revengerat | 069dda54e9ed04b61fab601cd04890915ac043a7cdee959d879a529bfb5d0256

General

Target

5ae94a44f940470041406d034a70a88e_JaffaCakes118.exe
Size

1.1MB
MD5

5ae94a44f940470041406d034a70a88e
SHA1

041fa65374fe0312e8c05b0aacb52922db3ebf68
SHA256

069dda54e9ed04b61fab601cd04890915ac043a7cdee959d879a529bfb5d0256
SHA512

7f72923d480cd98a292c32e9765f217df2822bd72e26361f2afdc82dc80f292b72a0dfaa0f3e18d961372f8f46cd6bc6b4c92c4ab705775e07b5fe353070ba3e
SSDEEP

24576:Iq5TfcdHj4fmb02qp0MmV0VMXLG3on1Gx1s4oo5osSx5:IUTsamQxLo1no5oL

Score

10^/10

revengerat stealer trojan upx

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral1/files/0x0037000000013a6e-4.dat	revengerat

Executes dropped EXE 1 IoCs

pid	Process
1452	dmr_72.exe

Loads dropped DLL 4 IoCs

pid	Process
1228	5ae94a44f940470041406d034a70a88e_JaffaCakes118.exe
1228	5ae94a44f940470041406d034a70a88e_JaffaCakes118.exe
1228	5ae94a44f940470041406d034a70a88e_JaffaCakes118.exe
1228	5ae94a44f940470041406d034a70a88e_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1228-0-0x0000000000F20000-0x0000000001196000-memory.dmp	upx
behavioral1/memory/1228-24-0x0000000000F20000-0x0000000001196000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1228-24-0x0000000000F20000-0x0000000001196000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1228	5ae94a44f940470041406d034a70a88e_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1452	dmr_72.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1228	5ae94a44f940470041406d034a70a88e_JaffaCakes118.exe
1228	5ae94a44f940470041406d034a70a88e_JaffaCakes118.exe
1228	5ae94a44f940470041406d034a70a88e_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1228	5ae94a44f940470041406d034a70a88e_JaffaCakes118.exe
1228	5ae94a44f940470041406d034a70a88e_JaffaCakes118.exe
1228	5ae94a44f940470041406d034a70a88e_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1452	dmr_72.exe
1452	dmr_72.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 1452	1228	5ae94a44f940470041406d034a70a88e_JaffaCakes118.exe	28
PID 1228 wrote to memory of 1452	1228	5ae94a44f940470041406d034a70a88e_JaffaCakes118.exe	28
PID 1228 wrote to memory of 1452	1228	5ae94a44f940470041406d034a70a88e_JaffaCakes118.exe	28
PID 1228 wrote to memory of 1452	1228	5ae94a44f940470041406d034a70a88e_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\5ae94a44f940470041406d034a70a88e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5ae94a44f940470041406d034a70a88e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe
  "C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe" -install -54422427 -dhtechradar -d7794bb3fa4d4daab18f6ee417dd6e5f - - -vcptunjdskefzicp -1228
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DMR\vcptunjdskefzicp.dat

Filesize
67B

MD5
bedd41390149ae5d1b8f597cd59079f0

SHA1
3dba87211721eff803aaf7116e03a0d93340e943

SHA256
9ba5a50edd48fa39878d82aafe15bea5882f4d57db71eaf6ef1ce054b97b7fbb

SHA512
475c115ebb9547ccb16a290c9df1e50ae45c70051bdcd071db9c1b45afe6104a51f30bf6fe882cc043cce99be730fc3d891defc06349bf9a1b84d091d089a1ee

Download Submit
\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe

Filesize
373KB

MD5
7563de18185a34b3717528c1f18f0e60

SHA1
4e5e8b54dda603d7e83f3ede2bcdd8064d4edf22

SHA256
266b2766df8a91a8baa41ae47b5cbe03e80023516c6c69613ebf956b2574e82d

SHA512
2ea8afc613bb175a5399045017f306d12da1d300c443570039937896b66fffa346baaba46d2a7b45817db955fc4d86dc6e658677bfe30ef74355a0cef7ea6cbb

Download Submit
memory/1228-0-0x0000000000F20000-0x0000000001196000-memory.dmp

Filesize
2.5MB

Download
memory/1228-24-0x0000000000F20000-0x0000000001196000-memory.dmp

Filesize
2.5MB

Download
memory/1452-16-0x000007FEF5A33000-0x000007FEF5A34000-memory.dmp

Filesize
4KB

Download
memory/1452-17-0x0000000000020000-0x0000000000082000-memory.dmp

Filesize
392KB

Download
memory/1452-19-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp

Filesize
9.9MB

Download
memory/1452-20-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp

Filesize
9.9MB

Download
memory/1452-21-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp

Filesize
9.9MB

Download
memory/1452-22-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp

Filesize
9.9MB

Download
memory/1452-25-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing