revengerat | 97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4

General

Target

97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe
Size

1.4MB
MD5

39ea22af539d7a3e3e33df71f1c7f48c
SHA1

8035e9dc9ed7abb2fa6131b81818f4f252cb4fe7
SHA256

97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4
SHA512

26f4477eeab06db03a0406a04c815babc25a30044a68bedcab1b15b24ed6d8895121634976bb661bfff199ee2cd9ca0c5538d88c04a43bf7ab207d1e44bf23a4
SSDEEP

24576:1q5TfcdHj4fmb9Ve982q6CIMeYyBMLL0oj+CWEzKJ9Ttr8J1lj2XW0zQJ9TtFiGF:1UTsamC98x1je5klj2e5H

Score

10^/10

revengerat stealer trojan upx

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

Detects executables packed with Dotfuscator 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5040-0-0x00000000001D0000-0x00000000004CC000-memory.dmp	INDICATOR_EXE_Packed_Dotfuscator
C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe	INDICATOR_EXE_Packed_Dotfuscator
behavioral2/memory/5040-13-0x00000000001D0000-0x00000000004CC000-memory.dmp	INDICATOR_EXE_Packed_Dotfuscator
behavioral2/memory/908-14-0x0000000000AB0000-0x0000000000B34000-memory.dmp	INDICATOR_EXE_Packed_Dotfuscator
behavioral2/memory/5040-21-0x00000000001D0000-0x00000000004CC000-memory.dmp	INDICATOR_EXE_Packed_Dotfuscator

RevengeRat Executable 1 IoCs

stealer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe	revengerat

UPX dump on OEP (original entry point) 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5040-0-0x00000000001D0000-0x00000000004CC000-memory.dmp	UPX
behavioral2/memory/5040-13-0x00000000001D0000-0x00000000004CC000-memory.dmp	UPX
behavioral2/memory/5040-21-0x00000000001D0000-0x00000000004CC000-memory.dmp	UPX

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe

Executes dropped EXE 1 IoCs

Processes:

dmr_72.exe

pid process

908 dmr_72.exe

pid	process
908	dmr_72.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/5040-0-0x00000000001D0000-0x00000000004CC000-memory.dmp	upx
behavioral2/memory/5040-13-0x00000000001D0000-0x00000000004CC000-memory.dmp	upx
behavioral2/memory/5040-21-0x00000000001D0000-0x00000000004CC000-memory.dmp	upx

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/memory/5040-13-0x00000000001D0000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/5040-21-0x00000000001D0000-0x00000000004CC000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe

pid	process
5040	97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe
5040	97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe

pid process

5040 97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

dmr_72.exe

description pid process

Token: SeDebugPrivilege 908 dmr_72.exe

description	pid	process
Token: SeDebugPrivilege	908	dmr_72.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe

pid	process
5040	97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe
5040	97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe
5040	97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe

pid	process
5040	97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe
5040	97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe
5040	97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

dmr_72.exe

pid process

908 dmr_72.exe
908 dmr_72.exe

pid	process
908	dmr_72.exe
908	dmr_72.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe

description	pid	process	target process
PID 5040 wrote to memory of 908	5040	97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe	dmr_72.exe
PID 5040 wrote to memory of 908	5040	97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe	dmr_72.exe

C:\Users\Admin\AppData\Local\Temp\97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe
"C:\Users\Admin\AppData\Local\Temp\97ebba20193617551f93bd14d03b37c616a385b3e2a8f3ec5f3c5348a98f75d4.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5040

C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe
"C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe" -install -62401916 -chipderedesign -806780354e6342258bdbc3cf44e2da8b - -BLUB2 -itlegduciqxfwamo -5040
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3912 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:2396

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe
Filesize
507KB

MD5
a30cd772e6718c5cb94cd4078815eefd

SHA1
fc13cfd5784a7b7eb2e21b35536aebc42ac858a7

SHA256
3885e2ffc57fe5b29bd177ab3e14f56079964e69433f00a4de9300454fddf177

SHA512
ad63cc302ad505cbf578df5f58838eee8524a5ca239916ab81598ace42e2433435d306761b9911692e70ce72a1bef43dd750930a6349a190b0deb7c92340979e

Download Submit
C:\Users\Admin\AppData\Local\Temp\DMR\itlegduciqxfwamo.dat
Filesize
147B

MD5
d6fc3d2242747930299d86adc4328397

SHA1
59b85a8a2097d40a41ee7b33fe95ebd9afc78d03

SHA256
7be5adb8a310d794dfc57b73efa0529ca2a6bb723315c9f2da320e789599ccc3

SHA512
a48edc9fb6f8e9d8d07a85c26208302ce7bcf32e53471574fdf5886cac61b4e40c106b9dee930eac8515a6c7ae8e1d96b71b8e9d6fe5f641dc2c8b736f9f57f5

Download Submit
memory/908-14-0x0000000000AB0000-0x0000000000B34000-memory.dmp

Filesize
528KB

Download
memory/908-15-0x00007FFFA3C80000-0x00007FFFA4741000-memory.dmp

Filesize
10.8MB

Download
memory/908-16-0x000000001B930000-0x000000001B940000-memory.dmp

Filesize
64KB

Download
memory/908-18-0x000000001B930000-0x000000001B940000-memory.dmp

Filesize
64KB

Download
memory/908-19-0x000000001B930000-0x000000001B940000-memory.dmp

Filesize
64KB

Download
memory/908-20-0x000000001B930000-0x000000001B940000-memory.dmp

Filesize
64KB

Download
memory/908-23-0x000000001BA80000-0x000000001BB1A000-memory.dmp

Filesize
616KB

Download
memory/908-24-0x000000001E5A0000-0x000000001E5B6000-memory.dmp

Filesize
88KB

Download
memory/908-25-0x00007FFFA3C80000-0x00007FFFA4741000-memory.dmp

Filesize
10.8MB

Download
memory/5040-0-0x00000000001D0000-0x00000000004CC000-memory.dmp

Filesize
3.0MB

Download
memory/5040-13-0x00000000001D0000-0x00000000004CC000-memory.dmp

Filesize
3.0MB

Download
memory/5040-21-0x00000000001D0000-0x00000000004CC000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads