revengerat | db68ffa236dd34fb3c092e3b76b511bc16bbc0451c23a4e0a2083b6e744a5f4b

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2024, 05:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe
Size 944KB
Sample240402-fx3g8she2t
SHA256 db68ffa236dd34fb3c092e3b76b511bc16bbc0451c23a4e0a2083b6e744a5f4b
MD5 84a4cb98d7bce223019fe142191dc5af
SHA1 63386615792f409bf3cbcc78c2a53ae1438bc5ea
SHA512 1f7b06b720d424782bc31f554e33a6b80f9451076047540bc6744aa2a802824a9c73577f748f6d808195ddaa3354022d8e7ad61b814bd859036ce1944d2d1b32
SSDEEP 12288:gCdOy3vVrKxR5CXbNjAOxK/j2n+4YG/6c1mFFja3mXgcjfRlgsUBgaH7nhEJes3P:gCdxte/80jYLT3U1jfsWabncesOCKlQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

revengerat guest trojan

Malware Config

Extracted

Family

revengerat

Botnet

Guest

ournewcompany2.hopto.org:333

Mutex

RV_MUTEX

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe	WScript.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 3300 set thread context of 4564	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	98
PID 3300 set thread context of 1632	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	99
PID 3300 set thread context of 1104	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	100
PID 3300 set thread context of 2524	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	101
PID 3300 set thread context of 2068	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	103
PID 3300 set thread context of 4676	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	104

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4592	2524	WerFault.exe	101
4076	4676	WerFault.exe	104
928	1104	WerFault.exe	100

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2068	RegAsm.exe
Token: SeDebugPrivilege	4564	RegAsm.exe
Token: SeDebugPrivilege	1632	RegAsm.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 3952	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	97
PID 3300 wrote to memory of 3952	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	97
PID 3300 wrote to memory of 3952	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	97
PID 3300 wrote to memory of 4564	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	98
PID 3300 wrote to memory of 4564	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	98
PID 3300 wrote to memory of 4564	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	98
PID 3300 wrote to memory of 4564	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	98
PID 3300 wrote to memory of 4564	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	98
PID 3300 wrote to memory of 4564	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	98
PID 3300 wrote to memory of 4564	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	98
PID 3300 wrote to memory of 1632	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	99
PID 3300 wrote to memory of 1632	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	99
PID 3300 wrote to memory of 1632	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	99
PID 3300 wrote to memory of 1632	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	99
PID 3300 wrote to memory of 1632	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	99
PID 3300 wrote to memory of 1632	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	99
PID 3300 wrote to memory of 1632	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	99
PID 3300 wrote to memory of 1104	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	100
PID 3300 wrote to memory of 1104	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	100
PID 3300 wrote to memory of 1104	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	100
PID 3300 wrote to memory of 1104	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	100
PID 3300 wrote to memory of 2524	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	101
PID 3300 wrote to memory of 2524	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	101
PID 3300 wrote to memory of 2524	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	101
PID 3300 wrote to memory of 2524	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	101
PID 3300 wrote to memory of 2068	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	103
PID 3300 wrote to memory of 2068	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	103
PID 3300 wrote to memory of 2068	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	103
PID 3300 wrote to memory of 2068	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	103
PID 3300 wrote to memory of 2068	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	103
PID 3300 wrote to memory of 2068	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	103
PID 3300 wrote to memory of 2068	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	103
PID 3300 wrote to memory of 4676	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	104
PID 3300 wrote to memory of 4676	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	104
PID 3300 wrote to memory of 4676	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	104
PID 3300 wrote to memory of 4676	3300	84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe	104

C:\Users\Admin\AppData\Local\Temp\84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\84a4cb98d7bce223019fe142191dc5af_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\1.vbs"
  2⤵
  - Drops startup file
  PID:3952
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4564
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1632
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:1104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 80
    3⤵
    - Program crash
    PID:928
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:2524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 80
    3⤵
    - Program crash
    PID:4592
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2068
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:4676
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 80
    3⤵
    - Program crash
    PID:4076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1104 -ip 1104
1⤵
PID:1128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4676 -ip 4676
1⤵
PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2524 -ip 2524
1⤵
PID:3156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RegAsm.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\RegAsm.exe.log
Size 411B
SHA256 339f0d8802510a6e166e235a157cc7a202ea593e90975ae4d40b900b4e5ca3f4
MD5 7e280eb67a1770838b96bef7cbb2ce83
SHA1 08d9c30ad799a890093d729d657a5c8e685416ae
SHA512 e48f371e71ce8403700640452e9805d3694a4662d907ab588e7e687d1fa30b2acf5b17593b6c2dbdb337a7150b05727dcf4d8eb0f29f9bb499afdf6d624af876
MD5 SHA1 SHA512

Submit Download

1.vbs

Path C:\Users\Admin\AppData\Roaming\1.vbs
Size 337B
SHA256 b758b3417d136a7f9a1bec30acb17c6d303173b195a8c06abdc63586e1b9f444
MD5 3039c70e3f0e0afdebdd224bd486edf2
SHA1 6f37978b20a045d7c3773746659f05e991d1a4d0
SHA512 be1ca7950be102445a2444d4bb1be387c17a2cf3f2e42b14a955d6854c339fa07888d509ab4c103d242c9965752c07a9887837d60aaa9945cca9d5f560bc5815
MD5 SHA1 SHA512

Submit Download

memory/1632-26-0x0000000072C20000-0x00000000731D1000-memory.dmp

Download

memory/1632-21-0x0000000002CC0000-0x0000000002CD0000-memory.dmp

Download

memory/1632-20-0x0000000072C20000-0x00000000731D1000-memory.dmp

Download

memory/2068-25-0x0000000072C20000-0x00000000731D1000-memory.dmp

Download

memory/2068-27-0x0000000002790000-0x00000000027A0000-memory.dmp

Download

memory/2068-18-0x0000000072C20000-0x00000000731D1000-memory.dmp

Download

memory/2068-28-0x0000000072C20000-0x00000000731D1000-memory.dmp

Download

memory/2068-29-0x0000000072C20000-0x00000000731D1000-memory.dmp

Download

memory/4564-19-0x0000000072C20000-0x00000000731D1000-memory.dmp

Download

memory/4564-24-0x0000000072C20000-0x00000000731D1000-memory.dmp

Download

memory/4564-12-0x0000000000400000-0x0000000000408000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads