revengerat | 697585670f658c4a97b8ffba1f251db024967c345a012aa3c09f64fbe291ba9c

Analysis

max time kernel
123s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2025, 19:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

svchost.exe
Size

527KB
MD5

8d8406efe453f31827c13ceb7c939754
SHA1

d21d889ce740d27ffe06b41940476a4a436dd3ec
SHA256

697585670f658c4a97b8ffba1f251db024967c345a012aa3c09f64fbe291ba9c
SHA512

2a8eb89c7bdc898002909445838d6016fbf6fc7f95d15996468d681e3c32b8c1abe42a0d91ef79c9374da7c01c0795d40eafbedd48e927137c6788d88338472d
SSDEEP

6144:c9lbcrJZ/FlpsvfO8UabGbjWVCxoCh+6I1fhoYS8ucrXGIAbbILChnSPdK0yyyIC:g+hsxUEN1CMzoC1gJadSHIaRy2Z

Score

10^/10

revengerat umbral xworm execution rat stealer trojan

Malware Config

Signatures

Detect Umbral payload 3 IoCs

resource	yara_rule
behavioral1/memory/1452-35-0x0000000002E50000-0x0000000002EAA000-memory.dmp	family_umbral
behavioral1/files/0x000b00000002406d-40.dat	family_umbral
behavioral1/memory/2196-48-0x000001B8390D0000-0x000001B839110000-memory.dmp	family_umbral

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1452-35-0x0000000002E50000-0x0000000002EAA000-memory.dmp	family_xworm

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Revengerat family
revengerat
Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral1/memory/1452-35-0x0000000002E50000-0x0000000002EAA000-memory.dmp	revengerat

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2668	powershell.exe
4512	powershell.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\International\Geo\Nation	SystemSettings.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\International\Geo\Nation	SystemSettings.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\International\Geo\Nation	SystemSettings.exe

Executes dropped EXE 6 IoCs

pid	Process
1452	SystemSettings.exe
2196	svchost.exe
3960	SystemSettings.exe
5244	svchost.exe
2952	SystemSettings.exe
5324	svchost.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
31	ip-api.com
78	ip-api.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\SystemSettings.exe	svchost.exe
File opened for modification	C:\Windows\System32\SystemSettings.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2668	powershell.exe
2668	powershell.exe
4512	powershell.exe
4512	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5316	svchost.exe
Token: SeDebugPrivilege	2668	powershell.exe
Token: SeDebugPrivilege	4512	powershell.exe
Token: SeDebugPrivilege	1452	SystemSettings.exe
Token: SeDebugPrivilege	2196	svchost.exe
Token: SeIncreaseQuotaPrivilege	2208	wmic.exe
Token: SeSecurityPrivilege	2208	wmic.exe
Token: SeTakeOwnershipPrivilege	2208	wmic.exe
Token: SeLoadDriverPrivilege	2208	wmic.exe
Token: SeSystemProfilePrivilege	2208	wmic.exe
Token: SeSystemtimePrivilege	2208	wmic.exe
Token: SeProfSingleProcessPrivilege	2208	wmic.exe
Token: SeIncBasePriorityPrivilege	2208	wmic.exe
Token: SeCreatePagefilePrivilege	2208	wmic.exe
Token: SeBackupPrivilege	2208	wmic.exe
Token: SeRestorePrivilege	2208	wmic.exe
Token: SeShutdownPrivilege	2208	wmic.exe
Token: SeDebugPrivilege	2208	wmic.exe
Token: SeSystemEnvironmentPrivilege	2208	wmic.exe
Token: SeRemoteShutdownPrivilege	2208	wmic.exe
Token: SeUndockPrivilege	2208	wmic.exe
Token: SeManageVolumePrivilege	2208	wmic.exe
Token: 33	2208	wmic.exe
Token: 34	2208	wmic.exe
Token: 35	2208	wmic.exe
Token: 36	2208	wmic.exe
Token: SeIncreaseQuotaPrivilege	2208	wmic.exe
Token: SeSecurityPrivilege	2208	wmic.exe
Token: SeTakeOwnershipPrivilege	2208	wmic.exe
Token: SeLoadDriverPrivilege	2208	wmic.exe
Token: SeSystemProfilePrivilege	2208	wmic.exe
Token: SeSystemtimePrivilege	2208	wmic.exe
Token: SeProfSingleProcessPrivilege	2208	wmic.exe
Token: SeIncBasePriorityPrivilege	2208	wmic.exe
Token: SeCreatePagefilePrivilege	2208	wmic.exe
Token: SeBackupPrivilege	2208	wmic.exe
Token: SeRestorePrivilege	2208	wmic.exe
Token: SeShutdownPrivilege	2208	wmic.exe
Token: SeDebugPrivilege	2208	wmic.exe
Token: SeSystemEnvironmentPrivilege	2208	wmic.exe
Token: SeRemoteShutdownPrivilege	2208	wmic.exe
Token: SeUndockPrivilege	2208	wmic.exe
Token: SeManageVolumePrivilege	2208	wmic.exe
Token: 33	2208	wmic.exe
Token: 34	2208	wmic.exe
Token: 35	2208	wmic.exe
Token: 36	2208	wmic.exe
Token: SeDebugPrivilege	3960	SystemSettings.exe
Token: SeDebugPrivilege	5244	svchost.exe
Token: SeIncreaseQuotaPrivilege	4220	wmic.exe
Token: SeSecurityPrivilege	4220	wmic.exe
Token: SeTakeOwnershipPrivilege	4220	wmic.exe
Token: SeLoadDriverPrivilege	4220	wmic.exe
Token: SeSystemProfilePrivilege	4220	wmic.exe
Token: SeSystemtimePrivilege	4220	wmic.exe
Token: SeProfSingleProcessPrivilege	4220	wmic.exe
Token: SeIncBasePriorityPrivilege	4220	wmic.exe
Token: SeCreatePagefilePrivilege	4220	wmic.exe
Token: SeBackupPrivilege	4220	wmic.exe
Token: SeRestorePrivilege	4220	wmic.exe
Token: SeShutdownPrivilege	4220	wmic.exe
Token: SeDebugPrivilege	4220	wmic.exe
Token: SeSystemEnvironmentPrivilege	4220	wmic.exe
Token: SeRemoteShutdownPrivilege	4220	wmic.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 5316 wrote to memory of 2668	5316	svchost.exe	89
PID 5316 wrote to memory of 2668	5316	svchost.exe	89
PID 5316 wrote to memory of 4512	5316	svchost.exe	91
PID 5316 wrote to memory of 4512	5316	svchost.exe	91
PID 1452 wrote to memory of 2196	1452	SystemSettings.exe	104
PID 1452 wrote to memory of 2196	1452	SystemSettings.exe	104
PID 2196 wrote to memory of 2208	2196	svchost.exe	108
PID 2196 wrote to memory of 2208	2196	svchost.exe	108
PID 3960 wrote to memory of 5244	3960	SystemSettings.exe	125
PID 3960 wrote to memory of 5244	3960	SystemSettings.exe	125
PID 5244 wrote to memory of 4220	5244	svchost.exe	128
PID 5244 wrote to memory of 4220	5244	svchost.exe	128
PID 2952 wrote to memory of 5324	2952	SystemSettings.exe	132
PID 2952 wrote to memory of 5324	2952	SystemSettings.exe	132
PID 5324 wrote to memory of 844	5324	svchost.exe	135
PID 5324 wrote to memory of 844	5324	svchost.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\SystemSettings.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SystemSettings.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4512

C:\Windows\System32\SystemSettings.exe
C:\Windows\System32\SystemSettings.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1452
- C:\ProgramData\svchost.exe
  "C:\ProgramData\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2208

C:\Windows\System32\SystemSettings.exe
C:\Windows\System32\SystemSettings.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3960
- C:\ProgramData\svchost.exe
  "C:\ProgramData\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5244
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4220

C:\Windows\System32\SystemSettings.exe
C:\Windows\System32\SystemSettings.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952
- C:\ProgramData\svchost.exe
  "C:\ProgramData\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5324
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\svchost.exe

Filesize
231KB

MD5
358e1b599e0d06b53343389b13c7fb62

SHA1
74be9b62dc8ef9fc34b6d59f87f89fa090fc1184

SHA256
57538a24f196fa4679b9a8e3af66db37826870d639374ab2350c13cf798759e9

SHA512
d370826d5f91cbf0f508ad2e2d20f78cefc2532497fcb3a995c21e14c66bbc8b36c42dde6d528b9a269386431e1d1a66588f326892cff119b8627e0727a9a137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.log

Filesize
1KB

MD5
71f773f5835f84ad3450d4dc488bbb93

SHA1
798cb5227bfe25e8fb8d866907220e6a7334dbf2

SHA256
ef9e32389290bbf9f82d5b82d4131bcf111fbabc75677493915a7ddb98e36417

SHA512
b2a8199a3af5113e4ac8a56e0bbf2be5e9895d74b84554c4a58f091d4946cd392f44119986a9d51be60f74529c50e3f8fe9b300f05907881330857435e572288

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d230e2e97704f9cc74439c51f1687c77

SHA1
900f3725386290db32227d09958968fcacce740a

SHA256
1294dc2197cdf3429384ef75726994b66d267ce2be233fca14ec9a18ff045d76

SHA512
d6dcaafe9b15e9566fcdf5561a9286a9164c453c05e81f5de30577f8541bf0c86318d7f5014d18ec0953c8eadf336db257d012a42e63d8e2c7e91c4ab3caeb81

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0cvpad5o.253.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System32\SystemSettings.exe

Filesize
527KB

MD5
8d8406efe453f31827c13ceb7c939754

SHA1
d21d889ce740d27ffe06b41940476a4a436dd3ec

SHA256
697585670f658c4a97b8ffba1f251db024967c345a012aa3c09f64fbe291ba9c

SHA512
2a8eb89c7bdc898002909445838d6016fbf6fc7f95d15996468d681e3c32b8c1abe42a0d91ef79c9374da7c01c0795d40eafbedd48e927137c6788d88338472d

Download Submit
memory/1452-35-0x0000000002E50000-0x0000000002EAA000-memory.dmp

Filesize
360KB

Download
memory/1452-49-0x000000001BF00000-0x000000001C0A9000-memory.dmp

Filesize
1.7MB

Download
memory/2196-48-0x000001B8390D0000-0x000001B839110000-memory.dmp

Filesize
256KB

Download
memory/2668-14-0x00007FFD57700000-0x00007FFD581C1000-memory.dmp

Filesize
10.8MB

Download
memory/2668-17-0x00007FFD57700000-0x00007FFD581C1000-memory.dmp

Filesize
10.8MB

Download
memory/2668-11-0x000002B859B90000-0x000002B859BB2000-memory.dmp

Filesize
136KB

Download
memory/2668-13-0x00007FFD57700000-0x00007FFD581C1000-memory.dmp

Filesize
10.8MB

Download
memory/2668-12-0x00007FFD57700000-0x00007FFD581C1000-memory.dmp

Filesize
10.8MB

Download
memory/2952-75-0x000000001B530000-0x000000001B6D9000-memory.dmp

Filesize
1.7MB

Download
memory/3960-62-0x000000001C160000-0x000000001C309000-memory.dmp

Filesize
1.7MB

Download
memory/5316-0-0x00007FFD57703000-0x00007FFD57705000-memory.dmp

Filesize
8KB

Download
memory/5316-1-0x0000000000F00000-0x0000000000F8A000-memory.dmp

Filesize
552KB

Download