revengerat | 0e2aec711565719376bc60bcea8fa5c94e640bdf89671dc6c0d08129b6af08c5

General

Target

0e2aec711565719376bc60bcea8fa5c94e640bdf89671dc6c0d08129b6af08c5.exe
Size

1.4MB
MD5

8d4272bb85d4d830ae700da174950292
SHA1

3e76b3fc0e2ff41765ec06ad18ba4f25cb282818
SHA256

0e2aec711565719376bc60bcea8fa5c94e640bdf89671dc6c0d08129b6af08c5
SHA512

68a7415cbd6bf7af9f10a80292f4914395e539b5d9e7f6880b7e8258ffac6308de6f6bc808be9ebcb6b0d79c9025a6053cc68049533e5cddff034b8149ccaa36
SSDEEP

24576:pq5TfcdHj4fmbz2qp0smVkVMyTmXqvEzKJ9TtLb6OqX8N70zQJ9TtDCZ6:pUTsamPxwXs5KX8B57

Score

10^/10

revengerat discovery stealer trojan upx

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Revengerat family
revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral2/files/0x0009000000023c94-7.dat	revengerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Control Panel\International\Geo\Nation	0e2aec711565719376bc60bcea8fa5c94e640bdf89671dc6c0d08129b6af08c5.exe

Executes dropped EXE 1 IoCs

pid	Process
5040	dmr_72.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/5088-21-0x00000000005A0000-0x000000000089B000-memory.dmp	autoit_exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5088-0-0x00000000005A0000-0x000000000089B000-memory.dmp	upx
behavioral2/memory/5088-21-0x00000000005A0000-0x000000000089B000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0e2aec711565719376bc60bcea8fa5c94e640bdf89671dc6c0d08129b6af08c5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	0e2aec711565719376bc60bcea8fa5c94e640bdf89671dc6c0d08129b6af08c5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	0e2aec711565719376bc60bcea8fa5c94e640bdf89671dc6c0d08129b6af08c5.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5088	0e2aec711565719376bc60bcea8fa5c94e640bdf89671dc6c0d08129b6af08c5.exe
5088	0e2aec711565719376bc60bcea8fa5c94e640bdf89671dc6c0d08129b6af08c5.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5088	0e2aec711565719376bc60bcea8fa5c94e640bdf89671dc6c0d08129b6af08c5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5040	dmr_72.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5088	0e2aec711565719376bc60bcea8fa5c94e640bdf89671dc6c0d08129b6af08c5.exe
5088	0e2aec711565719376bc60bcea8fa5c94e640bdf89671dc6c0d08129b6af08c5.exe
5088	0e2aec711565719376bc60bcea8fa5c94e640bdf89671dc6c0d08129b6af08c5.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5088	0e2aec711565719376bc60bcea8fa5c94e640bdf89671dc6c0d08129b6af08c5.exe
5088	0e2aec711565719376bc60bcea8fa5c94e640bdf89671dc6c0d08129b6af08c5.exe
5088	0e2aec711565719376bc60bcea8fa5c94e640bdf89671dc6c0d08129b6af08c5.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5040	dmr_72.exe
5040	dmr_72.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 5040	5088	0e2aec711565719376bc60bcea8fa5c94e640bdf89671dc6c0d08129b6af08c5.exe	85
PID 5088 wrote to memory of 5040	5088	0e2aec711565719376bc60bcea8fa5c94e640bdf89671dc6c0d08129b6af08c5.exe	85

C:\Users\Admin\AppData\Local\Temp\0e2aec711565719376bc60bcea8fa5c94e640bdf89671dc6c0d08129b6af08c5.exe
"C:\Users\Admin\AppData\Local\Temp\0e2aec711565719376bc60bcea8fa5c94e640bdf89671dc6c0d08129b6af08c5.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe
  "C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe" -install -63285565 -chipderedesign -a0bd224031be4330907490f3f0d2616d - -BLUB2 -wgwjoxgzdrgfupzt -5088
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe

Filesize
506KB

MD5
5b3b4b3940d91f3db2a7c9b5d445088a

SHA1
25efc5f0778a51028ff49b40816f17f841c166e7

SHA256
6b674f0dc8accaf8affac158d55951e648463d7ca477be094d22d2fb38a7606d

SHA512
908c0f063e5f25b79fe0dfc0f9103c0943e8fa2d7ccc42c3ffe6c3b9fa403b24b7646e7f96101f2e62bbc57cbf126de3e08a58b661e2573c5a09a505bf19c742

Download Submit
C:\Users\Admin\AppData\Local\Temp\DMR\wgwjoxgzdrgfupzt.dat

Filesize
147B

MD5
54f12ef3fa5331418536c164189049f4

SHA1
7e92e731effaca77c337a391461d75f9ce4aa5e4

SHA256
8a28d1d1c0b3b73bee9586784bc7cbd9bb2327edad0ea006cd819359d2726ee0

SHA512
e66db45b0b46df19abec6678cde420daea4795b5b8e6cd712d3d3da87e4fb4b56e40251c6983522cd7e230eaddf65f335e6603c67a0b0a3e6c1ee8ef3888ea62

Download Submit
memory/5040-13-0x00007FFBDDCF3000-0x00007FFBDDCF5000-memory.dmp

Filesize
8KB

Download
memory/5040-14-0x00000000007F0000-0x0000000000872000-memory.dmp

Filesize
520KB

Download
memory/5040-16-0x00007FFBDDCF0000-0x00007FFBDE7B1000-memory.dmp

Filesize
10.8MB

Download
memory/5040-17-0x00007FFBDDCF0000-0x00007FFBDE7B1000-memory.dmp

Filesize
10.8MB

Download
memory/5040-18-0x00007FFBDDCF0000-0x00007FFBDE7B1000-memory.dmp

Filesize
10.8MB

Download
memory/5040-19-0x00007FFBDDCF0000-0x00007FFBDE7B1000-memory.dmp

Filesize
10.8MB

Download
memory/5040-23-0x00007FFBDDCF0000-0x00007FFBDE7B1000-memory.dmp

Filesize
10.8MB

Download
memory/5088-0-0x00000000005A0000-0x000000000089B000-memory.dmp

Filesize
3.0MB

Download
memory/5088-21-0x00000000005A0000-0x000000000089B000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing