b3bec7f50598ed2f223448e800b10ee5bad84402991b9

Score

10^/10

revengerat guest stealer trojan

Malware Config

Extracted

Family

revengerat

Botnet

Guest

C2

193.70.71.227:9622

193.70.71.227:8845

obimu2275.duck.dns:9622

obimu2275.duck.dns:8845

Mutex

RV_MUTEX-ZlgZblRvZwfRtNH

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\tmp.exe	revengerat
C:\Users\Admin\AppData\Local\Temp\tmp.exe	revengerat
behavioral2/memory/3764-137-0x0000000000400000-0x0000000000408000-memory.dmp	revengerat

Executes dropped EXE 1 IoCs

Processes:

tmp.exe

pid process

1516 tmp.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe

Drops startup file 2 IoCs

Processes:

94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\filename.exe	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\filename.exe	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe

description	ioc	process
File created	C:\Windows\assembly\Desktop.ini	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe

description	pid	process	target process
PID 4320 set thread context of 3764	4320	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe	RegAsm.exe

Drops file in Windows directory 3 IoCs

Processes:

94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe

description	ioc	process
File opened for modification	C:\Windows\assembly	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe
File created	C:\Windows\assembly\Desktop.ini	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

RegAsm.exetmp.exe

description pid process

Token: SeDebugPrivilege 3764 RegAsm.exe
Token: SeDebugPrivilege 1516 tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe

description	pid	process	target process
PID 4320 wrote to memory of 1516	4320	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe	tmp.exe
PID 4320 wrote to memory of 1516	4320	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe	tmp.exe
PID 4320 wrote to memory of 3764	4320	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe	RegAsm.exe
PID 4320 wrote to memory of 3764	4320	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe	RegAsm.exe
PID 4320 wrote to memory of 3764	4320	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe	RegAsm.exe
PID 4320 wrote to memory of 3764	4320	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe	RegAsm.exe
PID 4320 wrote to memory of 3764	4320	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe	RegAsm.exe
PID 4320 wrote to memory of 3764	4320	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe	RegAsm.exe
PID 4320 wrote to memory of 3764	4320	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe
"C:\Users\Admin\AppData\Local\Temp\94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4320

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1516

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3764

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp.exe
Filesize
17KB

MD5
7869298ea7725f676aa2f4232a3f998c

SHA1
0e43c506cb7d968262a7447ac654600baf1b4327

SHA256
cc52ed0b29f4cd3efcc474a67861e39cd1ad2267b1e9d3e5053962145bf627d9

SHA512
b112280bc1356257341fcb61178d1b2bfc1e4d870db028f1f76a61be0227670817cd2d4bc82757d5aaebc664fe3cb3147e639b9c7d892c330e97883125298506

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp.exe
Filesize
17KB

MD5
7869298ea7725f676aa2f4232a3f998c

SHA1
0e43c506cb7d968262a7447ac654600baf1b4327

SHA256
cc52ed0b29f4cd3efcc474a67861e39cd1ad2267b1e9d3e5053962145bf627d9

SHA512
b112280bc1356257341fcb61178d1b2bfc1e4d870db028f1f76a61be0227670817cd2d4bc82757d5aaebc664fe3cb3147e639b9c7d892c330e97883125298506

Download Submit
memory/1516-133-0x0000000000000000-mapping.dmp

Download
memory/1516-140-0x00007FFF7D600000-0x00007FFF7E036000-memory.dmp

Filesize
10.2MB

Download
memory/3764-136-0x0000000000000000-mapping.dmp

Download
memory/3764-137-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3764-139-0x0000000074800000-0x0000000074DB1000-memory.dmp

Filesize
5.7MB

Download
memory/3764-141-0x0000000074800000-0x0000000074DB1000-memory.dmp

Filesize
5.7MB

Download
memory/4320-132-0x0000000074800000-0x0000000074DB1000-memory.dmp

Filesize
5.7MB

Download
memory/4320-138-0x0000000074800000-0x0000000074DB1000-memory.dmp

Filesize
5.7MB

Download