revengerat | f63eaf89e94827f4331b6600e6fe09f6c03b8ede2b2862904a3d781678208583

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 19:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

97756562952f31b23af0411c0e0b4d1e_JaffaCakes118.exe
Size

511KB
MD5

97756562952f31b23af0411c0e0b4d1e
SHA1

ba15365f2a21419f34961addcad6dad3f7c00e10
SHA256

f63eaf89e94827f4331b6600e6fe09f6c03b8ede2b2862904a3d781678208583
SHA512

d441d0111d70d9140e12e2f3525781a9492d7ddffd59844573100cd8db9efbaaff008a41c674c675ff30fd0e2ccf43d136c48dfda97aed7c0d65f7563a174f90
SSDEEP

12288:QOsJVl3oAad39isf2iyTF2NWBfpC1cipfXWRA:tsl3oAabjuiUFnCyWWRA

Score

10^/10

revengerat discovery persistence spyware stealer trojan upx

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
[email protected]
Password:
niggernigger

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

Detected Nirsoft tools 6 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/1796-31-0x0000000000400000-0x0000000000418000-memory.dmp	Nirsoft
behavioral1/memory/708-39-0x0000000000400000-0x0000000000419000-memory.dmp	Nirsoft
behavioral1/memory/592-48-0x0000000000400000-0x0000000000425000-memory.dmp	Nirsoft
behavioral1/memory/708-57-0x0000000000400000-0x0000000000419000-memory.dmp	Nirsoft
behavioral1/memory/2128-58-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/2248-69-0x0000000000400000-0x000000000043D000-memory.dmp	Nirsoft

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral1/files/0x0008000000015db6-7.dat	revengerat

Executes dropped EXE 8 IoCs

pid	Process
2852	Out.exe
2752	s5KDr9b1EP.exe
2640	Wa37LxMy8k5X6Zfc.exe
1796	dialup.exe
708	passwordfox.exe
592	mspass.exe
2128	iepv.exe
2248	ChromePass.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0031000000015d98-27.dat	upx
behavioral1/memory/1796-28-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral1/memory/1796-31-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral1/files/0x0007000000015f55-38.dat	upx
behavioral1/memory/708-39-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/files/0x0007000000015fa3-45.dat	upx
behavioral1/memory/592-46-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral1/memory/592-48-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral1/files/0x0006000000018d87-53.dat	upx
behavioral1/memory/2128-55-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/708-57-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/2128-58-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/files/0x000600000001904f-64.dat	upx
behavioral1/memory/2248-69-0x0000000000400000-0x000000000043D000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Network = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Wa37LxMy8k5X6Zfc.exe"	Wa37LxMy8k5X6Zfc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dialup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	passwordfox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iepv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ChromePass.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe
2640	Wa37LxMy8k5X6Zfc.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2852	Out.exe
Token: 33	2852	Out.exe
Token: SeIncBasePriorityPrivilege	2852	Out.exe
Token: SeDebugPrivilege	592	mspass.exe
Token: SeDebugPrivilege	2128	iepv.exe
Token: SeRestorePrivilege	2128	iepv.exe
Token: SeBackupPrivilege	2128	iepv.exe
Token: SeDebugPrivilege	2640	Wa37LxMy8k5X6Zfc.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2852	2776	97756562952f31b23af0411c0e0b4d1e_JaffaCakes118.exe	30
PID 2776 wrote to memory of 2852	2776	97756562952f31b23af0411c0e0b4d1e_JaffaCakes118.exe	30
PID 2776 wrote to memory of 2852	2776	97756562952f31b23af0411c0e0b4d1e_JaffaCakes118.exe	30
PID 2852 wrote to memory of 2752	2852	Out.exe	31
PID 2852 wrote to memory of 2752	2852	Out.exe	31
PID 2852 wrote to memory of 2752	2852	Out.exe	31
PID 2852 wrote to memory of 2640	2852	Out.exe	32
PID 2852 wrote to memory of 2640	2852	Out.exe	32
PID 2852 wrote to memory of 2640	2852	Out.exe	32
PID 2640 wrote to memory of 1796	2640	Wa37LxMy8k5X6Zfc.exe	33
PID 2640 wrote to memory of 1796	2640	Wa37LxMy8k5X6Zfc.exe	33
PID 2640 wrote to memory of 1796	2640	Wa37LxMy8k5X6Zfc.exe	33
PID 2640 wrote to memory of 1796	2640	Wa37LxMy8k5X6Zfc.exe	33
PID 2640 wrote to memory of 708	2640	Wa37LxMy8k5X6Zfc.exe	34
PID 2640 wrote to memory of 708	2640	Wa37LxMy8k5X6Zfc.exe	34
PID 2640 wrote to memory of 708	2640	Wa37LxMy8k5X6Zfc.exe	34
PID 2640 wrote to memory of 708	2640	Wa37LxMy8k5X6Zfc.exe	34
PID 2640 wrote to memory of 592	2640	Wa37LxMy8k5X6Zfc.exe	35
PID 2640 wrote to memory of 592	2640	Wa37LxMy8k5X6Zfc.exe	35
PID 2640 wrote to memory of 592	2640	Wa37LxMy8k5X6Zfc.exe	35
PID 2640 wrote to memory of 592	2640	Wa37LxMy8k5X6Zfc.exe	35
PID 2640 wrote to memory of 2128	2640	Wa37LxMy8k5X6Zfc.exe	36
PID 2640 wrote to memory of 2128	2640	Wa37LxMy8k5X6Zfc.exe	36
PID 2640 wrote to memory of 2128	2640	Wa37LxMy8k5X6Zfc.exe	36
PID 2640 wrote to memory of 2128	2640	Wa37LxMy8k5X6Zfc.exe	36
PID 2640 wrote to memory of 2248	2640	Wa37LxMy8k5X6Zfc.exe	37
PID 2640 wrote to memory of 2248	2640	Wa37LxMy8k5X6Zfc.exe	37
PID 2640 wrote to memory of 2248	2640	Wa37LxMy8k5X6Zfc.exe	37
PID 2640 wrote to memory of 2248	2640	Wa37LxMy8k5X6Zfc.exe	37

C:\Users\Admin\AppData\Local\Temp\97756562952f31b23af0411c0e0b4d1e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\97756562952f31b23af0411c0e0b4d1e_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Users\Admin\AppData\Local\Temp\Out.exe
  "C:\Users\Admin\AppData\Local\Temp\Out.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Users\Admin\AppData\Local\Temp\s5KDr9b1EP.exe
    "C:\Users\Admin\AppData\Local\Temp\s5KDr9b1EP.exe"
    3⤵
    - Executes dropped EXE
    PID:2752
- - C:\Users\Admin\AppData\Local\Temp\Wa37LxMy8k5X6Zfc.exe
    "C:\Users\Admin\AppData\Local\Temp\Wa37LxMy8k5X6Zfc.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Users\Admin\AppData\Local\Temp\dialup.exe
      C:\Users\Admin\AppData\Local\Temp\dialup.exe /stext C:\Users\Admin\AppData\Local\Temp\data.txt
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1796
  - - C:\Users\Admin\AppData\Local\Temp\passwordfox.exe
      C:\Users\Admin\AppData\Local\Temp\passwordfox.exe /stext C:\Users\Admin\AppData\Local\Temp\firefox.txt
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:708
  - - C:\Users\Admin\AppData\Local\Temp\mspass.exe
      C:\Users\Admin\AppData\Local\Temp\mspass.exe /stext C:\Users\Admin\AppData\Local\Temp\mess.txt
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:592
  - - C:\Users\Admin\AppData\Local\Temp\iepv.exe
      C:\Users\Admin\AppData\Local\Temp\iepv.exe /stext C:\Users\Admin\AppData\Local\Temp\iepv.txt
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2128
  - - C:\Users\Admin\AppData\Local\Temp\ChromePass.exe
      C:\Users\Admin\AppData\Local\Temp\ChromePass.exe /stext C:\Users\Admin\AppData\Local\Temp\ChromePass.txt
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ChromePass.exe

Filesize
125KB

MD5
9b3b1c0db965166319469b2afa6c4f0c

SHA1
9f1e65a3056dff872949329c4e5e70c007cc5621

SHA256
dbfa10a7deeb6d1ac8fd95ffeb23b87adc58e6388e522812fabe7f710e3cdd89

SHA512
c11512599b83fa1875a67915a7e7454512ed8300a0a47c16692ebc1f526755c39c795fe9721dd97d417bfcb29f9e4c1f3283cf4c426af6571b3996005f7e4f5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Out.exe

Filesize
473KB

MD5
74debc29e5716377c454ebae376af5ec

SHA1
56fa9f1a4b6b724ea4a2001e637950acbc1cbb4d

SHA256
98e98f57130cf45d64da8f31e86ee1ccf880909504bff792f24b434ce7f3eedc

SHA512
ea551d2e4ae638ba79f68f372d6cd5a37b92355e706a4aae19f9bf0b4a8c49a848540e4b73ecc82c5bc510623e5031482e8418648deb90f9cd50b586c8e1250f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Wa37LxMy8k5X6Zfc.exe

Filesize
328KB

MD5
b7b6c365a669acf719f65fac7f513952

SHA1
3ce8cecbff517f3beee0f3c76262bcdddfc01936

SHA256
2732cee0c0e429bfbe42ab459f4c201ada20e28a02d46e704631bf52ffbc5015

SHA512
b6c72ecdd9066e4e0805cfce49dee50576ed900336f48ef77cf9b0d6848d3d98fbcf8361ed3579f5b28fecf50f93dd76acb5a75ba5a36677bdd2381da36571bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\data.txt

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\dialup.exe

Filesize
37KB

MD5
9c8872c879d0a9d82988920488370864

SHA1
87ff4231547462e6474c832e28831dd691d83fd4

SHA256
8f576d5191721f8fdb47bb22950f43fc8f2c9cc880fe067090ed96e6fcb07a97

SHA512
3c413427c46ef92a412840479896841ffd5c6eb9215b8ecc416cdbd4f8e0f2eb643ed3b7f2e18eb5710ba7c55e1cd82af6637285ee364e069503c5ecc187cb2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\iepv.exe

Filesize
42KB

MD5
28c110b8d0ad095131c8d06043678086

SHA1
c684cf321e890e0e766a97609a4cde866156d6c5

SHA256
dbc2216d5f31f5218e940e3d802998dee90eeb69af69cbeb063c69c6a5a3f1e1

SHA512
065e043b76b0e1163e73f4a1c257bae793ae9b46bff1951956c2174ef91deb2528730da77aab76b9e7246d705c3b8c1d23f05dc3b161cacabf3e52d0f563c922

Download Submit
C:\Users\Admin\AppData\Local\Temp\mspass.exe

Filesize
63KB

MD5
fbb93d4c91453b06414d6973152d904e

SHA1
4624232c5450e7e9e7ba1f2113a07f8800dc5b5f

SHA256
8898b138a3f238fa985992a9d0e48f6b5865dd2cc35e08b83fa326260c510ffe

SHA512
4ed926d230af576a945bdd4d9b2d4001e8036abbcf1ef9a35669823d9420b6d95b426d80384a6fd022165c1fc2485fda0e28193b99b301927236928ddfcac6f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\passwordfox.exe

Filesize
37KB

MD5
a1d6a37917dcf4471486bc5a0e725cc6

SHA1
5b09f10dc215078ae44f535de12630c38f3b86e3

SHA256
8a06acd1158060a54d67098f07c1ff7895f799bc5834179b8aae04d28fb60e17

SHA512
5798a5d85052d5c2f6b781b91a400c85bc96c0127cc4e18079bff1f17bd302dc07c0f015ddf1105621a841680057322eb0172ba06063f55d795b7b079f1d26d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\s5KDr9b1EP.exe

Filesize
20KB

MD5
03e7f42263fdc606da33e0765f3a661f

SHA1
3fd94e3ff735c7f57c0ba71ecfbd3f0da7984f13

SHA256
8d2179a86937d658c0e806b4d49912802f4caa45b5455ae9e71858abb9153059

SHA512
0c4a3ed0798f274e069b66c23c6f78e14ccc9413b44ce880713bcc4fa4f0e5a5be3d892492919b17c042af3e3d32c1a380c35a7f55f15662a747e4200017f1b4

Download Submit
memory/592-48-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/592-46-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/708-57-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/708-39-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1796-31-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1796-28-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2128-55-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2128-58-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2248-69-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2776-3-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

Filesize
9.6MB

Download
memory/2776-9-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

Filesize
9.6MB

Download
memory/2776-0-0x000007FEF55BE000-0x000007FEF55BF000-memory.dmp

Filesize
4KB

Download
memory/2776-2-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

Filesize
9.6MB

Download
memory/2776-1-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

Filesize
9.6MB

Download
memory/2852-23-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

Filesize
9.6MB

Download
memory/2852-14-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

Filesize
9.6MB

Download
memory/2852-10-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

Filesize
9.6MB

Download
memory/2852-13-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

Filesize
9.6MB

Download