revengerat | 31e632dccf77dfff8b017277822f12197713b9c75661d7fbff9bbf0d78b0d29f

General

Target

5982bb4d0adca614bf0b71398932e643_JaffaCakes118.exe
Size

1.1MB
MD5

5982bb4d0adca614bf0b71398932e643
SHA1

c1180a512d8f03f7db9cc71fc20d780e72d0478d
SHA256

31e632dccf77dfff8b017277822f12197713b9c75661d7fbff9bbf0d78b0d29f
SHA512

88bdc2c2daa7e7fbd9d7abb7f0d2f7a1c7e2dae6be81cc0dd018b79227105ddad11822cc12a464a03986ff41949e5efd845ce9b5244a4f75e842448e75123044
SSDEEP

24576:Cq5TfcdHj4fmb12qv0MmV0VMXLG3on1Gx1s4oo5osSxk:CUTsamhx5o1no5oK

Score

10^/10

revengerat stealer trojan upx

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral1/files/0x00090000000155e2-4.dat	revengerat

Executes dropped EXE 1 IoCs

pid	Process
2076	dmr_72.exe

Loads dropped DLL 4 IoCs

pid	Process
2812	5982bb4d0adca614bf0b71398932e643_JaffaCakes118.exe
2812	5982bb4d0adca614bf0b71398932e643_JaffaCakes118.exe
2812	5982bb4d0adca614bf0b71398932e643_JaffaCakes118.exe
2812	5982bb4d0adca614bf0b71398932e643_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2812-0-0x00000000000A0000-0x0000000000316000-memory.dmp	upx
behavioral1/memory/2812-25-0x00000000000A0000-0x0000000000316000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2812-25-0x00000000000A0000-0x0000000000316000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2812	5982bb4d0adca614bf0b71398932e643_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2076	dmr_72.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2812	5982bb4d0adca614bf0b71398932e643_JaffaCakes118.exe
2812	5982bb4d0adca614bf0b71398932e643_JaffaCakes118.exe
2812	5982bb4d0adca614bf0b71398932e643_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2812	5982bb4d0adca614bf0b71398932e643_JaffaCakes118.exe
2812	5982bb4d0adca614bf0b71398932e643_JaffaCakes118.exe
2812	5982bb4d0adca614bf0b71398932e643_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2076	dmr_72.exe
2076	dmr_72.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 2076	2812	5982bb4d0adca614bf0b71398932e643_JaffaCakes118.exe	28
PID 2812 wrote to memory of 2076	2812	5982bb4d0adca614bf0b71398932e643_JaffaCakes118.exe	28
PID 2812 wrote to memory of 2076	2812	5982bb4d0adca614bf0b71398932e643_JaffaCakes118.exe	28
PID 2812 wrote to memory of 2076	2812	5982bb4d0adca614bf0b71398932e643_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\5982bb4d0adca614bf0b71398932e643_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5982bb4d0adca614bf0b71398932e643_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe
  "C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe" -install -54484138 -chipde -a32b8e5a9e8d4605b6a655ed50695cfc - -BLUB2 -bsoryxbzhkakdmjs -2812
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DMR\bsoryxbzhkakdmjs.dat

Filesize
163B

MD5
0b0e18713df926d7ac60ad12be9ee14a

SHA1
3d7bfb19b2d25b19fe1e2655b1ba75ea3ee7da03

SHA256
e56752d86cd4f972f5b64ce849f9f618d5fe307abe3782752c13df39965d70b5

SHA512
6e92d6f314b403c41586c3514022824d46b4563ddaecccc188882df55e16e663fc240190648219fa6ae2158705e181a64c2b86f4bedc94c43724c890b62e6ac4

Download Submit
\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe

Filesize
373KB

MD5
7563de18185a34b3717528c1f18f0e60

SHA1
4e5e8b54dda603d7e83f3ede2bcdd8064d4edf22

SHA256
266b2766df8a91a8baa41ae47b5cbe03e80023516c6c69613ebf956b2574e82d

SHA512
2ea8afc613bb175a5399045017f306d12da1d300c443570039937896b66fffa346baaba46d2a7b45817db955fc4d86dc6e658677bfe30ef74355a0cef7ea6cbb

Download Submit
memory/2076-20-0x000007FEF53D0000-0x000007FEF5DBC000-memory.dmp

Filesize
9.9MB

Download
memory/2076-17-0x0000000001290000-0x00000000012F2000-memory.dmp

Filesize
392KB

Download
memory/2076-16-0x000007FEF53D3000-0x000007FEF53D4000-memory.dmp

Filesize
4KB

Download
memory/2076-19-0x000007FEF53D0000-0x000007FEF5DBC000-memory.dmp

Filesize
9.9MB

Download
memory/2076-21-0x000007FEF53D0000-0x000007FEF5DBC000-memory.dmp

Filesize
9.9MB

Download
memory/2076-22-0x000007FEF53D0000-0x000007FEF5DBC000-memory.dmp

Filesize
9.9MB

Download
memory/2076-23-0x000007FEF53D0000-0x000007FEF5DBC000-memory.dmp

Filesize
9.9MB

Download
memory/2076-26-0x000007FEF53D0000-0x000007FEF5DBC000-memory.dmp

Filesize
9.9MB

Download
memory/2076-27-0x000007FEF53D0000-0x000007FEF5DBC000-memory.dmp

Filesize
9.9MB

Download
memory/2812-0-0x00000000000A0000-0x0000000000316000-memory.dmp

Filesize
2.5MB

Download
memory/2812-25-0x00000000000A0000-0x0000000000316000-memory.dmp

Filesize
2.5MB

Download

Analysis

Sharing