revengerat | 3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d

General

Target

3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe
Size

943KB
MD5

c3d7fac817472717e5ea1f86ac1ff617
SHA1

5a79365fdae5a436e6aea22ff1155734a8ae92f7
SHA256

3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d
SHA512

8d0a0a393b5916c21fcaf84b3751d459682877c3150034a732e91583a327f6039b2dd121e38672016a3dff99629976bc70ea7b2d3f5ecbf566e6e9901a97e656

Score

10^/10

revengerat guest stealer trojan

Malware Config

Extracted

Family

revengerat

Botnet

Guest

C2

ournewcompany2.hopto.org:333

Mutex

RV_MUTEX

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 10 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/1760-61-0x0000000000400000-0x0000000000408000-memory.dmp	revengerat
behavioral1/memory/1760-63-0x0000000000405DCE-mapping.dmp	revengerat
behavioral1/memory/1760-62-0x0000000000400000-0x0000000000408000-memory.dmp	revengerat
behavioral1/memory/1760-66-0x0000000000400000-0x0000000000408000-memory.dmp	revengerat
behavioral1/memory/1760-70-0x0000000000400000-0x0000000000408000-memory.dmp	revengerat
behavioral1/memory/1980-73-0x0000000000405DCE-mapping.dmp	revengerat
behavioral1/memory/1148-83-0x0000000000405DCE-mapping.dmp	revengerat
behavioral1/memory/1712-96-0x0000000000405DCE-mapping.dmp	revengerat
behavioral1/memory/816-106-0x0000000000405DCE-mapping.dmp	revengerat
behavioral1/memory/844-114-0x0000000000405DCE-mapping.dmp	revengerat

Drops startup file 2 IoCs

Processes:

WScript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe	WScript.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe

description	pid	process	target process
PID 768 set thread context of 1760	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 set thread context of 1980	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 set thread context of 1148	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 set thread context of 1712	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 set thread context of 816	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 set thread context of 844	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

RegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exe

description	pid	process
Token: SeDebugPrivilege	1980	RegAsm.exe
Token: SeDebugPrivilege	1760	RegAsm.exe
Token: SeDebugPrivilege	1712	RegAsm.exe
Token: SeDebugPrivilege	844	RegAsm.exe
Token: SeDebugPrivilege	816	RegAsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe

description	pid	process	target process
PID 768 wrote to memory of 1660	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	WScript.exe
PID 768 wrote to memory of 1660	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	WScript.exe
PID 768 wrote to memory of 1660	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	WScript.exe
PID 768 wrote to memory of 1660	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	WScript.exe
PID 768 wrote to memory of 1760	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1760	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1760	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1760	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1760	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1760	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1760	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1760	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1760	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1760	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1760	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1980	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1980	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1980	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1980	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1980	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1980	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1980	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1980	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1980	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1980	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1980	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1148	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1148	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1148	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1148	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1148	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1148	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1148	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1148	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1148	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1148	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1148	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1712	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1712	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1712	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1712	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1712	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1712	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1712	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1712	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1712	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1712	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 1712	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 816	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 816	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 816	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 816	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 816	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 816	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 816	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 816	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 816	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 816	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 816	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 844	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 844	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 844	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 844	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 768 wrote to memory of 844	768	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe
"C:\Users\Admin\AppData\Local\Temp\3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:768

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\1.vbs"
2⤵
- Drops startup file
PID:1660

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1760

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1980

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
2⤵
PID:1148

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1712

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:816

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:844

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\1.vbs
Filesize
355B

MD5
f46b01af063ab26583cbc102f0d7faa9

SHA1
dc86052d4e60f31b9bd569f392b039f1da3a5ab8

SHA256
a734c682eeff369adac414474ab1d8427a6505b246dcd55982a35ac7bf9d6f5f

SHA512
2e8ae969dfc975b601513bda8e57988f919ade03e61f14637872cd42a303602b44c699cdfe1320909eaf7aef544820af1a91525e614aa78c1f624679c1fc294f

Download Submit
memory/768-54-0x0000000076AE1000-0x0000000076AE3000-memory.dmp

Filesize
8KB

Download
memory/816-130-0x0000000074700000-0x0000000074CAB000-memory.dmp

Filesize
5.7MB

Download
memory/816-106-0x0000000000405DCE-mapping.dmp

Download
memory/844-129-0x0000000074700000-0x0000000074CAB000-memory.dmp

Filesize
5.7MB

Download
memory/844-114-0x0000000000405DCE-mapping.dmp

Download
memory/1148-123-0x0000000074700000-0x0000000074CAB000-memory.dmp

Filesize
5.7MB

Download
memory/1148-83-0x0000000000405DCE-mapping.dmp

Download
memory/1660-55-0x0000000000000000-mapping.dmp

Download
memory/1712-96-0x0000000000405DCE-mapping.dmp

Download
memory/1712-128-0x0000000074700000-0x0000000074CAB000-memory.dmp

Filesize
5.7MB

Download
memory/1712-127-0x0000000074700000-0x0000000074CAB000-memory.dmp

Filesize
5.7MB

Download
memory/1760-61-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1760-70-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1760-66-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1760-126-0x0000000074700000-0x0000000074CAB000-memory.dmp

Filesize
5.7MB

Download
memory/1760-62-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1760-63-0x0000000000405DCE-mapping.dmp

Download
memory/1760-58-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1760-59-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1760-131-0x0000000074700000-0x0000000074CAB000-memory.dmp

Filesize
5.7MB

Download
memory/1980-73-0x0000000000405DCE-mapping.dmp

Download
memory/1980-121-0x0000000074700000-0x0000000074CAB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads