revengerat | 8c598c9782ffaf10ac7bd59c5a48acc267d15590eccba787b61cda62a7ea7138

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 02:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
Size

1.0MB
MD5

f95564a72a16d6a4efa39278f0721ac2
SHA1

4e93f6849ca3717ebb3fe64f01b2384592906464
SHA256

8c598c9782ffaf10ac7bd59c5a48acc267d15590eccba787b61cda62a7ea7138
SHA512

d371acb9407680c06f8991d06046419ae0dd156e214ed6ce1062e0499caced63ddd5a323ca8176947555e2770d6ca2cccf9f2f59becc2997d8fc2a102565ea8d
SSDEEP

24576:iJjAKND1LIQgBPiXOa8tspOJy2HNyCY3rw:iJjN9IQEiXOBywmr

Score

10^/10

revengerat zgrat nyancatrevenge persistence rat trojan

Malware Config

Extracted

Family

revengerat

Botnet

NyanCatRevenge

dontreachme.duckdns.org:3601

Mutex

159ffe7d99124a92baa

Signatures

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2756-10-0x0000000006110000-0x000000000617E000-memory.dmp	family_zgrat_v1
behavioral2/memory/2756-11-0x0000000006110000-0x0000000006177000-memory.dmp	family_zgrat_v1
behavioral2/memory/2756-12-0x0000000006110000-0x0000000006177000-memory.dmp	family_zgrat_v1
behavioral2/memory/2756-14-0x0000000006110000-0x0000000006177000-memory.dmp	family_zgrat_v1
behavioral2/memory/2756-16-0x0000000006110000-0x0000000006177000-memory.dmp	family_zgrat_v1
behavioral2/memory/2756-18-0x0000000006110000-0x0000000006177000-memory.dmp	family_zgrat_v1
behavioral2/memory/2756-20-0x0000000006110000-0x0000000006177000-memory.dmp	family_zgrat_v1
behavioral2/memory/2756-22-0x0000000006110000-0x0000000006177000-memory.dmp	family_zgrat_v1
behavioral2/memory/2756-24-0x0000000006110000-0x0000000006177000-memory.dmp	family_zgrat_v1
behavioral2/memory/2756-26-0x0000000006110000-0x0000000006177000-memory.dmp	family_zgrat_v1
behavioral2/memory/2756-28-0x0000000006110000-0x0000000006177000-memory.dmp	family_zgrat_v1
behavioral2/memory/2756-30-0x0000000006110000-0x0000000006177000-memory.dmp	family_zgrat_v1
behavioral2/memory/2756-32-0x0000000006110000-0x0000000006177000-memory.dmp	family_zgrat_v1
behavioral2/memory/2756-34-0x0000000006110000-0x0000000006177000-memory.dmp	family_zgrat_v1
behavioral2/memory/2756-36-0x0000000006110000-0x0000000006177000-memory.dmp	family_zgrat_v1
behavioral2/memory/2756-38-0x0000000006110000-0x0000000006177000-memory.dmp	family_zgrat_v1
behavioral2/memory/2756-40-0x0000000006110000-0x0000000006177000-memory.dmp	family_zgrat_v1
behavioral2/memory/2756-42-0x0000000006110000-0x0000000006177000-memory.dmp	family_zgrat_v1
behavioral2/memory/2756-44-0x0000000006110000-0x0000000006177000-memory.dmp	family_zgrat_v1
behavioral2/memory/2756-46-0x0000000006110000-0x0000000006177000-memory.dmp	family_zgrat_v1
behavioral2/memory/2756-48-0x0000000006110000-0x0000000006177000-memory.dmp	family_zgrat_v1
behavioral2/memory/2756-50-0x0000000006110000-0x0000000006177000-memory.dmp	family_zgrat_v1
behavioral2/memory/2756-52-0x0000000006110000-0x0000000006177000-memory.dmp	family_zgrat_v1
behavioral2/memory/2756-54-0x0000000006110000-0x0000000006177000-memory.dmp	family_zgrat_v1
behavioral2/memory/2756-56-0x0000000006110000-0x0000000006177000-memory.dmp	family_zgrat_v1
behavioral2/memory/2756-58-0x0000000006110000-0x0000000006177000-memory.dmp	family_zgrat_v1
behavioral2/memory/2756-60-0x0000000006110000-0x0000000006177000-memory.dmp	family_zgrat_v1
behavioral2/memory/2756-62-0x0000000006110000-0x0000000006177000-memory.dmp	family_zgrat_v1
behavioral2/memory/2756-64-0x0000000006110000-0x0000000006177000-memory.dmp	family_zgrat_v1
behavioral2/memory/2756-66-0x0000000006110000-0x0000000006177000-memory.dmp	family_zgrat_v1
behavioral2/memory/2756-68-0x0000000006110000-0x0000000006177000-memory.dmp	family_zgrat_v1
behavioral2/memory/2756-70-0x0000000006110000-0x0000000006177000-memory.dmp	family_zgrat_v1
behavioral2/memory/2756-72-0x0000000006110000-0x0000000006177000-memory.dmp	family_zgrat_v1
behavioral2/memory/2756-74-0x0000000006110000-0x0000000006177000-memory.dmp	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\JavaUpdate\\JavaUpdate.exe\","	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exeWScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe

description	pid	process	target process
PID 2756 set thread context of 4972	2756	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000_Classes\Local Settings	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exepowershell.exe

pid	process
2756	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
2756	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
4456	powershell.exe
4456	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2756 f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
Token: SeDebugPrivilege 4456 powershell.exe

description	pid	process
Token: SeDebugPrivilege	2756	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
Token: SeDebugPrivilege	4456	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exeWScript.exe

description	pid	process	target process
PID 2756 wrote to memory of 2372	2756	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe	WScript.exe
PID 2756 wrote to memory of 2372	2756	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe	WScript.exe
PID 2756 wrote to memory of 2372	2756	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe	WScript.exe
PID 2756 wrote to memory of 4972	2756	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
PID 2756 wrote to memory of 4972	2756	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
PID 2756 wrote to memory of 4972	2756	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
PID 2756 wrote to memory of 4972	2756	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
PID 2756 wrote to memory of 4972	2756	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
PID 2756 wrote to memory of 4972	2756	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
PID 2756 wrote to memory of 4972	2756	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
PID 2756 wrote to memory of 4972	2756	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe	f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
PID 2372 wrote to memory of 4456	2372	WScript.exe	powershell.exe
PID 2372 wrote to memory of 4456	2372	WScript.exe	powershell.exe
PID 2372 wrote to memory of 4456	2372	WScript.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2756

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Xtsijkfgdndn.vbs"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2372

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Local\JavaUpdate\JavaUpdate.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4456

C:\Users\Admin\AppData\Local\Temp\f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe
2⤵
PID:4972

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\f95564a72a16d6a4efa39278f0721ac2_JaffaCakes118.exe.log
Filesize
1KB

MD5
7ebe314bf617dc3e48b995a6c352740c

SHA1
538f643b7b30f9231a3035c448607f767527a870

SHA256
48178f884b8a4dd96e330b210b0530667d9473a7629fc6b4ad12b614bf438ee8

SHA512
0ba9d8f4244c15285e254d27b4bff7c49344ff845c48bc0bf0d8563072fab4d6f7a6abe6b6742e8375a08e9a3b3e5d5dc4937ab428dbe2dd8e62892fda04507e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Xtsijkfgdndn.vbs
Filesize
149B

MD5
75fda8189e60e05655aea55fe68591c0

SHA1
de2177e12403c59f81d278497a387089ddd10d73

SHA256
cf8322af201e7b0f5d5b2b93c0df541c8785436ebdf04a32addc46b13caf81c5

SHA512
1bc581cbe6ba2f7f9a419bdb9b582ec5585d5cdfd8e245cab19c269d2bd4ecbc151cd98996b8d5f330304fda243c4a13388f1c601111dbab59fd0ad35e5ea647

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ckpr2tjm.yun.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2756-62-0x0000000006110000-0x0000000006177000-memory.dmp

Filesize
412KB

Download
memory/2756-34-0x0000000006110000-0x0000000006177000-memory.dmp

Filesize
412KB

Download
memory/2756-2-0x00000000051E0000-0x0000000005784000-memory.dmp

Filesize
5.6MB

Download
memory/2756-3-0x0000000004CD0000-0x0000000004D62000-memory.dmp

Filesize
584KB

Download
memory/2756-4-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

Filesize
64KB

Download
memory/2756-5-0x0000000004C70000-0x0000000004C7A000-memory.dmp

Filesize
40KB

Download
memory/2756-6-0x00000000743D0000-0x0000000074B80000-memory.dmp

Filesize
7.7MB

Download
memory/2756-7-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

Filesize
64KB

Download
memory/2756-8-0x0000000004F30000-0x0000000004F72000-memory.dmp

Filesize
264KB

Download
memory/2756-9-0x00000000051A0000-0x00000000051E2000-memory.dmp

Filesize
264KB

Download
memory/2756-10-0x0000000006110000-0x000000000617E000-memory.dmp

Filesize
440KB

Download
memory/2756-11-0x0000000006110000-0x0000000006177000-memory.dmp

Filesize
412KB

Download
memory/2756-12-0x0000000006110000-0x0000000006177000-memory.dmp

Filesize
412KB

Download
memory/2756-14-0x0000000006110000-0x0000000006177000-memory.dmp

Filesize
412KB

Download
memory/2756-16-0x0000000006110000-0x0000000006177000-memory.dmp

Filesize
412KB

Download
memory/2756-18-0x0000000006110000-0x0000000006177000-memory.dmp

Filesize
412KB

Download
memory/2756-20-0x0000000006110000-0x0000000006177000-memory.dmp

Filesize
412KB

Download
memory/2756-22-0x0000000006110000-0x0000000006177000-memory.dmp

Filesize
412KB

Download
memory/2756-24-0x0000000006110000-0x0000000006177000-memory.dmp

Filesize
412KB

Download
memory/2756-26-0x0000000006110000-0x0000000006177000-memory.dmp

Filesize
412KB

Download
memory/2756-28-0x0000000006110000-0x0000000006177000-memory.dmp

Filesize
412KB

Download
memory/2756-30-0x0000000006110000-0x0000000006177000-memory.dmp

Filesize
412KB

Download
memory/2756-32-0x0000000006110000-0x0000000006177000-memory.dmp

Filesize
412KB

Download
memory/2756-66-0x0000000006110000-0x0000000006177000-memory.dmp

Filesize
412KB

Download
memory/2756-36-0x0000000006110000-0x0000000006177000-memory.dmp

Filesize
412KB

Download
memory/2756-68-0x0000000006110000-0x0000000006177000-memory.dmp

Filesize
412KB

Download
memory/2756-40-0x0000000006110000-0x0000000006177000-memory.dmp

Filesize
412KB

Download
memory/2756-42-0x0000000006110000-0x0000000006177000-memory.dmp

Filesize
412KB

Download
memory/2756-44-0x0000000006110000-0x0000000006177000-memory.dmp

Filesize
412KB

Download
memory/2756-46-0x0000000006110000-0x0000000006177000-memory.dmp

Filesize
412KB

Download
memory/2756-48-0x0000000006110000-0x0000000006177000-memory.dmp

Filesize
412KB

Download
memory/2756-50-0x0000000006110000-0x0000000006177000-memory.dmp

Filesize
412KB

Download
memory/2756-52-0x0000000006110000-0x0000000006177000-memory.dmp

Filesize
412KB

Download
memory/2756-54-0x0000000006110000-0x0000000006177000-memory.dmp

Filesize
412KB

Download
memory/2756-56-0x0000000006110000-0x0000000006177000-memory.dmp

Filesize
412KB

Download
memory/2756-58-0x0000000006110000-0x0000000006177000-memory.dmp

Filesize
412KB

Download
memory/2756-60-0x0000000006110000-0x0000000006177000-memory.dmp

Filesize
412KB

Download
memory/2756-0-0x00000000001A0000-0x00000000002A8000-memory.dmp

Filesize
1.0MB

Download
memory/2756-1-0x00000000743D0000-0x0000000074B80000-memory.dmp

Filesize
7.7MB

Download
memory/2756-64-0x0000000006110000-0x0000000006177000-memory.dmp

Filesize
412KB

Download
memory/2756-38-0x0000000006110000-0x0000000006177000-memory.dmp

Filesize
412KB

Download
memory/2756-70-0x0000000006110000-0x0000000006177000-memory.dmp

Filesize
412KB

Download
memory/2756-72-0x0000000006110000-0x0000000006177000-memory.dmp

Filesize
412KB

Download
memory/2756-74-0x0000000006110000-0x0000000006177000-memory.dmp

Filesize
412KB

Download
memory/2756-518-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

Filesize
64KB

Download
memory/2756-1947-0x00000000743D0000-0x0000000074B80000-memory.dmp

Filesize
7.7MB

Download
memory/4456-1992-0x00000000078A0000-0x00000000078A8000-memory.dmp

Filesize
32KB

Download
memory/4456-1971-0x00000000701F0000-0x000000007023C000-memory.dmp

Filesize
304KB

Download
memory/4456-1951-0x00000000029D0000-0x0000000002A06000-memory.dmp

Filesize
216KB

Download
memory/4456-1952-0x00000000055B0000-0x0000000005BD8000-memory.dmp

Filesize
6.2MB

Download
memory/4456-1953-0x0000000005330000-0x0000000005352000-memory.dmp

Filesize
136KB

Download
memory/4456-1954-0x0000000005400000-0x0000000005466000-memory.dmp

Filesize
408KB

Download
memory/4456-1955-0x0000000005CE0000-0x0000000005D46000-memory.dmp

Filesize
408KB

Download
memory/4456-1965-0x0000000005F40000-0x0000000006294000-memory.dmp

Filesize
3.3MB

Download
memory/4456-1966-0x00000000062F0000-0x000000000630E000-memory.dmp

Filesize
120KB

Download
memory/4456-1967-0x0000000006330000-0x000000000637C000-memory.dmp

Filesize
304KB

Download
memory/4456-1995-0x00000000743D0000-0x0000000074B80000-memory.dmp

Filesize
7.7MB

Download
memory/4456-1984-0x0000000007C60000-0x00000000082DA000-memory.dmp

Filesize
6.5MB

Download
memory/4456-1991-0x0000000007970000-0x000000000798A000-memory.dmp

Filesize
104KB

Download
memory/4456-1969-0x000000007FA50000-0x000000007FA60000-memory.dmp

Filesize
64KB

Download
memory/4456-1970-0x00000000068B0000-0x00000000068E2000-memory.dmp

Filesize
200KB

Download
memory/4456-1950-0x0000000002B00000-0x0000000002B10000-memory.dmp

Filesize
64KB

Download
memory/4456-1982-0x00000000072D0000-0x00000000072EE000-memory.dmp

Filesize
120KB

Download
memory/4456-1981-0x0000000002B00000-0x0000000002B10000-memory.dmp

Filesize
64KB

Download
memory/4456-1983-0x00000000072F0000-0x0000000007393000-memory.dmp

Filesize
652KB

Download
memory/4456-1949-0x00000000743D0000-0x0000000074B80000-memory.dmp

Filesize
7.7MB

Download
memory/4456-1985-0x0000000007620000-0x000000000763A000-memory.dmp

Filesize
104KB

Download
memory/4456-1986-0x0000000007680000-0x000000000768A000-memory.dmp

Filesize
40KB

Download
memory/4456-1987-0x00000000078B0000-0x0000000007946000-memory.dmp

Filesize
600KB

Download
memory/4456-1988-0x0000000007820000-0x0000000007831000-memory.dmp

Filesize
68KB

Download
memory/4456-1989-0x0000000007850000-0x000000000785E000-memory.dmp

Filesize
56KB

Download
memory/4456-1990-0x0000000007860000-0x0000000007874000-memory.dmp

Filesize
80KB

Download
memory/4972-1968-0x0000000005980000-0x0000000005990000-memory.dmp

Filesize
64KB

Download
memory/4972-1946-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4972-1948-0x00000000743D0000-0x0000000074B80000-memory.dmp

Filesize
7.7MB

Download
memory/4972-1996-0x00000000743D0000-0x0000000074B80000-memory.dmp

Filesize
7.7MB

Download
memory/4972-1997-0x0000000005980000-0x0000000005990000-memory.dmp

Filesize
64KB

Download