revengerat | 14d6c2508873b72d123a8063b996cbcfa5cb5b022b5354937380560e1f8ca3ff

General

Target

4da76b8b9a77254611b7c846c3b0fd70_NeikiAnalytics.exe
Size

1.3MB
MD5

4da76b8b9a77254611b7c846c3b0fd70
SHA1

5e41e6b8e26cdb580c00b661976dfc7ebf19ee3c
SHA256

14d6c2508873b72d123a8063b996cbcfa5cb5b022b5354937380560e1f8ca3ff
SHA512

dce8baa1b6ca143fceffeaf771eaad5e0d6cf0ef3eb43c86515d4eb691c09d246df0abbc462536f1840646fc04853bf50e8124baf2f414650f2179fc4b1e83a3
SSDEEP

24576:uq5TfcdHj4fmbpD2qr24Hywe4CaeRzs1Ay6z5R03+dT3yozygK:uUTsam9xzHywe4C/s10dTA

Score

10^/10

revengerat stealer trojan upx

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral1/files/0x0038000000013362-4.dat	revengerat

Executes dropped EXE 1 IoCs

pid	Process
2016	dmr_72.exe

Loads dropped DLL 4 IoCs

pid	Process
2036	4da76b8b9a77254611b7c846c3b0fd70_NeikiAnalytics.exe
2036	4da76b8b9a77254611b7c846c3b0fd70_NeikiAnalytics.exe
2036	4da76b8b9a77254611b7c846c3b0fd70_NeikiAnalytics.exe
2036	4da76b8b9a77254611b7c846c3b0fd70_NeikiAnalytics.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2036-0-0x00000000009A0000-0x0000000000C62000-memory.dmp	upx
behavioral1/memory/2036-24-0x00000000009A0000-0x0000000000C62000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2036-24-0x00000000009A0000-0x0000000000C62000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2036	4da76b8b9a77254611b7c846c3b0fd70_NeikiAnalytics.exe
2016	dmr_72.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2036	4da76b8b9a77254611b7c846c3b0fd70_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2016	dmr_72.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2036	4da76b8b9a77254611b7c846c3b0fd70_NeikiAnalytics.exe
2036	4da76b8b9a77254611b7c846c3b0fd70_NeikiAnalytics.exe
2036	4da76b8b9a77254611b7c846c3b0fd70_NeikiAnalytics.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2036	4da76b8b9a77254611b7c846c3b0fd70_NeikiAnalytics.exe
2036	4da76b8b9a77254611b7c846c3b0fd70_NeikiAnalytics.exe
2036	4da76b8b9a77254611b7c846c3b0fd70_NeikiAnalytics.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2016	dmr_72.exe
2016	dmr_72.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2016	2036	4da76b8b9a77254611b7c846c3b0fd70_NeikiAnalytics.exe	28
PID 2036 wrote to memory of 2016	2036	4da76b8b9a77254611b7c846c3b0fd70_NeikiAnalytics.exe	28
PID 2036 wrote to memory of 2016	2036	4da76b8b9a77254611b7c846c3b0fd70_NeikiAnalytics.exe	28
PID 2036 wrote to memory of 2016	2036	4da76b8b9a77254611b7c846c3b0fd70_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\4da76b8b9a77254611b7c846c3b0fd70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4da76b8b9a77254611b7c846c3b0fd70_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe
  "C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe" -install -54428224 -chipderedesign -3ec27ac4dee841cb8fb6a172aa88e2ac - -BLUB2 -ltsmjghnlkmwosyh -2036
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DMR\ltsmjghnlkmwosyh.dat

Filesize
206B

MD5
a372ace647e0a3ed3274ff1542b61ced

SHA1
80915e05f4f6d6da34c02f9e0875cc52071ecf25

SHA256
cc094797520fcadc244bee033efbbbf7916342be619ff1fc1bbe9cc11c80be7e

SHA512
d7ba913114f3ecddc5fc7ac4bf84d41ca2ef40bccfb34a869a8cbbd91fd629e42f3f85dbf1763f6b22f7eee2bb32b4bc99525efb83480e4a994bb468935603fc

Download Submit
\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe

Filesize
449KB

MD5
dfea6e8d3b44f790adb0c0ff067b5cb9

SHA1
6fcd6054d71e8c4b257b5e325b3989485075a7c7

SHA256
7f1d111345d073c98096ef34d373cd7080914616e749a3f043168f054c6d3ff2

SHA512
0f49ae74cac6c9b1470aa2a7e10587bc76ca1726efc47e85e65b2455b59b5e70f233eed368e44e11b5ab08cac842d46150f87637f21cede30289da05a5b5882b

Download Submit
memory/2016-16-0x000007FEF51F3000-0x000007FEF51F4000-memory.dmp

Filesize
4KB

Download
memory/2016-17-0x0000000000240000-0x00000000002B4000-memory.dmp

Filesize
464KB

Download
memory/2016-19-0x000007FEF51F0000-0x000007FEF5BDC000-memory.dmp

Filesize
9.9MB

Download
memory/2016-20-0x000007FEF51F0000-0x000007FEF5BDC000-memory.dmp

Filesize
9.9MB

Download
memory/2016-21-0x000007FEF51F0000-0x000007FEF5BDC000-memory.dmp

Filesize
9.9MB

Download
memory/2016-22-0x000007FEF51F0000-0x000007FEF5BDC000-memory.dmp

Filesize
9.9MB

Download
memory/2016-23-0x000007FEF51F0000-0x000007FEF5BDC000-memory.dmp

Filesize
9.9MB

Download
memory/2016-25-0x000007FEF51F0000-0x000007FEF5BDC000-memory.dmp

Filesize
9.9MB

Download
memory/2036-0-0x00000000009A0000-0x0000000000C62000-memory.dmp

Filesize
2.8MB

Download
memory/2036-24-0x00000000009A0000-0x0000000000C62000-memory.dmp

Filesize
2.8MB

Download

Analysis

Sharing