revengerat | ca8792b14536fd50ff51c39aa1f3dd751be0d6201e7766823848b34cb9d84f92

Analysis

max time kernel
133s
max time network
143s
platform
windows10_x64
resource
win10v200722
submitted
12/09/2020, 19:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3MFnsubA.exe
Size 17KB
Sample200912-ss9eaytthx
SHA256 ca8792b14536fd50ff51c39aa1f3dd751be0d6201e7766823848b34cb9d84f92
MD5 a76a6043c3dc377b5b77d9db9c9ce309
SHA1 8db0bc41916c5a205585df6660996f932fda85b6
SHA512 bf8a5a7566c0c871ceee83c06d0056658bbeb8d046eaa05d7e0d747f13ee9118cf58881ac943b9b52ff92a92783e91f1e4443e1bb65f4b7bd887f58ad3a54a5e
MD5 SHA1 SHA512

Score

10^/10

trojan revengerat

Malware Config

Extracted

Family

revengerat

Botnet

Guest

systemmicrosoft.linkpc.net:5005

Mutex

RV_MUTEX

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

Executes dropped EXE 1 IoCs

pid	Process
3336	svchost.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	3MFnsubA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	3MFnsubA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3944	3MFnsubA.exe
Token: SeDebugPrivilege	3336	svchost.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 3336	3944	3MFnsubA.exe	75
PID 3944 wrote to memory of 3336	3944	3MFnsubA.exe	75

C:\Users\Admin\AppData\Local\Temp\3MFnsubA.exe
"C:\Users\Admin\AppData\Local\Temp\3MFnsubA.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Drops startup file
  - Suspicious use of AdjustPrivilegeToken
  PID:3336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3336-4-0x00007FFF4EA70000-0x00007FFF4F410000-memory.dmp

Download

memory/3944-0-0x00007FFF4EA70000-0x00007FFF4F410000-memory.dmp