revengerat | 3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d

General

Target

3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe
Size

943KB
MD5

c3d7fac817472717e5ea1f86ac1ff617
SHA1

5a79365fdae5a436e6aea22ff1155734a8ae92f7
SHA256

3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d
SHA512

8d0a0a393b5916c21fcaf84b3751d459682877c3150034a732e91583a327f6039b2dd121e38672016a3dff99629976bc70ea7b2d3f5ecbf566e6e9901a97e656

Score

10^/10

revengerat guest stealer trojan

Malware Config

Extracted

Family

revengerat

Botnet

Guest

C2

ournewcompany2.hopto.org:333

Mutex

RV_MUTEX

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 6 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/4052-132-0x0000000000000000-mapping.dmp	revengerat
behavioral2/memory/4052-133-0x0000000000400000-0x0000000000408000-memory.dmp	revengerat
behavioral2/memory/2320-134-0x0000000000000000-mapping.dmp	revengerat
behavioral2/memory/452-136-0x0000000000000000-mapping.dmp	revengerat
behavioral2/memory/3036-140-0x0000000000000000-mapping.dmp	revengerat
behavioral2/memory/2076-142-0x0000000000000000-mapping.dmp	revengerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe

Drops startup file 2 IoCs

Processes:

WScript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe	WScript.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe

description	pid	process	target process
PID 1880 set thread context of 4052	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 set thread context of 2320	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 set thread context of 452	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 set thread context of 696	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 set thread context of 3036	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 set thread context of 2076	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2496 696 WerFault.exe RegAsm.exe

pid	pid_target	process	target process
2496	696	WerFault.exe	RegAsm.exe

Modifies registry class 1 IoCs

Processes:

3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000_Classes\Local Settings	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

RegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exe

description	pid	process
Token: SeDebugPrivilege	2320	RegAsm.exe
Token: SeDebugPrivilege	2076	RegAsm.exe
Token: SeDebugPrivilege	452	RegAsm.exe
Token: SeDebugPrivilege	3036	RegAsm.exe
Token: SeDebugPrivilege	4052	RegAsm.exe

Suspicious use of WriteProcessMemory 42 IoCs

Processes:

3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe

description	pid	process	target process
PID 1880 wrote to memory of 1052	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	WScript.exe
PID 1880 wrote to memory of 1052	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	WScript.exe
PID 1880 wrote to memory of 1052	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	WScript.exe
PID 1880 wrote to memory of 4052	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 4052	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 4052	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 4052	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 4052	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 4052	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 4052	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 2320	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 2320	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 2320	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 2320	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 2320	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 2320	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 2320	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 452	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 452	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 452	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 452	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 452	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 452	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 452	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 696	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 696	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 696	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 696	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 3036	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 3036	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 3036	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 3036	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 3036	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 3036	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 3036	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 2076	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 2076	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 2076	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 2076	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 2076	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 2076	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe
PID 1880 wrote to memory of 2076	1880	3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe
"C:\Users\Admin\AppData\Local\Temp\3b85020323e7b11ba66d785eaf5fa7e3cf3e21791f6b97e6abef4f579266fa3d.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1880

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\1.vbs"
2⤵
- Drops startup file
PID:1052

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4052

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2320

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:452

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
2⤵
PID:696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 696 -s 80
3⤵
- Program crash
PID:2496

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3036

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 696 -ip 696
1⤵
PID:3480

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\RegAsm.exe.log
Filesize
411B

MD5
aa1e14353932d87c160bcc8b1f025429

SHA1
8be59f98296c1c5b9fb5ad84888d2a8dc6a3377d

SHA256
1c644f557743292853209410644526419eee72bfee8bfec839212b06d3b5e739

SHA512
7aec11c636bfe228d2029b87f980e979de9c214264eb2dbaa25186084e39f8732a83d44580300f98a15a1a9c0637e748c1f3eb4f46520ef4c6caaae07347033b

Download Submit
C:\Users\Admin\AppData\Roaming\1.vbs
Filesize
355B

MD5
f46b01af063ab26583cbc102f0d7faa9

SHA1
dc86052d4e60f31b9bd569f392b039f1da3a5ab8

SHA256
a734c682eeff369adac414474ab1d8427a6505b246dcd55982a35ac7bf9d6f5f

SHA512
2e8ae969dfc975b601513bda8e57988f919ade03e61f14637872cd42a303602b44c699cdfe1320909eaf7aef544820af1a91525e614aa78c1f624679c1fc294f

Download Submit
memory/452-136-0x0000000000000000-mapping.dmp

Download
memory/452-148-0x00000000743E0000-0x0000000074991000-memory.dmp

Filesize
5.7MB

Download
memory/452-151-0x00000000743E0000-0x0000000074991000-memory.dmp

Filesize
5.7MB

Download
memory/696-138-0x0000000000000000-mapping.dmp

Download
memory/1052-130-0x0000000000000000-mapping.dmp

Download
memory/2076-154-0x00000000743E0000-0x0000000074991000-memory.dmp

Filesize
5.7MB

Download
memory/2076-142-0x0000000000000000-mapping.dmp

Download
memory/2076-146-0x00000000743E0000-0x0000000074991000-memory.dmp

Filesize
5.7MB

Download
memory/2320-134-0x0000000000000000-mapping.dmp

Download
memory/2320-153-0x00000000743E0000-0x0000000074991000-memory.dmp

Filesize
5.7MB

Download
memory/2320-147-0x00000000743E0000-0x0000000074991000-memory.dmp

Filesize
5.7MB

Download
memory/3036-140-0x0000000000000000-mapping.dmp

Download
memory/3036-150-0x00000000743E0000-0x0000000074991000-memory.dmp

Filesize
5.7MB

Download
memory/3036-144-0x00000000743E0000-0x0000000074991000-memory.dmp

Filesize
5.7MB

Download
memory/4052-132-0x0000000000000000-mapping.dmp

Download
memory/4052-145-0x00000000743E0000-0x0000000074991000-memory.dmp

Filesize
5.7MB

Download
memory/4052-152-0x00000000743E0000-0x0000000074991000-memory.dmp

Filesize
5.7MB

Download
memory/4052-133-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads