revengerat | 82104a89b676d095f16da49490abfd6267a0eea6617d619d25416aaf423125ce

Analysis

max time kernel
146s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17-06-2024 09:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rv.exe
Size

386KB
MD5

2602c258d3fe5647f4f039b644abeaa6
SHA1

f733131b769735c82c56dd5b3f6aef4e3cabac9b
SHA256

ab682dce500913302f75c0cccc9f049fc3fa70b16b5de99788fb9cd520f47d3d
SHA512

db0aa91cbf071fa12951a5b9eeb6610aea3917edd93465863cdeafb939cc5ac9088fee8f64e96d375a428f236bbb589953e60cef3ff50ae2697940d12eba90c6
SSDEEP

384:re6KdcoFfsOxQrSuxY8OR1XOg9rPdQ0qphKBXnMTismaFcwadkfLpOhqqSOpFC:+dcoFLxQrS0Yv5OaVQ52eisHcBKv2C

Score

10^/10

revengerat guest persistence trojan

Malware Config

Extracted

Family

revengerat

Botnet

Guest

awaisawan.zapto.org:333

Mutex

Random

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

rv.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation rv.exe
Executes dropped EXE 1 IoCs

Processes:

svchsoot.exe

pid process

2968 svchsoot.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	rv.exe

pid	process
2968	svchsoot.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

rv.exesvchsoot.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rv.exe"	rv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\svchsoot.exe"	svchsoot.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rv.exesvchsoot.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0	rv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0	svchsoot.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchsoot.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rv.exe

description pid process target process

PID 4320 wrote to memory of 2968 4320 rv.exe svchsoot.exe
PID 4320 wrote to memory of 2968 4320 rv.exe svchsoot.exe
PID 4320 wrote to memory of 2968 4320 rv.exe svchsoot.exe

description	pid	process	target process
PID 4320 wrote to memory of 2968	4320	rv.exe	svchsoot.exe
PID 4320 wrote to memory of 2968	4320	rv.exe	svchsoot.exe
PID 4320 wrote to memory of 2968	4320	rv.exe	svchsoot.exe

C:\Users\Admin\AppData\Local\Temp\rv.exe
"C:\Users\Admin\AppData\Local\Temp\rv.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4320

C:\Users\Admin\AppData\Roaming\svchsoot.exe
"C:\Users\Admin\AppData\Roaming\svchsoot.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks processor information in registry
PID:2968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4212,i,11751898164297348119,13021661521765644467,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:8
1⤵
PID:2956

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\svchsoot.exe
Filesize
386KB

MD5
2602c258d3fe5647f4f039b644abeaa6

SHA1
f733131b769735c82c56dd5b3f6aef4e3cabac9b

SHA256
ab682dce500913302f75c0cccc9f049fc3fa70b16b5de99788fb9cd520f47d3d

SHA512
db0aa91cbf071fa12951a5b9eeb6610aea3917edd93465863cdeafb939cc5ac9088fee8f64e96d375a428f236bbb589953e60cef3ff50ae2697940d12eba90c6

Download Submit
memory/2968-25-0x0000000074C70000-0x0000000075420000-memory.dmp

Filesize
7.7MB

Download
memory/2968-24-0x0000000074C70000-0x0000000075420000-memory.dmp

Filesize
7.7MB

Download
memory/2968-23-0x0000000074C70000-0x0000000075420000-memory.dmp

Filesize
7.7MB

Download
memory/2968-22-0x0000000074C70000-0x0000000075420000-memory.dmp

Filesize
7.7MB

Download
memory/4320-3-0x0000000074C7E000-0x0000000074C7F000-memory.dmp

Filesize
4KB

Download
memory/4320-6-0x0000000074C70000-0x0000000075420000-memory.dmp

Filesize
7.7MB

Download
memory/4320-7-0x0000000005AB0000-0x0000000006054000-memory.dmp

Filesize
5.6MB

Download
memory/4320-8-0x0000000074C70000-0x0000000075420000-memory.dmp

Filesize
7.7MB

Download
memory/4320-5-0x00000000053B0000-0x0000000005416000-memory.dmp

Filesize
408KB

Download
memory/4320-20-0x0000000074C70000-0x0000000075420000-memory.dmp

Filesize
7.7MB

Download
memory/4320-4-0x0000000005080000-0x000000000508C000-memory.dmp

Filesize
48KB

Download
memory/4320-0-0x0000000074C7E000-0x0000000074C7F000-memory.dmp

Filesize
4KB

Download
memory/4320-2-0x00000000050A0000-0x000000000513C000-memory.dmp

Filesize
624KB

Download
memory/4320-1-0x00000000007D0000-0x0000000000838000-memory.dmp

Filesize
416KB

Download