revengerat | f10c42d174ddd54feb7137a49807904d489b9b7345a032a7b393b7e8f612d9e4

General

Target

JaffaCakes118_19c8f7ceabfd03accfcbfb8698aabdd2.exe
Size

57KB
MD5

19c8f7ceabfd03accfcbfb8698aabdd2
SHA1

7450580ec60ad5c82d6be51cbcf7f9a3cf55e25f
SHA256

f10c42d174ddd54feb7137a49807904d489b9b7345a032a7b393b7e8f612d9e4
SHA512

cb3507d419a7368665d32f255ddb830776a0f2d01287f9a8b559a53aaaa06d04f2396da8066553cf73e7e87e090f7bf3434ace5384a7426883db6ca90182ebe4
SSDEEP

768:9/NrSYzvletjumiFzI35f+rouhpW05clQvmNfA9EZ4UENQ2TA/:+YrEjiNIl+rouhpW0cfNfA9pUEA

Score

10^/10

revengerat discovery persistence stealer trojan

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Revengerat family
revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral1/files/0x0004000000004ed7-7.dat	revengerat

Drops startup file 8 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TeamViewer-4k.lnk	TeamViewer-4k.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TeamViewer-4k.URL	TeamViewer-4k.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TeamViewer-4k	vbc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TeamViewer-4k.exe	vbc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TeamViewer-4k	TeamViewer-4k.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TeamViewer-4k	TeamViewer-4k.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TeamViewer-4k.vbs	TeamViewer-4k.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TeamViewer-4k.js	TeamViewer-4k.exe

Executes dropped EXE 2 IoCs

pid	Process
2656	TeamViewer-4k.exe
2728	TeamViewer-4k.exe

Loads dropped DLL 3 IoCs

pid	Process
1864	JaffaCakes118_19c8f7ceabfd03accfcbfb8698aabdd2.exe
1864	JaffaCakes118_19c8f7ceabfd03accfcbfb8698aabdd2.exe
2656	TeamViewer-4k.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\4kTEAM = "C:\\Users\\Admin\\AppData\\Roaming\\TeamViewer-4k.exe"	TeamViewer-4k.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TeamViewer-4k.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_19c8f7ceabfd03accfcbfb8698aabdd2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TeamViewer-4k.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2292	schtasks.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1864	JaffaCakes118_19c8f7ceabfd03accfcbfb8698aabdd2.exe
Token: SeDebugPrivilege	2656	TeamViewer-4k.exe
Token: SeDebugPrivilege	2728	TeamViewer-4k.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 2656	1864	JaffaCakes118_19c8f7ceabfd03accfcbfb8698aabdd2.exe	31
PID 1864 wrote to memory of 2656	1864	JaffaCakes118_19c8f7ceabfd03accfcbfb8698aabdd2.exe	31
PID 1864 wrote to memory of 2656	1864	JaffaCakes118_19c8f7ceabfd03accfcbfb8698aabdd2.exe	31
PID 1864 wrote to memory of 2656	1864	JaffaCakes118_19c8f7ceabfd03accfcbfb8698aabdd2.exe	31
PID 2656 wrote to memory of 884	2656	TeamViewer-4k.exe	32
PID 2656 wrote to memory of 884	2656	TeamViewer-4k.exe	32
PID 2656 wrote to memory of 884	2656	TeamViewer-4k.exe	32
PID 2656 wrote to memory of 884	2656	TeamViewer-4k.exe	32
PID 884 wrote to memory of 1668	884	vbc.exe	34
PID 884 wrote to memory of 1668	884	vbc.exe	34
PID 884 wrote to memory of 1668	884	vbc.exe	34
PID 884 wrote to memory of 1668	884	vbc.exe	34
PID 2656 wrote to memory of 2292	2656	TeamViewer-4k.exe	35
PID 2656 wrote to memory of 2292	2656	TeamViewer-4k.exe	35
PID 2656 wrote to memory of 2292	2656	TeamViewer-4k.exe	35
PID 2656 wrote to memory of 2292	2656	TeamViewer-4k.exe	35
PID 2596 wrote to memory of 2728	2596	taskeng.exe	38
PID 2596 wrote to memory of 2728	2596	taskeng.exe	38
PID 2596 wrote to memory of 2728	2596	taskeng.exe	38
PID 2596 wrote to memory of 2728	2596	taskeng.exe	38

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19c8f7ceabfd03accfcbfb8698aabdd2.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19c8f7ceabfd03accfcbfb8698aabdd2.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe
  "C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\_kt9bggp.cmdline"
    3⤵
    - Drops startup file
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:884
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE457.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE456.tmp"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1668
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "4kTEAM" /tr "C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2292

C:\Windows\system32\taskeng.exe
taskeng.exe {975C0800-82CC-44EA-BD04-70E7D3D1A532} S-1-5-21-4177215427-74451935-3209572229-1000:JSMURNPT\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe
  C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESE457.tmp

Filesize
1KB

MD5
394498da4237ad15b279ccad2dc59c69

SHA1
d97439dedddcda51e458ef367c7d21a74386306e

SHA256
61f78ee79360da44fbf7b2b6d5dd2d994f3712005945241b7fd98a402c70f09b

SHA512
9c91ec41786d2441593fabd5477c31d593510109452fc04c0d706bdc559e339ab60f4212e248badc74a4dd9f76072f21a3078db3dfdd155bff01494e5eb0c378

Download Submit
C:\Users\Admin\AppData\Local\Temp\_kt9bggp.0.vb

Filesize
158B

MD5
6f08a6843d6aab5c6c2f04127f9260a2

SHA1
545eff96fbc0d3c3d6759d158b71705904613114

SHA256
0737ebc854708f9f2ec8707c8e83adb8e1a4e8f83074cfc77a1eba0e0949f3a4

SHA512
2753cdb89404cd8147a524b4c2ce71317ad51b02a7bde5fa473877e828303b6302b8b82c0d3ca7ce62e901aa24c82d44da720f687b694a770fedaef913c1c3a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_kt9bggp.cmdline

Filesize
197B

MD5
40047d0cf92335c786e68843afe48c6d

SHA1
3abb83a49e65eba51d44d1bf3b1c87cb4c951533

SHA256
ba32fa35c096d087219623a50e442fab97964c57bf8cbea725e2cc907b78418a

SHA512
d6b02802edd14dee48a6b345bd66775f610168fec0872f46aa28073a02cd4689c467649168f19d206b798d3bd62fecfee89768f6cb479ff587cdafff2a7946d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcE456.tmp

Filesize
668B

MD5
b2e2ac45261982d0eb75d0a4f9f7a4c5

SHA1
ab1741199faf69b1163a6ddaf5a739ede02858ab

SHA256
1a8da5a0397488b826932d7584733a714005a6e1f720da484d56e4f9677e96ae

SHA512
0a87dc721ffdc45f892529a0a2edc454bf87ec53e0b43cc1d0561e138493533ba244db9cc8395a061120d4323dc8b20b298a0d76da66dda429a6cb3d69d5d07a

Download Submit
\Users\Admin\AppData\Roaming\TeamViewer-4k.exe

Filesize
57KB

MD5
19c8f7ceabfd03accfcbfb8698aabdd2

SHA1
7450580ec60ad5c82d6be51cbcf7f9a3cf55e25f

SHA256
f10c42d174ddd54feb7137a49807904d489b9b7345a032a7b393b7e8f612d9e4

SHA512
cb3507d419a7368665d32f255ddb830776a0f2d01287f9a8b559a53aaaa06d04f2396da8066553cf73e7e87e090f7bf3434ace5384a7426883db6ca90182ebe4

Download Submit
memory/1864-16-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/1864-0-0x0000000074511000-0x0000000074512000-memory.dmp

Filesize
4KB

Download
memory/1864-4-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/1864-3-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/1864-2-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/1864-1-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/2656-17-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/2656-18-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/2656-19-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads