revengerat | af813a303e700b27c7ba44acc90ec98b650c9a0bc0d471fd337f5271c81a7458

General

Target

0b18382d5ac0f30d8773acb6d5671a74_JaffaCakes118.exe
Size

728KB
MD5

0b18382d5ac0f30d8773acb6d5671a74
SHA1

f4ccfc6cc940aeb2a30489458f781a6c5d78fdd8
SHA256

af813a303e700b27c7ba44acc90ec98b650c9a0bc0d471fd337f5271c81a7458
SHA512

e089a7b956b692f02dbebfde28a90e2cc8ca6d6743d7587d3b21a556dfc816bd0e40215e180a026dd02ec76a7945b1f70cc4d6f6743f66bf247a52207dea73fd
SSDEEP

12288:8lGRF0NXm4Vtjfx8G8PpJLj8KbqOQjg3uxf9LbNgoGwWbvh8ByS9NULj7OT6G:8oRF0c43r78PbLYKKg3uxfZNgjvVWmL4

Score

10^/10

revengerat discovery persistence spyware stealer trojan upx

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
[email protected]
Password:
ownage12

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral2/memory/3256-7-0x000000001C9F0000-0x000000001CAB2000-memory.dmp	revengerat

ACProtect 1.3x - 1.4x DLL software 7 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000200000001e490-37.dat	acprotect
behavioral2/memory/4620-50-0x0000000060220000-0x0000000060229000-memory.dmp	acprotect
behavioral2/files/0x000700000002348c-46.dat	acprotect
behavioral2/files/0x000700000002348a-45.dat	acprotect
behavioral2/files/0x0007000000023489-42.dat	acprotect
behavioral2/memory/4620-60-0x0000000060220000-0x0000000060229000-memory.dmp	acprotect
behavioral2/files/0x0007000000023486-41.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
4620	FirePassword.exe

Loads dropped DLL 5 IoCs

pid	Process
4620	FirePassword.exe
4620	FirePassword.exe
4620	FirePassword.exe
4620	FirePassword.exe
4620	FirePassword.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0b18382d5ac0f30d8773acb6d5671a74_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	0b18382d5ac0f30d8773acb6d5671a74_JaffaCakes118.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	0b18382d5ac0f30d8773acb6d5671a74_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	0b18382d5ac0f30d8773acb6d5671a74_JaffaCakes118.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000023482-34.dat	upx
behavioral2/memory/4620-35-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral2/files/0x000200000001e490-37.dat	upx
behavioral2/memory/4620-47-0x0000000060170000-0x00000000601D7000-memory.dmp	upx
behavioral2/memory/4620-51-0x0000000060260000-0x00000000602BF000-memory.dmp	upx
behavioral2/memory/4620-50-0x0000000060220000-0x0000000060229000-memory.dmp	upx
behavioral2/memory/4620-49-0x0000000060210000-0x000000006021A000-memory.dmp	upx
behavioral2/memory/4620-48-0x0000000060140000-0x000000006016D000-memory.dmp	upx
behavioral2/files/0x000700000002348c-46.dat	upx
behavioral2/files/0x000700000002348a-45.dat	upx
behavioral2/files/0x0007000000023489-42.dat	upx
behavioral2/memory/4620-57-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral2/memory/4620-61-0x0000000060260000-0x00000000602BF000-memory.dmp	upx
behavioral2/memory/4620-60-0x0000000060220000-0x0000000060229000-memory.dmp	upx
behavioral2/memory/4620-59-0x0000000060210000-0x000000006021A000-memory.dmp	upx
behavioral2/memory/4620-58-0x0000000060140000-0x000000006016D000-memory.dmp	upx
behavioral2/files/0x0007000000023486-41.dat	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	0b18382d5ac0f30d8773acb6d5671a74_JaffaCakes118.exe
File created	C:\Windows\assembly\Desktop.ini	0b18382d5ac0f30d8773acb6d5671a74_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	0b18382d5ac0f30d8773acb6d5671a74_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FirePassword.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3256	0b18382d5ac0f30d8773acb6d5671a74_JaffaCakes118.exe
3256	0b18382d5ac0f30d8773acb6d5671a74_JaffaCakes118.exe
3256	0b18382d5ac0f30d8773acb6d5671a74_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3256	0b18382d5ac0f30d8773acb6d5671a74_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3256	0b18382d5ac0f30d8773acb6d5671a74_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 588	3256	0b18382d5ac0f30d8773acb6d5671a74_JaffaCakes118.exe	89
PID 3256 wrote to memory of 588	3256	0b18382d5ac0f30d8773acb6d5671a74_JaffaCakes118.exe	89
PID 3256 wrote to memory of 2504	3256	0b18382d5ac0f30d8773acb6d5671a74_JaffaCakes118.exe	90
PID 3256 wrote to memory of 2504	3256	0b18382d5ac0f30d8773acb6d5671a74_JaffaCakes118.exe	90
PID 2504 wrote to memory of 4620	2504	cmd.exe	93
PID 2504 wrote to memory of 4620	2504	cmd.exe	93
PID 2504 wrote to memory of 4620	2504	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\0b18382d5ac0f30d8773acb6d5671a74_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b18382d5ac0f30d8773acb6d5671a74_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Windows\SYSTEM32\cmd.exe
  cmd /C cd C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  PID:588
- C:\Windows\SYSTEM32\cmd.exe
  cmd /C C:\Users\Admin\AppData\Roaming\Microsoft\FirePassword.exe >C:\Users\Admin\AppData\Roaming\Microsoft\Error.txt
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Users\Admin\AppData\Roaming\Microsoft\FirePassword.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\FirePassword.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Error.txt

Filesize
283B

MD5
1d870fe37141ae58bc38bc6794374781

SHA1
8b20b3096f36fe4d343fc770c5f29a7983760d48

SHA256
c51d09b0f2fe56f42ea2a852e6de4d8a45e5dbaa610c4caabb30c9c0ec3f8360

SHA512
575b36d30e80c75fe3bb97ba057260f283286f88f5e6b008b806402acf6d94d081ddae3414c531522d2bca51327732f83596fbaf1550d827574a8b4496b03e79

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\FirePassword.exe

Filesize
200KB

MD5
dab03dc446a8d2b809ce7aade0fab8b4

SHA1
3c6c19c9c6612653aab2cce45a6507547142fab1

SHA256
2c19dd25af9acc7ae31881c28108acb64a6b544622b97aebb0e55af783402e00

SHA512
52ae8830e522b5314820edaca9cddc2cddb2e477874a7207bc4f65a8d22d94a3d5909000c113cb417db3d6c00e8f86306a518ff168f815e9029959977b833dc4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\nspr4.dll

Filesize
72KB

MD5
72414dfb0b112c664d2c8d1215674e09

SHA1
50a1e61309741e92fe3931d8eb606f8ada582c0a

SHA256
69e73fea2210adc2ae0837ac98b46980a09fe91c07f181a28fda195e2b9e6b71

SHA512
41428624573b4a191b33657ed9ad760b500c5640f3d62b758869a17857edc68f90bc10d7a5e720029519c0d49b5ca0fa8579743e80b200ef331e41efde1dc8c9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\nss3.dll

Filesize
172KB

MD5
7ddbd64d87c94fd0b5914688093dd5c2

SHA1
d49d1f79efae8a5f58e6f713e43360117589efeb

SHA256
769703fb1ba6c95fb6c889e8a9baaea309e62d0f3ca444d01cc6b495c0f722d1

SHA512
60eaad58c3c4894f1673723eb28ddb42b681ff7aafe7a29ff8bf87a2da6595c16d1f8449096accdb89bd6cda6454eb90470e71dde7c5bd16abd0f80e115cfa2d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\plc4.dll

Filesize
8KB

MD5
c73ec58b42e66443fafc03f3a84dcef9

SHA1
5e91f467fe853da2c437f887162bccc6fd9d9dbe

SHA256
2dc0171b83c406db6ec9389b438828246b282862d2b8bdf2f5b75aec932a69f7

SHA512
6318e831d8f38525e2e49b5a1661440cd8b1f3d2afc6813bb862c21d88d213c4675a8ec2a413b14fbdca896c63b65a7da6ec9595893b352ade8979e7e86a7fcf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\plds4.dll

Filesize
6KB

MD5
ee44d5d780521816c906568a8798ed2f

SHA1
2da1b06d5de378cbfc7f2614a0f280f59f2b1224

SHA256
50b2735318233d6c87b6efccccc23a0e3216d2870c67f2f193cc1c83c7c879fc

SHA512
634a1cd2baaef29b4fe7c7583c04406bb2ea3a3c93294b31f621652844541e7c549da1a31619f657207327604c261976e15845571ee1efe5416f1b021d361da8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\softokn3.dll

Filesize
155KB

MD5
e846285b19405b11c8f19c1ed0a57292

SHA1
2c20cf37394be48770cd6d396878a3ca70066fd0

SHA256
251f0094b6b6537df3d3ce7c2663726616f06cfb9b6de90efabd67de2179a477

SHA512
b622ff07ae2f77e886a93987a9a922e80032e9041ed41503f0e38abb8c344eb922d154ade29e52454d0a1ad31596c4085f4bd942e4412af9f0698183acd75db7

Download Submit
memory/3256-25-0x00007FFC3A5B0000-0x00007FFC3AF51000-memory.dmp

Filesize
9.6MB

Download
memory/3256-32-0x00007FFC3A5B0000-0x00007FFC3AF51000-memory.dmp

Filesize
9.6MB

Download
memory/3256-11-0x000000001CFC0000-0x000000001D00C000-memory.dmp

Filesize
304KB

Download
memory/3256-12-0x00007FFC3A5B0000-0x00007FFC3AF51000-memory.dmp

Filesize
9.6MB

Download
memory/3256-13-0x00007FFC3A5B0000-0x00007FFC3AF51000-memory.dmp

Filesize
9.6MB

Download
memory/3256-14-0x000000001F570000-0x000000001F5D2000-memory.dmp

Filesize
392KB

Download
memory/3256-15-0x00007FFC3A5B0000-0x00007FFC3AF51000-memory.dmp

Filesize
9.6MB

Download
memory/3256-16-0x00007FFC3A5B0000-0x00007FFC3AF51000-memory.dmp

Filesize
9.6MB

Download
memory/3256-17-0x000000001D360000-0x000000001D379000-memory.dmp

Filesize
100KB

Download
memory/3256-18-0x00007FFC3A5B0000-0x00007FFC3AF51000-memory.dmp

Filesize
9.6MB

Download
memory/3256-19-0x00007FFC3A865000-0x00007FFC3A866000-memory.dmp

Filesize
4KB

Download
memory/3256-20-0x00007FFC3A5B0000-0x00007FFC3AF51000-memory.dmp

Filesize
9.6MB

Download
memory/3256-22-0x00007FFC3A5B0000-0x00007FFC3AF51000-memory.dmp

Filesize
9.6MB

Download
memory/3256-0-0x00007FFC3A865000-0x00007FFC3A866000-memory.dmp

Filesize
4KB

Download
memory/3256-27-0x00007FFC3A5B0000-0x00007FFC3AF51000-memory.dmp

Filesize
9.6MB

Download
memory/3256-29-0x00007FFC3A5B0000-0x00007FFC3AF51000-memory.dmp

Filesize
9.6MB

Download
memory/3256-31-0x00007FFC3A5B0000-0x00007FFC3AF51000-memory.dmp

Filesize
9.6MB

Download
memory/3256-10-0x00000000017A0000-0x00000000017A8000-memory.dmp

Filesize
32KB

Download
memory/3256-9-0x000000001CD10000-0x000000001CDAC000-memory.dmp

Filesize
624KB

Download
memory/3256-1-0x00007FFC3A5B0000-0x00007FFC3AF51000-memory.dmp

Filesize
9.6MB

Download
memory/3256-7-0x000000001C9F0000-0x000000001CAB2000-memory.dmp

Filesize
776KB

Download
memory/3256-3-0x000000001C370000-0x000000001C83E000-memory.dmp

Filesize
4.8MB

Download
memory/3256-2-0x00007FFC3A5B0000-0x00007FFC3AF51000-memory.dmp

Filesize
9.6MB

Download
memory/3256-4-0x00000000019B0000-0x00000000019C4000-memory.dmp

Filesize
80KB

Download
memory/3256-8-0x000000001CB60000-0x000000001CC06000-memory.dmp

Filesize
664KB

Download
memory/4620-48-0x0000000060140000-0x000000006016D000-memory.dmp

Filesize
180KB

Download
memory/4620-49-0x0000000060210000-0x000000006021A000-memory.dmp

Filesize
40KB

Download
memory/4620-50-0x0000000060220000-0x0000000060229000-memory.dmp

Filesize
36KB

Download
memory/4620-51-0x0000000060260000-0x00000000602BF000-memory.dmp

Filesize
380KB

Download
memory/4620-57-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/4620-61-0x0000000060260000-0x00000000602BF000-memory.dmp

Filesize
380KB

Download
memory/4620-60-0x0000000060220000-0x0000000060229000-memory.dmp

Filesize
36KB

Download
memory/4620-59-0x0000000060210000-0x000000006021A000-memory.dmp

Filesize
40KB

Download
memory/4620-58-0x0000000060140000-0x000000006016D000-memory.dmp

Filesize
180KB

Download
memory/4620-47-0x0000000060170000-0x00000000601D7000-memory.dmp

Filesize
412KB

Download
memory/4620-35-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads