revengerat | 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c

General

Target

LisectAVT_2403002B_27.exe
Size

155KB
MD5

e769b63b22a914d5fe9722716257e3b6
SHA1

d69e65bcb3959724ccf02e6f1d2319163c2593f1
SHA256

1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c
SHA512

e901dfc8ede587b76997c5e98b576d12c5762176fc23501f404c195732a36d532b9fea97a79b68005150ca444d9cb1d8ecc5386698f3f4e8d6038d62bd773182
SSDEEP

1536:DwVCOKVP+JC+ZzmSd1vpCaTjjbDOcAT5D8V0HOQb89NmnJAO1yqrg0Yz:DLP2rP5ppJAT5YVCA9NmnJAO1yq0r

Score

10^/10

revengerat mayo24 discovery trojan

Malware Config

Extracted

Family

revengerat

Botnet

MAYO24

C2

karmina113.sytes.net:3333

karmina117.sytes.net:3333

karmina118.sytes.net:3333

karmina119.sytes.net:3333

nibiru3.duckdns.org:3333

nibiru4.duckdns.org:3333

nibiru5.duckdns.org:3333

nibiru6.duckdns.org:3333

Mutex

WSCollect

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

Drops startup file 2 IoCs

Processes:

WSCollect.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WSCollect.exe	WSCollect.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WSCollect.exe	WSCollect.exe

Executes dropped EXE 2 IoCs

Processes:

WSCollect.exeWSCollect.exe

pid process

2820 WSCollect.exe
2752 WSCollect.exe
Loads dropped DLL 2 IoCs

Processes:

LisectAVT_2403002B_27.exeWSCollect.exe

pid process

2300 LisectAVT_2403002B_27.exe
2820 WSCollect.exe

pid	process
2820	WSCollect.exe
2752	WSCollect.exe

pid	process
2300	LisectAVT_2403002B_27.exe
2820	WSCollect.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

LisectAVT_2403002B_27.exeWSCollect.exe

description	pid	process	target process
PID 2260 set thread context of 2300	2260	LisectAVT_2403002B_27.exe	LisectAVT_2403002B_27.exe
PID 2820 set thread context of 2752	2820	WSCollect.exe	WSCollect.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

WSCollect.exeWSCollect.exeLisectAVT_2403002B_27.exeLisectAVT_2403002B_27.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WSCollect.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WSCollect.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LisectAVT_2403002B_27.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LisectAVT_2403002B_27.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

LisectAVT_2403002B_27.exeWSCollect.exe

description pid process

Token: SeDebugPrivilege 2300 LisectAVT_2403002B_27.exe
Token: SeDebugPrivilege 2752 WSCollect.exe

description	pid	process
Token: SeDebugPrivilege	2300	LisectAVT_2403002B_27.exe
Token: SeDebugPrivilege	2752	WSCollect.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

LisectAVT_2403002B_27.exeLisectAVT_2403002B_27.exeWSCollect.exe

description	pid	process	target process
PID 2260 wrote to memory of 2300	2260	LisectAVT_2403002B_27.exe	LisectAVT_2403002B_27.exe
PID 2260 wrote to memory of 2300	2260	LisectAVT_2403002B_27.exe	LisectAVT_2403002B_27.exe
PID 2260 wrote to memory of 2300	2260	LisectAVT_2403002B_27.exe	LisectAVT_2403002B_27.exe
PID 2260 wrote to memory of 2300	2260	LisectAVT_2403002B_27.exe	LisectAVT_2403002B_27.exe
PID 2260 wrote to memory of 2300	2260	LisectAVT_2403002B_27.exe	LisectAVT_2403002B_27.exe
PID 2260 wrote to memory of 2300	2260	LisectAVT_2403002B_27.exe	LisectAVT_2403002B_27.exe
PID 2260 wrote to memory of 2300	2260	LisectAVT_2403002B_27.exe	LisectAVT_2403002B_27.exe
PID 2260 wrote to memory of 2300	2260	LisectAVT_2403002B_27.exe	LisectAVT_2403002B_27.exe
PID 2260 wrote to memory of 2300	2260	LisectAVT_2403002B_27.exe	LisectAVT_2403002B_27.exe
PID 2300 wrote to memory of 2820	2300	LisectAVT_2403002B_27.exe	WSCollect.exe
PID 2300 wrote to memory of 2820	2300	LisectAVT_2403002B_27.exe	WSCollect.exe
PID 2300 wrote to memory of 2820	2300	LisectAVT_2403002B_27.exe	WSCollect.exe
PID 2300 wrote to memory of 2820	2300	LisectAVT_2403002B_27.exe	WSCollect.exe
PID 2820 wrote to memory of 2752	2820	WSCollect.exe	WSCollect.exe
PID 2820 wrote to memory of 2752	2820	WSCollect.exe	WSCollect.exe
PID 2820 wrote to memory of 2752	2820	WSCollect.exe	WSCollect.exe
PID 2820 wrote to memory of 2752	2820	WSCollect.exe	WSCollect.exe
PID 2820 wrote to memory of 2752	2820	WSCollect.exe	WSCollect.exe
PID 2820 wrote to memory of 2752	2820	WSCollect.exe	WSCollect.exe
PID 2820 wrote to memory of 2752	2820	WSCollect.exe	WSCollect.exe
PID 2820 wrote to memory of 2752	2820	WSCollect.exe	WSCollect.exe
PID 2820 wrote to memory of 2752	2820	WSCollect.exe	WSCollect.exe

C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002B_27.exe
"C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002B_27.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2260

C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002B_27.exe
"C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002B_27.exe"
2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2300

C:\Users\Admin\Documents\WSCollect.exe
"C:\Users\Admin\Documents\WSCollect.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2820

C:\Users\Admin\Documents\WSCollect.exe
"C:\Users\Admin\Documents\WSCollect.exe"
4⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\Documents\WSCollect.exe

Filesize
155KB

MD5
e769b63b22a914d5fe9722716257e3b6

SHA1
d69e65bcb3959724ccf02e6f1d2319163c2593f1

SHA256
1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c

SHA512
e901dfc8ede587b76997c5e98b576d12c5762176fc23501f404c195732a36d532b9fea97a79b68005150ca444d9cb1d8ecc5386698f3f4e8d6038d62bd773182

Download Submit
memory/2260-0-0x0000000074961000-0x0000000074962000-memory.dmp

Filesize
4KB

Download
memory/2260-12-0x0000000074960000-0x0000000074F0B000-memory.dmp

Filesize
5.7MB

Download
memory/2300-2-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2300-13-0x00000000743B1000-0x00000000743B2000-memory.dmp

Filesize
4KB

Download
memory/2300-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2300-4-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2300-3-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2300-9-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2300-1-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2300-7-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2300-14-0x00000000743B0000-0x000000007495B000-memory.dmp

Filesize
5.7MB

Download
memory/2300-15-0x00000000743B0000-0x000000007495B000-memory.dmp

Filesize
5.7MB

Download
memory/2300-11-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2300-38-0x00000000743B0000-0x000000007495B000-memory.dmp

Filesize
5.7MB

Download
memory/2752-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2820-37-0x00000000743B0000-0x000000007495B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads