revengerat | 749fb97b6beff8b404936b5b366ae19ad4611d28162538a8230c22a180ec1797

General

Target

fe7f65712ce141ff666b5013f137dbd6_JaffaCakes118.exe
Size

238KB
MD5

fe7f65712ce141ff666b5013f137dbd6
SHA1

02dcab6bebd422ff779587780a5b56dfa58c404d
SHA256

749fb97b6beff8b404936b5b366ae19ad4611d28162538a8230c22a180ec1797
SHA512

cc611b7d164718403828e1cff35c8256f9d9abe0d3978d65719bf024e9634d31e462cd38744972ffe2c004ca86414019a5da35fe2117b56b5beca0d1497c2f47
SSDEEP

3072:0T0C/NrtHBG04NeX4MLuL2Ip4woXzK1FhTmtZZFJH3Tv03oXBSwXNIwRsSlqPEv:GllBG04sJa20oW1FhTm5DkoX8O5v

Score

10^/10

revengerat guest discovery trojan

Malware Config

Extracted

Family

revengerat

Botnet

Guest

C2

lapoire2.hopto.org:333

Mutex

RV_MUTEX-DxjEexVoqqNL

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

Drops startup file 2 IoCs

Processes:

fe7f65712ce141ff666b5013f137dbd6_JaffaCakes118.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7bPAfP3n.url	fe7f65712ce141ff666b5013f137dbd6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7bPAfP3n.url	fe7f65712ce141ff666b5013f137dbd6_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

fe7f65712ce141ff666b5013f137dbd6_JaffaCakes118.exe

description	pid	process	target process
PID 4928 set thread context of 1416	4928	fe7f65712ce141ff666b5013f137dbd6_JaffaCakes118.exe	fe7f65712ce141ff666b5013f137dbd6_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

fe7f65712ce141ff666b5013f137dbd6_JaffaCakes118.exefe7f65712ce141ff666b5013f137dbd6_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fe7f65712ce141ff666b5013f137dbd6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fe7f65712ce141ff666b5013f137dbd6_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

fe7f65712ce141ff666b5013f137dbd6_JaffaCakes118.exe

pid process

4928 fe7f65712ce141ff666b5013f137dbd6_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

fe7f65712ce141ff666b5013f137dbd6_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 1416 fe7f65712ce141ff666b5013f137dbd6_JaffaCakes118.exe

pid	process
4928	fe7f65712ce141ff666b5013f137dbd6_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	1416	fe7f65712ce141ff666b5013f137dbd6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fe7f65712ce141ff666b5013f137dbd6_JaffaCakes118.exe

description	pid	process	target process
PID 4928 wrote to memory of 1416	4928	fe7f65712ce141ff666b5013f137dbd6_JaffaCakes118.exe	fe7f65712ce141ff666b5013f137dbd6_JaffaCakes118.exe
PID 4928 wrote to memory of 1416	4928	fe7f65712ce141ff666b5013f137dbd6_JaffaCakes118.exe	fe7f65712ce141ff666b5013f137dbd6_JaffaCakes118.exe
PID 4928 wrote to memory of 1416	4928	fe7f65712ce141ff666b5013f137dbd6_JaffaCakes118.exe	fe7f65712ce141ff666b5013f137dbd6_JaffaCakes118.exe
PID 4928 wrote to memory of 1416	4928	fe7f65712ce141ff666b5013f137dbd6_JaffaCakes118.exe	fe7f65712ce141ff666b5013f137dbd6_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fe7f65712ce141ff666b5013f137dbd6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fe7f65712ce141ff666b5013f137dbd6_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Users\Admin\AppData\Local\Temp\fe7f65712ce141ff666b5013f137dbd6_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\fe7f65712ce141ff666b5013f137dbd6_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fe7f65712ce141ff666b5013f137dbd6_JaffaCakes118.exe.log

Filesize
520B

MD5
3ca2f9e6a94c24c455ac9431a0bf479b

SHA1
a90309eec691588990609f8f8ad9b935d6f38eb2

SHA256
e84d0c64750ec6333b67eb8aef737bb21cd86c6ef6e520c6537ede13505e125e

SHA512
ba66e42b384f0d865a21d9169169a0b2bd9c62ebee68acc63a191b1a67ca16f4534f955055fc84bbc4a9cd22cec11c3c22a15df7741d99b7dec456e5cabcb0b5

Download Submit
memory/1416-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1416-20-0x0000000074A60000-0x0000000075210000-memory.dmp

Filesize
7.7MB

Download
memory/1416-19-0x0000000074A60000-0x0000000075210000-memory.dmp

Filesize
7.7MB

Download
memory/1416-18-0x0000000004EF0000-0x0000000004F56000-memory.dmp

Filesize
408KB

Download
memory/1416-17-0x0000000004E50000-0x0000000004EEC000-memory.dmp

Filesize
624KB

Download
memory/1416-16-0x0000000074A60000-0x0000000075210000-memory.dmp

Filesize
7.7MB

Download
memory/4928-4-0x0000000002860000-0x0000000002870000-memory.dmp

Filesize
64KB

Download
memory/4928-7-0x0000000074A60000-0x0000000075210000-memory.dmp

Filesize
7.7MB

Download
memory/4928-6-0x0000000074A6E000-0x0000000074A6F000-memory.dmp

Filesize
4KB

Download
memory/4928-15-0x0000000074A60000-0x0000000075210000-memory.dmp

Filesize
7.7MB

Download
memory/4928-5-0x0000000005440000-0x00000000059E4000-memory.dmp

Filesize
5.6MB

Download
memory/4928-14-0x0000000074A60000-0x0000000075210000-memory.dmp

Filesize
7.7MB

Download
memory/4928-0-0x0000000074A6E000-0x0000000074A6F000-memory.dmp

Filesize
4KB

Download
memory/4928-3-0x0000000004D30000-0x0000000004D4A000-memory.dmp

Filesize
104KB

Download
memory/4928-2-0x0000000074A60000-0x0000000075210000-memory.dmp

Filesize
7.7MB

Download
memory/4928-1-0x00000000003C0000-0x0000000000400000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads