revengerat | da1e65953f6cf5b06dc9c4e0f596d5c9997c2ec32aeb41e875816f10c74cb049

Analysis

max time kernel
219s
max time network
220s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
07-01-2025 18:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Revenge.exe
Size

20KB
MD5

8ce9e623e44cdb2dbd292da43a90506f
SHA1

09c00d2c83c5456ae168b8329a63befacaef004e
SHA256

da1e65953f6cf5b06dc9c4e0f596d5c9997c2ec32aeb41e875816f10c74cb049
SHA512

792e0cb35c0d4dd87a5f21d9ea7b154139676497373717150bfb629669bc59c799f8f8bbdeb763eab696e0cb85e94744af4c77441eaa7a6283511ef0654331f3
SSDEEP

384:AX2yy5E7X152gLDQqb7sVKuBV1yhKr2534WCzYcHe+Z:Q2yy5Gl52uDp42h4XzYcHe+Z

Score

10^/10

revengerat guest stealer trojan

Malware Config

Extracted

Family

revengerat

Botnet

Guest

necatisoff-36486.portmap.host:36486

Mutex

RV_MUTEX-ETUKIWwiejYAo

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Revengerat family
revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral1/files/0x002a000000046170-16.dat	revengerat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation	algorhitm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation	Revenge.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\algorhitm.exe	algorhitm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\algorhitm.vbs	algorhitm.exe

Executes dropped EXE 1 IoCs

pid	Process
3712	algorhitm.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\algorhitm.exe	algorhitm.exe
File created	C:\Windows\system32\algorhitm.exe	Revenge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	algorhitm.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0	Revenge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Revenge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0	algorhitm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	2976	Revenge.exe
Token: SeDebugPrivilege	3712	algorhitm.exe
Token: SeDebugPrivilege	1016	Taskmgr.exe
Token: SeSystemProfilePrivilege	1016	Taskmgr.exe
Token: SeCreateGlobalPrivilege	1016	Taskmgr.exe
Token: 33	1016	Taskmgr.exe
Token: SeIncBasePriorityPrivilege	1016	Taskmgr.exe
Token: 33	1056	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1056	AUDIODG.EXE
Token: SeBackupPrivilege	4388	dw20.exe
Token: SeBackupPrivilege	4388	dw20.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe

Suspicious use of SendNotifyMessage 50 IoCs

pid	Process
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe
1016	Taskmgr.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 3712	2976	Revenge.exe	92
PID 2976 wrote to memory of 3712	2976	Revenge.exe	92
PID 3712 wrote to memory of 4744	3712	algorhitm.exe	93
PID 3712 wrote to memory of 4744	3712	algorhitm.exe	93
PID 3712 wrote to memory of 1016	3712	algorhitm.exe	95
PID 3712 wrote to memory of 1016	3712	algorhitm.exe	95
PID 3712 wrote to memory of 4012	3712	algorhitm.exe	96
PID 3712 wrote to memory of 4012	3712	algorhitm.exe	96
PID 3712 wrote to memory of 4388	3712	algorhitm.exe	100
PID 3712 wrote to memory of 4388	3712	algorhitm.exe	100

C:\Users\Admin\AppData\Local\Temp\Revenge.exe
"C:\Users\Admin\AppData\Local\Temp\Revenge.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\system32\algorhitm.exe
  "C:\Windows\system32\algorhitm.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Drops file in System32 directory
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:4744
- - C:\Windows\System32\Taskmgr.exe
    "C:\Windows\System32\Taskmgr.exe"
    3⤵
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1016
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Modifies registry class
    PID:4012
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
    dw20.exe -x -s 1588
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    PID:4388

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f8 0x2f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\algorhitm.exe

Filesize
20KB

MD5
8ce9e623e44cdb2dbd292da43a90506f

SHA1
09c00d2c83c5456ae168b8329a63befacaef004e

SHA256
da1e65953f6cf5b06dc9c4e0f596d5c9997c2ec32aeb41e875816f10c74cb049

SHA512
792e0cb35c0d4dd87a5f21d9ea7b154139676497373717150bfb629669bc59c799f8f8bbdeb763eab696e0cb85e94744af4c77441eaa7a6283511ef0654331f3

Download Submit
memory/1016-32-0x0000020329B30000-0x0000020329B31000-memory.dmp

Filesize
4KB

Download
memory/1016-33-0x0000020329B30000-0x0000020329B31000-memory.dmp

Filesize
4KB

Download
memory/1016-34-0x0000020329B30000-0x0000020329B31000-memory.dmp

Filesize
4KB

Download
memory/1016-35-0x0000020329B30000-0x0000020329B31000-memory.dmp

Filesize
4KB

Download
memory/1016-36-0x0000020329B30000-0x0000020329B31000-memory.dmp

Filesize
4KB

Download
memory/1016-37-0x0000020329B30000-0x0000020329B31000-memory.dmp

Filesize
4KB

Download
memory/1016-31-0x0000020329B30000-0x0000020329B31000-memory.dmp

Filesize
4KB

Download
memory/1016-25-0x0000020329B30000-0x0000020329B31000-memory.dmp

Filesize
4KB

Download
memory/1016-27-0x0000020329B30000-0x0000020329B31000-memory.dmp

Filesize
4KB

Download
memory/1016-26-0x0000020329B30000-0x0000020329B31000-memory.dmp

Filesize
4KB

Download
memory/2976-10-0x000000001CC40000-0x000000001CC48000-memory.dmp

Filesize
32KB

Download
memory/2976-1-0x000000001BEB0000-0x000000001C37E000-memory.dmp

Filesize
4.8MB

Download
memory/2976-13-0x00007FFFEC030000-0x00007FFFEC9D1000-memory.dmp

Filesize
9.6MB

Download
memory/2976-14-0x00007FFFEC030000-0x00007FFFEC9D1000-memory.dmp

Filesize
9.6MB

Download
memory/2976-15-0x00007FFFEC030000-0x00007FFFEC9D1000-memory.dmp

Filesize
9.6MB

Download
memory/2976-11-0x000000001E6E0000-0x000000001EBF0000-memory.dmp

Filesize
5.1MB

Download
memory/2976-18-0x00007FFFEC030000-0x00007FFFEC9D1000-memory.dmp

Filesize
9.6MB

Download
memory/2976-19-0x00007FFFEC030000-0x00007FFFEC9D1000-memory.dmp

Filesize
9.6MB

Download
memory/2976-12-0x0000000001200000-0x000000000120C000-memory.dmp

Filesize
48KB

Download
memory/2976-2-0x00007FFFEC030000-0x00007FFFEC9D1000-memory.dmp

Filesize
9.6MB

Download
memory/2976-3-0x000000001B910000-0x000000001B9B6000-memory.dmp

Filesize
664KB

Download
memory/2976-4-0x000000001C440000-0x000000001C4A2000-memory.dmp

Filesize
392KB

Download
memory/2976-5-0x00007FFFEC030000-0x00007FFFEC9D1000-memory.dmp

Filesize
9.6MB

Download
memory/2976-0-0x00007FFFEC2E5000-0x00007FFFEC2E6000-memory.dmp

Filesize
4KB

Download
memory/2976-9-0x000000001E130000-0x000000001E1CC000-memory.dmp

Filesize
624KB

Download
memory/2976-8-0x000000001C7A0000-0x000000001C7B4000-memory.dmp

Filesize
80KB

Download
memory/2976-7-0x00007FFFEC030000-0x00007FFFEC9D1000-memory.dmp

Filesize
9.6MB

Download
memory/2976-6-0x00007FFFEC2E5000-0x00007FFFEC2E6000-memory.dmp

Filesize
4KB

Download
memory/3712-24-0x00007FFFEC030000-0x00007FFFEC9D1000-memory.dmp

Filesize
9.6MB

Download
memory/3712-23-0x00007FFFEC030000-0x00007FFFEC9D1000-memory.dmp

Filesize
9.6MB

Download
memory/3712-22-0x00007FFFEC030000-0x00007FFFEC9D1000-memory.dmp

Filesize
9.6MB

Download
memory/3712-20-0x00007FFFEC030000-0x00007FFFEC9D1000-memory.dmp

Filesize
9.6MB

Download
memory/3712-21-0x00007FFFEC030000-0x00007FFFEC9D1000-memory.dmp

Filesize
9.6MB

Download
memory/3712-38-0x00007FFFEC030000-0x00007FFFEC9D1000-memory.dmp

Filesize
9.6MB

Download
memory/3712-40-0x00007FFFEC030000-0x00007FFFEC9D1000-memory.dmp

Filesize
9.6MB

Download
memory/3712-42-0x000000001D1A0000-0x000000001D1B2000-memory.dmp

Filesize
72KB

Download
memory/3712-43-0x000000001E5E0000-0x000000001E5F8000-memory.dmp

Filesize
96KB

Download
memory/3712-44-0x0000000001410000-0x0000000001430000-memory.dmp

Filesize
128KB

Download
memory/3712-45-0x0000000001390000-0x00000000013A4000-memory.dmp

Filesize
80KB

Download
memory/3712-52-0x00007FFFEC030000-0x00007FFFEC9D1000-memory.dmp

Filesize
9.6MB

Download