revengerat | 7b860ae6851ace6b7f107bf685e82e71d283627837223a8746f59ece8eeedcf0

General

Target

f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe
Size

1.4MB
MD5

f976198585759fa3eafbd852ac1bdd83
SHA1

12381c5842a035c22d4f401e80ca85c8b8200542
SHA256

7b860ae6851ace6b7f107bf685e82e71d283627837223a8746f59ece8eeedcf0
SHA512

6328e2dfb8419442be74a1de781f02d355773e8c43056e9bdc94c51e759db008f9785557f035c91d99abca74dc2f55b2dce19aaa7f6c6aa0653a8cdaa9966f4b
SSDEEP

24576:yq5TfcdHj4fmbk2q4EzKJ9Ttr60lYYtWY2YPGO0zQJ9TtFaLnUMvkYtWYnYPqW:yUTsam4x+5IYtWY2YPJ5DYtWYnYP

Score

10^/10

revengerat discovery stealer trojan upx

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 1 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/files/0x0008000000019023-4.dat	revengerat

Executes dropped EXE 1 IoCs

Processes:

dmr_72.exe

pid	Process
2992	dmr_72.exe

Loads dropped DLL 4 IoCs

Processes:

f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe

pid	Process
1288	f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe
1288	f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe
1288	f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe
1288	f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/1288-24-0x0000000000AF0000-0x0000000000DF8000-memory.dmp	autoit_exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1288-0-0x0000000000AF0000-0x0000000000DF8000-memory.dmp	upx
behavioral1/memory/1288-24-0x0000000000AF0000-0x0000000000DF8000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exedmr_72.exe

pid	Process
1288	f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe
2992	dmr_72.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe

pid	Process
1288	f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

dmr_72.exe

description	pid	Process
Token: SeDebugPrivilege	2992	dmr_72.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe

pid	Process
1288	f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe
1288	f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe
1288	f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe

pid	Process
1288	f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe
1288	f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe
1288	f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

dmr_72.exe

pid	Process
2992	dmr_72.exe
2992	dmr_72.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe

description	pid	Process	procid_target
PID 1288 wrote to memory of 2992	1288	f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe	30
PID 1288 wrote to memory of 2992	1288	f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe	30
PID 1288 wrote to memory of 2992	1288	f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe	30
PID 1288 wrote to memory of 2992	1288	f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe
  "C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe" -install -54471874 -chipde -882a80fe8aeb4a958af3d6708aa9e063 - -BLUB2 -xxcrekwnknzmzaus -1288
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DMR\xxcrekwnknzmzaus.dat

Filesize
149B

MD5
5799a33a03b85823d685ad3293d76a0d

SHA1
2070680468d3f6b472afd66b1de605e0d4183256

SHA256
2ae9783be70c1207da82bf26947d2267317fa021ae93d0360eb4acc215c60408

SHA512
53c77a4dc0d15ea11b02a3c18d59250f63e396dbf24058ca02d39ede97a00a77d463796ee07d2f4702165dd5709e95ff901cefd573c16971930e0541df38c14e

Download Submit
\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe

Filesize
519KB

MD5
cca0a31a96b965f3e121599df138afe0

SHA1
06e33278d473995ebb843a1fc99e964929dd9ad4

SHA256
e8c94324346a70c2ae8d2320816bbc579578b443af0f80abba75865892f15974

SHA512
74e549f3d19660205a104f62e166ec68261ed8adebf1aa8c27f285f22802c999064262bf77dbdbc548af1720b867bd3dfcee6a81a986d48d46022d4e339fb829

Download Submit
memory/1288-0-0x0000000000AF0000-0x0000000000DF8000-memory.dmp

Filesize
3.0MB

Download
memory/1288-24-0x0000000000AF0000-0x0000000000DF8000-memory.dmp

Filesize
3.0MB

Download
memory/2992-16-0x000007FEF5023000-0x000007FEF5024000-memory.dmp

Filesize
4KB

Download
memory/2992-17-0x0000000000B10000-0x0000000000B98000-memory.dmp

Filesize
544KB

Download
memory/2992-19-0x000007FEF5020000-0x000007FEF5A0C000-memory.dmp

Filesize
9.9MB

Download
memory/2992-20-0x000007FEF5020000-0x000007FEF5A0C000-memory.dmp

Filesize
9.9MB

Download
memory/2992-21-0x000007FEF5020000-0x000007FEF5A0C000-memory.dmp

Filesize
9.9MB

Download
memory/2992-23-0x000007FEF5020000-0x000007FEF5A0C000-memory.dmp

Filesize
9.9MB

Download
memory/2992-22-0x000007FEF5020000-0x000007FEF5A0C000-memory.dmp

Filesize
9.9MB

Download
memory/2992-25-0x000007FEF5020000-0x000007FEF5A0C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads