revengerat | 7b860ae6851ace6b7f107bf685e82e71d283627837223a8746f59ece8eeedcf0

General

Target

f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe
Size

1.4MB
MD5

f976198585759fa3eafbd852ac1bdd83
SHA1

12381c5842a035c22d4f401e80ca85c8b8200542
SHA256

7b860ae6851ace6b7f107bf685e82e71d283627837223a8746f59ece8eeedcf0
SHA512

6328e2dfb8419442be74a1de781f02d355773e8c43056e9bdc94c51e759db008f9785557f035c91d99abca74dc2f55b2dce19aaa7f6c6aa0653a8cdaa9966f4b
SSDEEP

24576:yq5TfcdHj4fmbk2q4EzKJ9Ttr60lYYtWY2YPGO0zQJ9TtFaLnUMvkYtWYnYPqW:yUTsam4x+5IYtWY2YPJ5DYtWYnYP

Score

10^/10

revengerat discovery stealer trojan upx

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 1 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/files/0x000800000002345c-6.dat	revengerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

Processes:

dmr_72.exe

pid	Process
4068	dmr_72.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/memory/2388-19-0x0000000000F80000-0x0000000001288000-memory.dmp	autoit_exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2388-0-0x0000000000F80000-0x0000000001288000-memory.dmp	upx
behavioral2/memory/2388-19-0x0000000000F80000-0x0000000001288000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exedmr_72.exe

pid	Process
2388	f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe
2388	f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe
4068	dmr_72.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe

pid	Process
2388	f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

dmr_72.exe

description	pid	Process
Token: SeDebugPrivilege	4068	dmr_72.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe

pid	Process
2388	f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe
2388	f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe
2388	f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe

pid	Process
2388	f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe
2388	f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe
2388	f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

dmr_72.exe

pid	Process
4068	dmr_72.exe
4068	dmr_72.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe

description	pid	Process	procid_target
PID 2388 wrote to memory of 4068	2388	f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe	82
PID 2388 wrote to memory of 4068	2388	f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f976198585759fa3eafbd852ac1bdd83_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe
  "C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe" -install -54471874 -chipde -882a80fe8aeb4a958af3d6708aa9e063 - -BLUB2 -armzokreycesrpqg -2388
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DMR\armzokreycesrpqg.dat

Filesize
149B

MD5
5799a33a03b85823d685ad3293d76a0d

SHA1
2070680468d3f6b472afd66b1de605e0d4183256

SHA256
2ae9783be70c1207da82bf26947d2267317fa021ae93d0360eb4acc215c60408

SHA512
53c77a4dc0d15ea11b02a3c18d59250f63e396dbf24058ca02d39ede97a00a77d463796ee07d2f4702165dd5709e95ff901cefd573c16971930e0541df38c14e

Download Submit
C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe

Filesize
519KB

MD5
cca0a31a96b965f3e121599df138afe0

SHA1
06e33278d473995ebb843a1fc99e964929dd9ad4

SHA256
e8c94324346a70c2ae8d2320816bbc579578b443af0f80abba75865892f15974

SHA512
74e549f3d19660205a104f62e166ec68261ed8adebf1aa8c27f285f22802c999064262bf77dbdbc548af1720b867bd3dfcee6a81a986d48d46022d4e339fb829

Download Submit
memory/2388-0-0x0000000000F80000-0x0000000001288000-memory.dmp

Filesize
3.0MB

Download
memory/2388-19-0x0000000000F80000-0x0000000001288000-memory.dmp

Filesize
3.0MB

Download
memory/4068-13-0x00007FFF447A3000-0x00007FFF447A5000-memory.dmp

Filesize
8KB

Download
memory/4068-14-0x0000000000B50000-0x0000000000BD8000-memory.dmp

Filesize
544KB

Download
memory/4068-16-0x00007FFF447A0000-0x00007FFF45261000-memory.dmp

Filesize
10.8MB

Download
memory/4068-17-0x00007FFF447A0000-0x00007FFF45261000-memory.dmp

Filesize
10.8MB

Download
memory/4068-18-0x00007FFF447A0000-0x00007FFF45261000-memory.dmp

Filesize
10.8MB

Download
memory/4068-21-0x000000001DF30000-0x000000001E687000-memory.dmp

Filesize
7.3MB

Download
memory/4068-22-0x00007FFF447A0000-0x00007FFF45261000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads