revengerat | de110c481ca316e3f5858a9f53535991fcf40cb35ac385019c61e0acdaf5ac94

General

Target

aabe13fca3d4b9e2813db8f552e0bfd0_NeikiAnalytics.exe
Size

1.4MB
MD5

aabe13fca3d4b9e2813db8f552e0bfd0
SHA1

a5f142d524053fc681ab364c12ff99212eac4758
SHA256

de110c481ca316e3f5858a9f53535991fcf40cb35ac385019c61e0acdaf5ac94
SHA512

3ce892109225248c0a385364bf443f11d02ec0e6e84128051550b76cd470d1bb6f51e32645adff99f6b5162f2b1efb17c101cd803c0e97134cca4a7076a1504a
SSDEEP

24576:vq5TfcdHj4fmbk2qwEzKJ9Ttr60lYYtWY2YPGO0zQJ9TtFaLnUMvkYtWYnYPqWt:vUTsam4xm5IYtWY2YPJ5DYtWYnYP1

Score

10^/10

revengerat stealer trojan upx

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral2/files/0x000700000002343f-6.dat	revengerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	aabe13fca3d4b9e2813db8f552e0bfd0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
4928	dmr_72.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2460-0-0x00000000009C0000-0x0000000000CC8000-memory.dmp	upx
behavioral2/memory/2460-20-0x00000000009C0000-0x0000000000CC8000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/2460-20-0x00000000009C0000-0x0000000000CC8000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2460	aabe13fca3d4b9e2813db8f552e0bfd0_NeikiAnalytics.exe
2460	aabe13fca3d4b9e2813db8f552e0bfd0_NeikiAnalytics.exe
4928	dmr_72.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2460	aabe13fca3d4b9e2813db8f552e0bfd0_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4928	dmr_72.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2460	aabe13fca3d4b9e2813db8f552e0bfd0_NeikiAnalytics.exe
2460	aabe13fca3d4b9e2813db8f552e0bfd0_NeikiAnalytics.exe
2460	aabe13fca3d4b9e2813db8f552e0bfd0_NeikiAnalytics.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2460	aabe13fca3d4b9e2813db8f552e0bfd0_NeikiAnalytics.exe
2460	aabe13fca3d4b9e2813db8f552e0bfd0_NeikiAnalytics.exe
2460	aabe13fca3d4b9e2813db8f552e0bfd0_NeikiAnalytics.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4928	dmr_72.exe
4928	dmr_72.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 4928	2460	aabe13fca3d4b9e2813db8f552e0bfd0_NeikiAnalytics.exe	84
PID 2460 wrote to memory of 4928	2460	aabe13fca3d4b9e2813db8f552e0bfd0_NeikiAnalytics.exe	84

C:\Users\Admin\AppData\Local\Temp\aabe13fca3d4b9e2813db8f552e0bfd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\aabe13fca3d4b9e2813db8f552e0bfd0_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe
  "C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe" -install -54463312 -chipderedesign -a809d8d02f8f417e9741c4f917a148b8 - -BLUB2 -swolrsxzgtnevayw -2460
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe

Filesize
519KB

MD5
cca0a31a96b965f3e121599df138afe0

SHA1
06e33278d473995ebb843a1fc99e964929dd9ad4

SHA256
e8c94324346a70c2ae8d2320816bbc579578b443af0f80abba75865892f15974

SHA512
74e549f3d19660205a104f62e166ec68261ed8adebf1aa8c27f285f22802c999064262bf77dbdbc548af1720b867bd3dfcee6a81a986d48d46022d4e339fb829

Download Submit
C:\Users\Admin\AppData\Local\Temp\DMR\swolrsxzgtnevayw.dat

Filesize
163B

MD5
fbb582572ee1d022a7d8f9cdcd2af6c8

SHA1
63c822adea974a502b9f2931784fd2f16a4402bc

SHA256
8f50cc5b37aac16143aadb2be18d6cd4574e0932fd72abda45ff7455575c7032

SHA512
7d9ecc653c4d88a6e57c8989c6e8a86890167c255cda0a446fb283a2feb1cdd13400149cd8d23383cc4496fd0efd23d1126d432c9312049a781ad575ba9f690b

Download Submit
memory/2460-0-0x00000000009C0000-0x0000000000CC8000-memory.dmp

Filesize
3.0MB

Download
memory/2460-20-0x00000000009C0000-0x0000000000CC8000-memory.dmp

Filesize
3.0MB

Download
memory/4928-13-0x00007FF8FFF43000-0x00007FF8FFF45000-memory.dmp

Filesize
8KB

Download
memory/4928-14-0x0000000000C60000-0x0000000000CE8000-memory.dmp

Filesize
544KB

Download
memory/4928-16-0x00007FF8FFF40000-0x00007FF900A01000-memory.dmp

Filesize
10.8MB

Download
memory/4928-17-0x00007FF8FFF40000-0x00007FF900A01000-memory.dmp

Filesize
10.8MB

Download
memory/4928-18-0x00007FF8FFF40000-0x00007FF900A01000-memory.dmp

Filesize
10.8MB

Download
memory/4928-19-0x00007FF8FFF40000-0x00007FF900A01000-memory.dmp

Filesize
10.8MB

Download
memory/4928-22-0x00007FF8FFF40000-0x00007FF900A01000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing