revengerat | 8c598c9782ffaf10ac7bd59c5a48acc267d15590eccba787b61cda62a7ea7138

General

Target

f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
Size

1.0MB
MD5

f95564a72a16d6a4efa39278f0721ac2
SHA1

4e93f6849ca3717ebb3fe64f01b2384592906464
SHA256

8c598c9782ffaf10ac7bd59c5a48acc267d15590eccba787b61cda62a7ea7138
SHA512

d371acb9407680c06f8991d06046419ae0dd156e214ed6ce1062e0499caced63ddd5a323ca8176947555e2770d6ca2cccf9f2f59becc2997d8fc2a102565ea8d
SSDEEP

24576:iJjAKND1LIQgBPiXOa8tspOJy2HNyCY3rw:iJjN9IQEiXOBywmr

Score

10^/10

revengerat zgrat nyancatrevenge persistence rat trojan

Malware Config

Extracted

Family

revengerat

Botnet

NyanCatRevenge

C2

dontreachme.duckdns.org:3601

Mutex

159ffe7d99124a92baa

Signatures

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2732-7-0x0000000004C80000-0x0000000004CEE000-memory.dmp	family_zgrat_v1
behavioral1/memory/2732-8-0x0000000004C80000-0x0000000004CE7000-memory.dmp	family_zgrat_v1
behavioral1/memory/2732-9-0x0000000004C80000-0x0000000004CE7000-memory.dmp	family_zgrat_v1
behavioral1/memory/2732-11-0x0000000004C80000-0x0000000004CE7000-memory.dmp	family_zgrat_v1
behavioral1/memory/2732-13-0x0000000004C80000-0x0000000004CE7000-memory.dmp	family_zgrat_v1
behavioral1/memory/2732-15-0x0000000004C80000-0x0000000004CE7000-memory.dmp	family_zgrat_v1
behavioral1/memory/2732-17-0x0000000004C80000-0x0000000004CE7000-memory.dmp	family_zgrat_v1
behavioral1/memory/2732-19-0x0000000004C80000-0x0000000004CE7000-memory.dmp	family_zgrat_v1
behavioral1/memory/2732-23-0x0000000004C80000-0x0000000004CE7000-memory.dmp	family_zgrat_v1
behavioral1/memory/2732-21-0x0000000004C80000-0x0000000004CE7000-memory.dmp	family_zgrat_v1
behavioral1/memory/2732-25-0x0000000004C80000-0x0000000004CE7000-memory.dmp	family_zgrat_v1
behavioral1/memory/2732-27-0x0000000004C80000-0x0000000004CE7000-memory.dmp	family_zgrat_v1
behavioral1/memory/2732-29-0x0000000004C80000-0x0000000004CE7000-memory.dmp	family_zgrat_v1
behavioral1/memory/2732-31-0x0000000004C80000-0x0000000004CE7000-memory.dmp	family_zgrat_v1
behavioral1/memory/2732-33-0x0000000004C80000-0x0000000004CE7000-memory.dmp	family_zgrat_v1
behavioral1/memory/2732-35-0x0000000004C80000-0x0000000004CE7000-memory.dmp	family_zgrat_v1
behavioral1/memory/2732-37-0x0000000004C80000-0x0000000004CE7000-memory.dmp	family_zgrat_v1
behavioral1/memory/2732-39-0x0000000004C80000-0x0000000004CE7000-memory.dmp	family_zgrat_v1
behavioral1/memory/2732-41-0x0000000004C80000-0x0000000004CE7000-memory.dmp	family_zgrat_v1
behavioral1/memory/2732-43-0x0000000004C80000-0x0000000004CE7000-memory.dmp	family_zgrat_v1
behavioral1/memory/2732-45-0x0000000004C80000-0x0000000004CE7000-memory.dmp	family_zgrat_v1
behavioral1/memory/2732-47-0x0000000004C80000-0x0000000004CE7000-memory.dmp	family_zgrat_v1
behavioral1/memory/2732-49-0x0000000004C80000-0x0000000004CE7000-memory.dmp	family_zgrat_v1
behavioral1/memory/2732-51-0x0000000004C80000-0x0000000004CE7000-memory.dmp	family_zgrat_v1
behavioral1/memory/2732-53-0x0000000004C80000-0x0000000004CE7000-memory.dmp	family_zgrat_v1
behavioral1/memory/2732-55-0x0000000004C80000-0x0000000004CE7000-memory.dmp	family_zgrat_v1
behavioral1/memory/2732-57-0x0000000004C80000-0x0000000004CE7000-memory.dmp	family_zgrat_v1
behavioral1/memory/2732-59-0x0000000004C80000-0x0000000004CE7000-memory.dmp	family_zgrat_v1
behavioral1/memory/2732-61-0x0000000004C80000-0x0000000004CE7000-memory.dmp	family_zgrat_v1
behavioral1/memory/2732-63-0x0000000004C80000-0x0000000004CE7000-memory.dmp	family_zgrat_v1
behavioral1/memory/2732-65-0x0000000004C80000-0x0000000004CE7000-memory.dmp	family_zgrat_v1
behavioral1/memory/2732-67-0x0000000004C80000-0x0000000004CE7000-memory.dmp	family_zgrat_v1
behavioral1/memory/2732-69-0x0000000004C80000-0x0000000004CE7000-memory.dmp	family_zgrat_v1
behavioral1/memory/2732-71-0x0000000004C80000-0x0000000004CE7000-memory.dmp	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\JavaUpdate\\JavaUpdate.exe\","	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe

description	pid	process	target process
PID 2732 set thread context of 1580	2732	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exepowershell.exe

pid	process
2732	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
2732	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
2732	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
2732	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
2732	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
2732	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
2732	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
2732	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
2732	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
2732	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
284	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2732 f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
Token: SeDebugPrivilege 284 powershell.exe

description	pid	process
Token: SeDebugPrivilege	2732	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
Token: SeDebugPrivilege	284	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exeWScript.exe

C:\Users\Admin\AppData\Local\Temp\f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Xtsijkfgdndn.vbs"
2⤵
- Suspicious use of WriteProcessMemory
PID:2336

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Local\JavaUpdate\JavaUpdate.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:284

C:\Users\Admin\AppData\Local\Temp\f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
2⤵
PID:1716

C:\Users\Admin\AppData\Local\Temp\f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
2⤵
PID:2528

C:\Users\Admin\AppData\Local\Temp\f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
2⤵
PID:1580

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_Xtsijkfgdndn.vbs
Filesize
149B

MD5
75fda8189e60e05655aea55fe68591c0

SHA1
de2177e12403c59f81d278497a387089ddd10d73

SHA256
cf8322af201e7b0f5d5b2b93c0df541c8785436ebdf04a32addc46b13caf81c5

SHA512
1bc581cbe6ba2f7f9a419bdb9b582ec5585d5cdfd8e245cab19c269d2bd4ecbc151cd98996b8d5f330304fda243c4a13388f1c601111dbab59fd0ad35e5ea647

Download Submit
memory/284-1957-0x0000000070720000-0x0000000070CCB000-memory.dmp

Filesize
5.7MB

Download
memory/284-1958-0x0000000070720000-0x0000000070CCB000-memory.dmp

Filesize
5.7MB

Download
memory/284-1961-0x0000000070720000-0x0000000070CCB000-memory.dmp

Filesize
5.7MB

Download
memory/284-1960-0x00000000028C0000-0x0000000002900000-memory.dmp

Filesize
256KB

Download
memory/284-1959-0x00000000028C0000-0x0000000002900000-memory.dmp

Filesize
256KB

Download
memory/1580-1952-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1580-1954-0x00000000743A0000-0x0000000074A8E000-memory.dmp

