revengerat | de110c481ca316e3f5858a9f53535991fcf40cb35ac385019c61e0acdaf5ac94

General

Target

aabe13fca3d4b9e2813db8f552e0bfd0_NeikiAnalytics.exe
Size

1.4MB
MD5

aabe13fca3d4b9e2813db8f552e0bfd0
SHA1

a5f142d524053fc681ab364c12ff99212eac4758
SHA256

de110c481ca316e3f5858a9f53535991fcf40cb35ac385019c61e0acdaf5ac94
SHA512

3ce892109225248c0a385364bf443f11d02ec0e6e84128051550b76cd470d1bb6f51e32645adff99f6b5162f2b1efb17c101cd803c0e97134cca4a7076a1504a
SSDEEP

24576:vq5TfcdHj4fmbk2qwEzKJ9Ttr60lYYtWY2YPGO0zQJ9TtFaLnUMvkYtWYnYPqWt:vUTsam4xm5IYtWY2YPJ5DYtWYnYP1

Score

10^/10

revengerat stealer trojan upx

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral1/files/0x0038000000015d28-4.dat	revengerat

Executes dropped EXE 1 IoCs

pid	Process
1788	dmr_72.exe

Loads dropped DLL 4 IoCs

pid	Process
2236	aabe13fca3d4b9e2813db8f552e0bfd0_NeikiAnalytics.exe
2236	aabe13fca3d4b9e2813db8f552e0bfd0_NeikiAnalytics.exe
2236	aabe13fca3d4b9e2813db8f552e0bfd0_NeikiAnalytics.exe
2236	aabe13fca3d4b9e2813db8f552e0bfd0_NeikiAnalytics.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2236-0-0x0000000000270000-0x0000000000578000-memory.dmp	upx
behavioral1/memory/2236-24-0x0000000000270000-0x0000000000578000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2236-24-0x0000000000270000-0x0000000000578000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2236	aabe13fca3d4b9e2813db8f552e0bfd0_NeikiAnalytics.exe
1788	dmr_72.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1788	dmr_72.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2236	aabe13fca3d4b9e2813db8f552e0bfd0_NeikiAnalytics.exe
2236	aabe13fca3d4b9e2813db8f552e0bfd0_NeikiAnalytics.exe
2236	aabe13fca3d4b9e2813db8f552e0bfd0_NeikiAnalytics.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2236	aabe13fca3d4b9e2813db8f552e0bfd0_NeikiAnalytics.exe
2236	aabe13fca3d4b9e2813db8f552e0bfd0_NeikiAnalytics.exe
2236	aabe13fca3d4b9e2813db8f552e0bfd0_NeikiAnalytics.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1788	dmr_72.exe
1788	dmr_72.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 1788	2236	aabe13fca3d4b9e2813db8f552e0bfd0_NeikiAnalytics.exe	28
PID 2236 wrote to memory of 1788	2236	aabe13fca3d4b9e2813db8f552e0bfd0_NeikiAnalytics.exe	28
PID 2236 wrote to memory of 1788	2236	aabe13fca3d4b9e2813db8f552e0bfd0_NeikiAnalytics.exe	28
PID 2236 wrote to memory of 1788	2236	aabe13fca3d4b9e2813db8f552e0bfd0_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\aabe13fca3d4b9e2813db8f552e0bfd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\aabe13fca3d4b9e2813db8f552e0bfd0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe
  "C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe" -install -54463312 -chipderedesign -a809d8d02f8f417e9741c4f917a148b8 - -BLUB2 -axcbvmocxynmofdj -2236
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DMR\axcbvmocxynmofdj.dat

Filesize
163B

MD5
fbb582572ee1d022a7d8f9cdcd2af6c8

SHA1
63c822adea974a502b9f2931784fd2f16a4402bc

SHA256
8f50cc5b37aac16143aadb2be18d6cd4574e0932fd72abda45ff7455575c7032

SHA512
7d9ecc653c4d88a6e57c8989c6e8a86890167c255cda0a446fb283a2feb1cdd13400149cd8d23383cc4496fd0efd23d1126d432c9312049a781ad575ba9f690b

Download Submit
\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe

Filesize
519KB

MD5
cca0a31a96b965f3e121599df138afe0

SHA1
06e33278d473995ebb843a1fc99e964929dd9ad4

SHA256
e8c94324346a70c2ae8d2320816bbc579578b443af0f80abba75865892f15974

SHA512
74e549f3d19660205a104f62e166ec68261ed8adebf1aa8c27f285f22802c999064262bf77dbdbc548af1720b867bd3dfcee6a81a986d48d46022d4e339fb829

Download Submit
memory/1788-16-0x000007FEF5483000-0x000007FEF5484000-memory.dmp

Filesize
4KB

Download
memory/1788-17-0x0000000001030000-0x00000000010B8000-memory.dmp

Filesize
544KB

Download
memory/1788-19-0x000007FEF5480000-0x000007FEF5E6C000-memory.dmp

Filesize
9.9MB

Download
memory/1788-20-0x000007FEF5480000-0x000007FEF5E6C000-memory.dmp

Filesize
9.9MB

Download
memory/1788-21-0x000007FEF5480000-0x000007FEF5E6C000-memory.dmp

Filesize
9.9MB

Download
memory/1788-22-0x000007FEF5480000-0x000007FEF5E6C000-memory.dmp

Filesize
9.9MB

Download
memory/1788-23-0x000007FEF5480000-0x000007FEF5E6C000-memory.dmp

Filesize
9.9MB

Download
memory/1788-25-0x000007FEF5480000-0x000007FEF5E6C000-memory.dmp

Filesize
9.9MB

Download
memory/2236-0-0x0000000000270000-0x0000000000578000-memory.dmp

Filesize
3.0MB

Download
memory/2236-24-0x0000000000270000-0x0000000000578000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing