revengerat | 94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6

General

Target
94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe
Size 136KB
Sample220724-2m13babedn
SHA256 94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6
MD5 e518aaf5bd01393f6ebd19d18544a2df
SHA1 8e5fe78c881d1251f7257a7cb6f9f82fb9a1a9e4
SHA512 90a3313c8531da012972e9418d5ea64bb98b9df0d35b947b025664a47a4b928291f8b654f8f18b7a0a2b3bec7f50598ed2f223448e800b10ee5bad84402991b9
MD5 SHA1 SHA512

Score

10^/10

revengerat guest stealer trojan

Malware Config

Extracted

Family

revengerat

Botnet

Guest

C2

193.70.71.227:9622
193.70.71.227:8845
obimu2275.duck.dns:9622
obimu2275.duck.dns:8845

Mutex

RV_MUTEX-ZlgZblRvZwfRtNH

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 3 IoCs

stealer

resource	yara_rule
behavioral2/files/0x0006000000022eb6-134.dat	revengerat
behavioral2/files/0x0006000000022eb6-135.dat	revengerat
behavioral2/memory/3764-137-0x0000000000400000-0x0000000000408000-memory.dmp	revengerat

Executes dropped EXE 1 IoCs

pid	Process
1516	tmp.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\filename.exe	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\filename.exe	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4320 set thread context of 3764	4320	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe	76

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe
File created	C:\Windows\assembly\Desktop.ini	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3764	RegAsm.exe
Token: SeDebugPrivilege	1516	tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 1516	4320	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe	75
PID 4320 wrote to memory of 1516	4320	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe	75
PID 4320 wrote to memory of 3764	4320	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe	76
PID 4320 wrote to memory of 3764	4320	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe	76
PID 4320 wrote to memory of 3764	4320	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe	76
PID 4320 wrote to memory of 3764	4320	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe	76
PID 4320 wrote to memory of 3764	4320	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe	76
PID 4320 wrote to memory of 3764	4320	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe	76
PID 4320 wrote to memory of 3764	4320	94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe	76

C:\Users\Admin\AppData\Local\Temp\94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe
"C:\Users\Admin\AppData\Local\Temp\94245f5f535d986ad764c670db35ecf2ca10aedb7770e0959ca23a2a30ef7dc6.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1516
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp.exe
Size 17KB
SHA256 cc52ed0b29f4cd3efcc474a67861e39cd1ad2267b1e9d3e5053962145bf627d9
MD5 7869298ea7725f676aa2f4232a3f998c
SHA1 0e43c506cb7d968262a7447ac654600baf1b4327
SHA512 b112280bc1356257341fcb61178d1b2bfc1e4d870db028f1f76a61be0227670817cd2d4bc82757d5aaebc664fe3cb3147e639b9c7d892c330e97883125298506
SSDEEP 384:ugJ2yuVBDFn9oDPlMNcLlb5sVKuy05Ct:ugJ2yYRclMNEKo
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp.exe
Size 17KB
SHA256 cc52ed0b29f4cd3efcc474a67861e39cd1ad2267b1e9d3e5053962145bf627d9
MD5 7869298ea7725f676aa2f4232a3f998c
SHA1 0e43c506cb7d968262a7447ac654600baf1b4327
SHA512 b112280bc1356257341fcb61178d1b2bfc1e4d870db028f1f76a61be0227670817cd2d4bc82757d5aaebc664fe3cb3147e639b9c7d892c330e97883125298506
SSDEEP 384:ugJ2yuVBDFn9oDPlMNcLlb5sVKuy05Ct:ugJ2yYRclMNEKo
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1516-140-0x00007FFF7D600000-0x00007FFF7E036000-memory.dmp

Download

memory/3764-137-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3764-139-0x0000000074800000-0x0000000074DB1000-memory.dmp

Download

memory/3764-141-0x0000000074800000-0x0000000074DB1000-memory.dmp

Download

memory/4320-132-0x0000000074800000-0x0000000074DB1000-memory.dmp

Download

memory/4320-138-0x0000000074800000-0x0000000074DB1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads