revengerat | 09605dc7fa490c072cac25d2d269ab07c58e099870657c9fbefcb7d3b8cb233d

General

Target

09605dc7fa490c072cac25d2d269ab07c58e099870657c9fbefcb7d3b8cb233dN.exe
Size

1.4MB
MD5

6eef1dc5a1688c72aa00481401d307b0
SHA1

3cd9b23fcbc55090698b358ed730f7ce15f58db9
SHA256

09605dc7fa490c072cac25d2d269ab07c58e099870657c9fbefcb7d3b8cb233d
SHA512

89aabe324f60bd659478d710873587c2678bdd3b9d77f572ad8a3d019d03a45bf9bec5ab3dab1563e7b0f5da50a2c19c8fc83b166594671c5bb9ad4fc85791ce
SSDEEP

24576:Wq5TfcdHj4fmbqOw2qBS0smVkVMyvLlnhWEzKJ9TtLvgl/piakl3Jro0zQJ9TtDs:WUTsamVwxolC53akl325A

Score

10^/10

revengerat discovery stealer trojan upx

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Revengerat family
revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral1/files/0x0008000000015fba-4.dat	revengerat

Executes dropped EXE 1 IoCs

pid	Process
3024	dmr_72.exe

Loads dropped DLL 4 IoCs

pid	Process
2508	09605dc7fa490c072cac25d2d269ab07c58e099870657c9fbefcb7d3b8cb233dN.exe
2508	09605dc7fa490c072cac25d2d269ab07c58e099870657c9fbefcb7d3b8cb233dN.exe
2508	09605dc7fa490c072cac25d2d269ab07c58e099870657c9fbefcb7d3b8cb233dN.exe
2508	09605dc7fa490c072cac25d2d269ab07c58e099870657c9fbefcb7d3b8cb233dN.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2508-25-0x0000000000AB0000-0x0000000000DA9000-memory.dmp	autoit_exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2508-0-0x0000000000AB0000-0x0000000000DA9000-memory.dmp	upx
behavioral1/memory/2508-25-0x0000000000AB0000-0x0000000000DA9000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	09605dc7fa490c072cac25d2d269ab07c58e099870657c9fbefcb7d3b8cb233dN.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	09605dc7fa490c072cac25d2d269ab07c58e099870657c9fbefcb7d3b8cb233dN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	09605dc7fa490c072cac25d2d269ab07c58e099870657c9fbefcb7d3b8cb233dN.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2508	09605dc7fa490c072cac25d2d269ab07c58e099870657c9fbefcb7d3b8cb233dN.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3024	dmr_72.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2508	09605dc7fa490c072cac25d2d269ab07c58e099870657c9fbefcb7d3b8cb233dN.exe
2508	09605dc7fa490c072cac25d2d269ab07c58e099870657c9fbefcb7d3b8cb233dN.exe
2508	09605dc7fa490c072cac25d2d269ab07c58e099870657c9fbefcb7d3b8cb233dN.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2508	09605dc7fa490c072cac25d2d269ab07c58e099870657c9fbefcb7d3b8cb233dN.exe
2508	09605dc7fa490c072cac25d2d269ab07c58e099870657c9fbefcb7d3b8cb233dN.exe
2508	09605dc7fa490c072cac25d2d269ab07c58e099870657c9fbefcb7d3b8cb233dN.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3024	dmr_72.exe
3024	dmr_72.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 3024	2508	09605dc7fa490c072cac25d2d269ab07c58e099870657c9fbefcb7d3b8cb233dN.exe	30
PID 2508 wrote to memory of 3024	2508	09605dc7fa490c072cac25d2d269ab07c58e099870657c9fbefcb7d3b8cb233dN.exe	30
PID 2508 wrote to memory of 3024	2508	09605dc7fa490c072cac25d2d269ab07c58e099870657c9fbefcb7d3b8cb233dN.exe	30
PID 2508 wrote to memory of 3024	2508	09605dc7fa490c072cac25d2d269ab07c58e099870657c9fbefcb7d3b8cb233dN.exe	30

C:\Users\Admin\AppData\Local\Temp\09605dc7fa490c072cac25d2d269ab07c58e099870657c9fbefcb7d3b8cb233dN.exe
"C:\Users\Admin\AppData\Local\Temp\09605dc7fa490c072cac25d2d269ab07c58e099870657c9fbefcb7d3b8cb233dN.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe
  "C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe" -install -54427628 -chipderedesign -a9254044700e472bb720a88324b810ec - -BLUB2 -frxzeavncumpmasz -2508
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DMR\frxzeavncumpmasz.dat

Filesize
163B

MD5
5ebfb0f0a54c8e5131f5ea941f4a958e

SHA1
cb891032a42c724fd141d5e16600b59c356e305d

SHA256
d5948348d9bf21f8231a0a9a7fb27935bfd76019f952e333515e799f57e54eb6

SHA512
a5b8010cf022e66d4a4e9316ebec768653308b037287d634a07eb251ab4189b589b10632f91f3ebb9e3afc466c7b97fcaa3226fdda535abf68a35e79b0f64cc7

Download Submit
\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe

Filesize
504KB

MD5
25bbe781403dbd685377647a982df817

SHA1
5b5ea2f5cec496f99d245a68c884c09f5849e037

SHA256
ca718f45191351cdda8ed5ca2c8074c899d32837dd019d325c72e4123b5edbfc

SHA512
595644e2542194371d2f3acb27932717464aa9b6e661bc71e5058b8189a433cd1938b49a9c3f241c3a6a675e93cfed97b336a125e2437358a37b0fb6f9714aa2

Download Submit
memory/2508-0-0x0000000000AB0000-0x0000000000DA9000-memory.dmp

Filesize
3.0MB

Download
memory/2508-25-0x0000000000AB0000-0x0000000000DA9000-memory.dmp

Filesize
3.0MB

Download
memory/3024-16-0x000007FEF5573000-0x000007FEF5574000-memory.dmp

Filesize
4KB

Download
memory/3024-17-0x0000000000F50000-0x0000000000FD2000-memory.dmp

Filesize
520KB

Download
memory/3024-19-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

Filesize
9.9MB

Download
memory/3024-20-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

Filesize
9.9MB

Download
memory/3024-21-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

Filesize
9.9MB

Download
memory/3024-23-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

Filesize
9.9MB

Download
memory/3024-22-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

Filesize
9.9MB

Download
memory/3024-26-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing