revengerat | 82104a89b676d095f16da49490abfd6267a0eea6617d619d25416aaf423125ce

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
17-06-2024 09:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rv.exe
Size

386KB
MD5

2602c258d3fe5647f4f039b644abeaa6
SHA1

f733131b769735c82c56dd5b3f6aef4e3cabac9b
SHA256

ab682dce500913302f75c0cccc9f049fc3fa70b16b5de99788fb9cd520f47d3d
SHA512

db0aa91cbf071fa12951a5b9eeb6610aea3917edd93465863cdeafb939cc5ac9088fee8f64e96d375a428f236bbb589953e60cef3ff50ae2697940d12eba90c6
SSDEEP

384:re6KdcoFfsOxQrSuxY8OR1XOg9rPdQ0qphKBXnMTismaFcwadkfLpOhqqSOpFC:+dcoFLxQrS0Yv5OaVQ52eisHcBKv2C

Score

10^/10

revengerat guest persistence trojan

Malware Config

Extracted

Family

revengerat

Botnet

Guest

awaisawan.zapto.org:333

Mutex

Random

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Executes dropped EXE 1 IoCs

Processes:

svchsoot.exe

pid process

2736 svchsoot.exe
Loads dropped DLL 1 IoCs

Processes:

rv.exe

pid process

2908 rv.exe

pid	process
2736	svchsoot.exe

pid	process
2908	rv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

rv.exesvchsoot.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rv.exe"	rv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\svchsoot.exe"	svchsoot.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchsoot.exerv.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0	svchsoot.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CENTRALPROCESSOR\0\ProcessorNameString	svchsoot.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0	rv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CENTRALPROCESSOR\0\ProcessorNameString	rv.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

rv.exe

description	pid	process	target process
PID 2908 wrote to memory of 2736	2908	rv.exe	svchsoot.exe
PID 2908 wrote to memory of 2736	2908	rv.exe	svchsoot.exe
PID 2908 wrote to memory of 2736	2908	rv.exe	svchsoot.exe
PID 2908 wrote to memory of 2736	2908	rv.exe	svchsoot.exe

C:\Users\Admin\AppData\Local\Temp\rv.exe
"C:\Users\Admin\AppData\Local\Temp\rv.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2908

C:\Users\Admin\AppData\Roaming\svchsoot.exe
"C:\Users\Admin\AppData\Roaming\svchsoot.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks processor information in registry
PID:2736

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\svchsoot.exe
Filesize
386KB

MD5
2602c258d3fe5647f4f039b644abeaa6

SHA1
f733131b769735c82c56dd5b3f6aef4e3cabac9b

SHA256
ab682dce500913302f75c0cccc9f049fc3fa70b16b5de99788fb9cd520f47d3d

SHA512
db0aa91cbf071fa12951a5b9eeb6610aea3917edd93465863cdeafb939cc5ac9088fee8f64e96d375a428f236bbb589953e60cef3ff50ae2697940d12eba90c6

Download Submit
memory/2736-13-0x0000000000FC0000-0x0000000001028000-memory.dmp

Filesize
416KB

Download
memory/2736-15-0x00000000742B0000-0x000000007499E000-memory.dmp

Filesize
6.9MB

Download
memory/2736-16-0x00000000742B0000-0x000000007499E000-memory.dmp

Filesize
6.9MB

Download
memory/2736-17-0x00000000742B0000-0x000000007499E000-memory.dmp

Filesize
6.9MB

Download
memory/2736-18-0x00000000742B0000-0x000000007499E000-memory.dmp

Filesize
6.9MB

Download
memory/2908-2-0x00000000742BE000-0x00000000742BF000-memory.dmp

Filesize
4KB

Download
memory/2908-3-0x0000000000500000-0x000000000050C000-memory.dmp

Filesize
48KB

Download
memory/2908-4-0x00000000742B0000-0x000000007499E000-memory.dmp

Filesize
6.9MB

Download
memory/2908-5-0x00000000742B0000-0x000000007499E000-memory.dmp

Filesize
6.9MB

Download
memory/2908-1-0x0000000000A50000-0x0000000000AB8000-memory.dmp

Filesize
416KB

Download
memory/2908-14-0x00000000742B0000-0x000000007499E000-memory.dmp

Filesize
6.9MB

Download
memory/2908-0-0x00000000742BE000-0x00000000742BF000-memory.dmp

Filesize
4KB

Download