Filesize
6.9MB

Download
memory/1580-1964-0x0000000004BA0000-0x0000000004BE0000-memory.dmp

Filesize
256KB

Download
memory/1580-1963-0x00000000743A0000-0x0000000074A8E000-memory.dmp

Filesize
6.9MB

Download
memory/1580-1962-0x0000000004BA0000-0x0000000004BE0000-memory.dmp

Filesize
256KB

Download
memory/2732-33-0x0000000004C80000-0x0000000004CE7000-memory.dmp

Filesize
412KB

Download
memory/2732-45-0x0000000004C80000-0x0000000004CE7000-memory.dmp

Filesize
412KB

Download
memory/2732-8-0x0000000004C80000-0x0000000004CE7000-memory.dmp

Filesize
412KB

Download
memory/2732-9-0x0000000004C80000-0x0000000004CE7000-memory.dmp

Filesize
412KB

Download
memory/2732-11-0x0000000004C80000-0x0000000004CE7000-memory.dmp

Filesize
412KB

Download
memory/2732-13-0x0000000004C80000-0x0000000004CE7000-memory.dmp

Filesize
412KB

Download
memory/2732-15-0x0000000004C80000-0x0000000004CE7000-memory.dmp

Filesize
412KB

Download
memory/2732-17-0x0000000004C80000-0x0000000004CE7000-memory.dmp

Filesize
412KB

Download
memory/2732-19-0x0000000004C80000-0x0000000004CE7000-memory.dmp

Filesize
412KB

Download
memory/2732-23-0x0000000004C80000-0x0000000004CE7000-memory.dmp

Filesize
412KB

Download
memory/2732-21-0x0000000004C80000-0x0000000004CE7000-memory.dmp

Filesize
412KB

Download
memory/2732-25-0x0000000004C80000-0x0000000004CE7000-memory.dmp

Filesize
412KB

Download
memory/2732-27-0x0000000004C80000-0x0000000004CE7000-memory.dmp

Filesize
412KB

Download
memory/2732-29-0x0000000004C80000-0x0000000004CE7000-memory.dmp

Filesize
412KB

Download
memory/2732-31-0x0000000004C80000-0x0000000004CE7000-memory.dmp

Filesize
412KB

Download
memory/2732-6-0x0000000000590000-0x00000000005D2000-memory.dmp

Filesize
264KB

Download
memory/2732-35-0x0000000004C80000-0x0000000004CE7000-memory.dmp

Filesize
412KB

Download
memory/2732-37-0x0000000004C80000-0x0000000004CE7000-memory.dmp

Filesize
412KB

Download
memory/2732-39-0x0000000004C80000-0x0000000004CE7000-memory.dmp

Filesize
412KB

Download
memory/2732-41-0x0000000004C80000-0x0000000004CE7000-memory.dmp

Filesize
412KB

Download
memory/2732-43-0x0000000004C80000-0x0000000004CE7000-memory.dmp

Filesize
412KB

Download
memory/2732-7-0x0000000004C80000-0x0000000004CEE000-memory.dmp

Filesize
440KB

Download
memory/2732-47-0x0000000004C80000-0x0000000004CE7000-memory.dmp

Filesize
412KB

Download
memory/2732-49-0x0000000004C80000-0x0000000004CE7000-memory.dmp

Filesize
412KB

Download
memory/2732-51-0x0000000004C80000-0x0000000004CE7000-memory.dmp

Filesize
412KB

Download
memory/2732-53-0x0000000004C80000-0x0000000004CE7000-memory.dmp

Filesize
412KB

Download
memory/2732-55-0x0000000004C80000-0x0000000004CE7000-memory.dmp

Filesize
412KB

Download
memory/2732-57-0x0000000004C80000-0x0000000004CE7000-memory.dmp

Filesize
412KB

Download
memory/2732-59-0x0000000004C80000-0x0000000004CE7000-memory.dmp

Filesize
412KB

Download
memory/2732-61-0x0000000004C80000-0x0000000004CE7000-memory.dmp

Filesize
412KB

Download
memory/2732-63-0x0000000004C80000-0x0000000004CE7000-memory.dmp

Filesize
412KB

Download
memory/2732-65-0x0000000004C80000-0x0000000004CE7000-memory.dmp

Filesize
412KB

Download
memory/2732-67-0x0000000004C80000-0x0000000004CE7000-memory.dmp

Filesize
412KB

Download
memory/2732-5-0x0000000004E40000-0x0000000004E80000-memory.dmp

Filesize
256KB

Download
memory/2732-4-0x00000000743A0000-0x0000000074A8E000-memory.dmp

Filesize
6.9MB

Download
memory/2732-3-0x0000000004E40000-0x0000000004E80000-memory.dmp

Filesize
256KB

Download
memory/2732-2-0x0000000004E40000-0x0000000004E80000-memory.dmp

Filesize
256KB

Download
memory/2732-0-0x00000000013B0000-0x00000000014B8000-memory.dmp

Filesize
1.0MB

Download
memory/2732-1-0x00000000743A0000-0x0000000074A8E000-memory.dmp

Filesize
6.9MB

Download
memory/2732-69-0x0000000004C80000-0x0000000004CE7000-memory.dmp

Filesize
412KB

Download
memory/2732-71-0x0000000004C80000-0x0000000004CE7000-memory.dmp

Filesize
412KB

Download
memory/2732-534-0x0000000004E40000-0x0000000004E80000-memory.dmp

Filesize
256KB

Download
memory/2732-1953-0x00000000743A0000-0x0000000074A8E000-memory.dmp

Filesize
6.9MB

Download

description	pid	process	target process
PID 2732 wrote to memory of 2336	2732	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe	WScript.exe
PID 2732 wrote to memory of 2336	2732	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe	WScript.exe
PID 2732 wrote to memory of 2336	2732	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe	WScript.exe
PID 2732 wrote to memory of 2336	2732	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe	WScript.exe
PID 2732 wrote to memory of 1716	2732	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
PID 2732 wrote to memory of 1716	2732	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
PID 2732 wrote to memory of 1716	2732	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
PID 2732 wrote to memory of 1716	2732	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
PID 2732 wrote to memory of 2528	2732	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
PID 2732 wrote to memory of 2528	2732	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
PID 2732 wrote to memory of 2528	2732	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
PID 2732 wrote to memory of 2528	2732	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
PID 2732 wrote to memory of 1580	2732	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
PID 2732 wrote to memory of 1580	2732	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
PID 2732 wrote to memory of 1580	2732	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
PID 2732 wrote to memory of 1580	2732	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
PID 2732 wrote to memory of 1580	2732	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
PID 2732 wrote to memory of 1580	2732	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
PID 2732 wrote to memory of 1580	2732	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
PID 2732 wrote to memory of 1580	2732	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
PID 2336 wrote to memory of 284	2336	WScript.exe	powershell.exe
PID 2336 wrote to memory of 284	2336	WScript.exe	powershell.exe
PID 2336 wrote to memory of 284	2336	WScript.exe	powershell.exe
PID 2336 wrote to memory of 284	2336	WScript.exe	powershell.exe
PID 2732 wrote to memory of 1580	2732	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads