revengerat | 97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4

General

Target

97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe
Size

1.4MB
MD5

39ea22af539d7a3e3e33df71f1c7f48c
SHA1

8035e9dc9ed7abb2fa6131b81818f4f252cb4fe7
SHA256

97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4
SHA512

26f4477eeab06db03a0406a04c815babc25a30044a68bedcab1b15b24ed6d8895121634976bb661bfff199ee2cd9ca0c5538d88c04a43bf7ab207d1e44bf23a4
SSDEEP

24576:1q5TfcdHj4fmb9Ve982q6CIMeYyBMLL0oj+CWEzKJ9Ttr8J1lj2XW0zQJ9TtFiGF:1UTsamC98x1je5klj2e5H

Score

10^/10

revengerat stealer trojan upx

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

Detects executables packed with Dotfuscator 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2852-0-0x0000000001380000-0x000000000167C000-memory.dmp	INDICATOR_EXE_Packed_Dotfuscator
\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe	INDICATOR_EXE_Packed_Dotfuscator
behavioral1/memory/1316-16-0x0000000000B80000-0x0000000000C04000-memory.dmp	INDICATOR_EXE_Packed_Dotfuscator
behavioral1/memory/1316-18-0x000000001A920000-0x000000001A9A0000-memory.dmp	INDICATOR_EXE_Packed_Dotfuscator
behavioral1/memory/2852-24-0x0000000001380000-0x000000000167C000-memory.dmp	INDICATOR_EXE_Packed_Dotfuscator

RevengeRat Executable 1 IoCs

stealer

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe	revengerat

UPX dump on OEP (original entry point) 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2852-0-0x0000000001380000-0x000000000167C000-memory.dmp	UPX
behavioral1/memory/2852-24-0x0000000001380000-0x000000000167C000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

Processes:

dmr_72.exe

pid process

1316 dmr_72.exe

pid	process
1316	dmr_72.exe

Loads dropped DLL 4 IoCs

Processes:

97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe

pid	process
2852	97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe
2852	97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe
2852	97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe
2852	97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2852-0-0x0000000001380000-0x000000000167C000-memory.dmp	upx
behavioral1/memory/2852-24-0x0000000001380000-0x000000000167C000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/2852-24-0x0000000001380000-0x000000000167C000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe

pid process

2852 97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe

pid process

2852 97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

dmr_72.exe

description pid process

Token: SeDebugPrivilege 1316 dmr_72.exe

description	pid	process
Token: SeDebugPrivilege	1316	dmr_72.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe

pid	process
2852	97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe
2852	97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe
2852	97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe

pid	process
2852	97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe
2852	97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe
2852	97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

dmr_72.exe

pid process

1316 dmr_72.exe
1316 dmr_72.exe

pid	process
1316	dmr_72.exe
1316	dmr_72.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe

description	pid	process	target process
PID 2852 wrote to memory of 1316	2852	97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe	dmr_72.exe
PID 2852 wrote to memory of 1316	2852	97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe	dmr_72.exe
PID 2852 wrote to memory of 1316	2852	97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe	dmr_72.exe
PID 2852 wrote to memory of 1316	2852	97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe	dmr_72.exe

C:\Users\Admin\AppData\Local\Temp\97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe
"C:\Users\Admin\AppData\Local\Temp\97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2852

C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe
"C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe" -install -62401916 -chipderedesign -806780354e6342258bdbc3cf44e2da8b - -BLUB2 -ekxjhkiwztqlznxr -2852
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1316

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DMR\ekxjhkiwztqlznxr.dat
Filesize
147B

MD5
d6fc3d2242747930299d86adc4328397

SHA1
59b85a8a2097d40a41ee7b33fe95ebd9afc78d03

SHA256
7be5adb8a310d794dfc57b73efa0529ca2a6bb723315c9f2da320e789599ccc3

SHA512
a48edc9fb6f8e9d8d07a85c26208302ce7bcf32e53471574fdf5886cac61b4e40c106b9dee930eac8515a6c7ae8e1d96b71b8e9d6fe5f641dc2c8b736f9f57f5

Download Submit
\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe
Filesize
507KB

MD5
a30cd772e6718c5cb94cd4078815eefd

SHA1
fc13cfd5784a7b7eb2e21b35536aebc42ac858a7

SHA256
3885e2ffc57fe5b29bd177ab3e14f56079964e69433f00a4de9300454fddf177

SHA512
ad63cc302ad505cbf578df5f58838eee8524a5ca239916ab81598ace42e2433435d306761b9911692e70ce72a1bef43dd750930a6349a190b0deb7c92340979e

Download Submit
memory/1316-16-0x0000000000B80000-0x0000000000C04000-memory.dmp

Filesize
528KB

Download
memory/1316-17-0x000007FEF5FF0000-0x000007FEF69DC000-memory.dmp

Filesize
9.9MB

Download
memory/1316-18-0x000000001A920000-0x000000001A9A0000-memory.dmp

Filesize
512KB

Download
memory/1316-20-0x000000001A920000-0x000000001A9A0000-memory.dmp

Filesize
512KB

Download
memory/1316-21-0x000000001A920000-0x000000001A9A0000-memory.dmp

Filesize
512KB

Download
memory/1316-22-0x000000001A920000-0x000000001A9A0000-memory.dmp

Filesize
512KB

Download
memory/1316-23-0x000000001A920000-0x000000001A9A0000-memory.dmp

Filesize
512KB

Download
memory/1316-25-0x000007FEF5FF0000-0x000007FEF69DC000-memory.dmp

Filesize
9.9MB

Download
memory/2852-0-0x0000000001380000-0x000000000167C000-memory.dmp

Filesize
3.0MB

Download
memory/2852-24-0x0000000001380000-0x000000000167C000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads