revengerat | 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c

General

Target

1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe
Size

155KB
MD5

e769b63b22a914d5fe9722716257e3b6
SHA1

d69e65bcb3959724ccf02e6f1d2319163c2593f1
SHA256

1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c
SHA512

e901dfc8ede587b76997c5e98b576d12c5762176fc23501f404c195732a36d532b9fea97a79b68005150ca444d9cb1d8ecc5386698f3f4e8d6038d62bd773182
SSDEEP

1536:DwVCOKVP+JC+ZzmSd1vpCaTjjbDOcAT5D8V0HOQb89NmnJAO1yqrg0Yz:DLP2rP5ppJAT5YVCA9NmnJAO1yq0r

Score

10^/10

revengerat mayo24 discovery trojan

Malware Config

Extracted

Family

revengerat

Botnet

MAYO24

C2

karmina113.sytes.net:3333

karmina117.sytes.net:3333

karmina118.sytes.net:3333

karmina119.sytes.net:3333

nibiru3.duckdns.org:3333

nibiru4.duckdns.org:3333

nibiru5.duckdns.org:3333

nibiru6.duckdns.org:3333

Mutex

WSCollect

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

Drops startup file 2 IoCs

Processes:

WSCollect.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WSCollect.exe	WSCollect.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WSCollect.exe	WSCollect.exe

Executes dropped EXE 2 IoCs

Processes:

WSCollect.exeWSCollect.exe

pid process

2948 WSCollect.exe
884 WSCollect.exe
Loads dropped DLL 2 IoCs

Processes:

1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exeWSCollect.exe

pid process

832 1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe
2948 WSCollect.exe

pid	process
2948	WSCollect.exe
884	WSCollect.exe

pid	process
832	1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe
2948	WSCollect.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exeWSCollect.exe

description	pid	process	target process
PID 448 set thread context of 832	448	1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe	1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe
PID 2948 set thread context of 884	2948	WSCollect.exe	WSCollect.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

WSCollect.exe1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exeWSCollect.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WSCollect.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WSCollect.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exeWSCollect.exe

description	pid	process
Token: SeDebugPrivilege	832	1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe
Token: SeDebugPrivilege	884	WSCollect.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exeWSCollect.exe

description	pid	process	target process
PID 448 wrote to memory of 832	448	1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe	1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe
PID 448 wrote to memory of 832	448	1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe	1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe
PID 448 wrote to memory of 832	448	1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe	1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe
PID 448 wrote to memory of 832	448	1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe	1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe
PID 448 wrote to memory of 832	448	1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe	1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe
PID 448 wrote to memory of 832	448	1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe	1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe
PID 448 wrote to memory of 832	448	1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe	1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe
PID 448 wrote to memory of 832	448	1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe	1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe
PID 448 wrote to memory of 832	448	1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe	1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe
PID 832 wrote to memory of 2948	832	1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe	WSCollect.exe
PID 832 wrote to memory of 2948	832	1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe	WSCollect.exe
PID 832 wrote to memory of 2948	832	1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe	WSCollect.exe
PID 832 wrote to memory of 2948	832	1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe	WSCollect.exe
PID 2948 wrote to memory of 884	2948	WSCollect.exe	WSCollect.exe
PID 2948 wrote to memory of 884	2948	WSCollect.exe	WSCollect.exe
PID 2948 wrote to memory of 884	2948	WSCollect.exe	WSCollect.exe
PID 2948 wrote to memory of 884	2948	WSCollect.exe	WSCollect.exe
PID 2948 wrote to memory of 884	2948	WSCollect.exe	WSCollect.exe
PID 2948 wrote to memory of 884	2948	WSCollect.exe	WSCollect.exe
PID 2948 wrote to memory of 884	2948	WSCollect.exe	WSCollect.exe
PID 2948 wrote to memory of 884	2948	WSCollect.exe	WSCollect.exe
PID 2948 wrote to memory of 884	2948	WSCollect.exe	WSCollect.exe

C:\Users\Admin\AppData\Local\Temp\1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe
"C:\Users\Admin\AppData\Local\Temp\1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:448

C:\Users\Admin\AppData\Local\Temp\1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe
"C:\Users\Admin\AppData\Local\Temp\1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c.exe"
2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:832

C:\Users\Admin\Documents\WSCollect.exe
"C:\Users\Admin\Documents\WSCollect.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2948

C:\Users\Admin\Documents\WSCollect.exe
"C:\Users\Admin\Documents\WSCollect.exe"
4⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\WSCollect.exe

Filesize
155KB

MD5
e769b63b22a914d5fe9722716257e3b6

SHA1
d69e65bcb3959724ccf02e6f1d2319163c2593f1

SHA256
1e76f1954d14aff43291a7079962d0ad3856657537a9595ba190d5c61abfc93c

SHA512
e901dfc8ede587b76997c5e98b576d12c5762176fc23501f404c195732a36d532b9fea97a79b68005150ca444d9cb1d8ecc5386698f3f4e8d6038d62bd773182

Download Submit
memory/448-0-0x0000000074951000-0x0000000074952000-memory.dmp

Filesize
4KB

Download
memory/448-1-0x0000000074950000-0x0000000074EFB000-memory.dmp

Filesize
5.7MB

Download
memory/448-21-0x0000000074950000-0x0000000074EFB000-memory.dmp

Filesize
5.7MB

Download
memory/832-12-0x0000000000080000-0x0000000000098000-memory.dmp

Filesize
96KB

Download
memory/832-23-0x0000000074950000-0x0000000074EFB000-memory.dmp

Filesize
5.7MB

Download
memory/832-4-0x0000000000080000-0x0000000000098000-memory.dmp

Filesize
96KB

Download
memory/832-20-0x0000000000080000-0x0000000000098000-memory.dmp

Filesize
96KB

Download
memory/832-17-0x0000000000080000-0x0000000000098000-memory.dmp

Filesize
96KB

Download
memory/832-13-0x0000000000080000-0x0000000000098000-memory.dmp

Filesize
96KB

Download
memory/832-8-0x0000000000080000-0x0000000000098000-memory.dmp

Filesize
96KB

Download
memory/832-22-0x0000000074950000-0x0000000074EFB000-memory.dmp

Filesize
5.7MB

Download
memory/832-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/832-6-0x0000000000080000-0x0000000000098000-memory.dmp

Filesize
96KB

Download
memory/832-2-0x0000000000080000-0x0000000000098000-memory.dmp

Filesize
96KB

Download
memory/832-31-0x0000000074950000-0x0000000074EFB000-memory.dmp

Filesize
5.7MB

Download
memory/884-47-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/884-46-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/884-42-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2948-32-0x0000000074950000-0x0000000074EFB000-memory.dmp

Filesize
5.7MB

Download
memory/2948-45-0x0000000074950000-0x0000000074EFB000-memory.dmp

Filesize
5.7MB

Download
memory/2948-48-0x0000000074950000-0x0000000074EFB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads