revengerat | fe614080646708a020532d8dac57d96767d07ac9f605e86ba306dbfd8f9d51cf

General

Target

df85f50f72f850fb70d6464e17053c4a.exe
Size

23KB
MD5

df85f50f72f850fb70d6464e17053c4a
SHA1

13962c04bafe361466cce63abd389f9ce149debb
SHA256

fe614080646708a020532d8dac57d96767d07ac9f605e86ba306dbfd8f9d51cf
SHA512

da2800fd3b91d99b09f44a22a2b9cd9da523d4b366ae2c0d62eeb0fc33fb9e5a0ecb96b9a6212eec070897f74672d24d312194aa4c04ee6863c3f08388618b6e

Score

10^/10

revengerat stealer trojan

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 3 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/436-9-0x000000000040F67E-mapping.dmp	revengerat
behavioral1/memory/436-8-0x0000000000400000-0x0000000000416000-memory.dmp	revengerat
behavioral1/memory/436-10-0x0000000000400000-0x0000000000416000-memory.dmp	revengerat

Suspicious use of SetThreadContext 1 IoCs

Processes:

df85f50f72f850fb70d6464e17053c4a.exe

description pid process target process

PID 1068 set thread context of 436 1068 df85f50f72f850fb70d6464e17053c4a.exe df85f50f72f850fb70d6464e17053c4a.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1972 timeout.exe

description	pid	process	target process
PID 1068 set thread context of 436	1068	df85f50f72f850fb70d6464e17053c4a.exe	df85f50f72f850fb70d6464e17053c4a.exe

pid	process
1972	timeout.exe

Modifies registry class 2 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

df85f50f72f850fb70d6464e17053c4a.exedf85f50f72f850fb70d6464e17053c4a.exe

description pid process

Token: SeDebugPrivilege 1068 df85f50f72f850fb70d6464e17053c4a.exe
Token: SeDebugPrivilege 436 df85f50f72f850fb70d6464e17053c4a.exe

description	pid	process
Token: SeDebugPrivilege	1068	df85f50f72f850fb70d6464e17053c4a.exe
Token: SeDebugPrivilege	436	df85f50f72f850fb70d6464e17053c4a.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

df85f50f72f850fb70d6464e17053c4a.execmd.exedf85f50f72f850fb70d6464e17053c4a.exe

description	pid	process	target process
PID 1068 wrote to memory of 848	1068	df85f50f72f850fb70d6464e17053c4a.exe	cmd.exe
PID 1068 wrote to memory of 848	1068	df85f50f72f850fb70d6464e17053c4a.exe	cmd.exe
PID 1068 wrote to memory of 848	1068	df85f50f72f850fb70d6464e17053c4a.exe	cmd.exe
PID 1068 wrote to memory of 848	1068	df85f50f72f850fb70d6464e17053c4a.exe	cmd.exe
PID 848 wrote to memory of 1972	848	cmd.exe	timeout.exe
PID 848 wrote to memory of 1972	848	cmd.exe	timeout.exe
PID 848 wrote to memory of 1972	848	cmd.exe	timeout.exe
PID 848 wrote to memory of 1972	848	cmd.exe	timeout.exe
PID 1068 wrote to memory of 436	1068	df85f50f72f850fb70d6464e17053c4a.exe	df85f50f72f850fb70d6464e17053c4a.exe
PID 1068 wrote to memory of 436	1068	df85f50f72f850fb70d6464e17053c4a.exe	df85f50f72f850fb70d6464e17053c4a.exe
PID 1068 wrote to memory of 436	1068	df85f50f72f850fb70d6464e17053c4a.exe	df85f50f72f850fb70d6464e17053c4a.exe
PID 1068 wrote to memory of 436	1068	df85f50f72f850fb70d6464e17053c4a.exe	df85f50f72f850fb70d6464e17053c4a.exe
PID 1068 wrote to memory of 436	1068	df85f50f72f850fb70d6464e17053c4a.exe	df85f50f72f850fb70d6464e17053c4a.exe
PID 1068 wrote to memory of 436	1068	df85f50f72f850fb70d6464e17053c4a.exe	df85f50f72f850fb70d6464e17053c4a.exe
PID 1068 wrote to memory of 436	1068	df85f50f72f850fb70d6464e17053c4a.exe	df85f50f72f850fb70d6464e17053c4a.exe
PID 1068 wrote to memory of 436	1068	df85f50f72f850fb70d6464e17053c4a.exe	df85f50f72f850fb70d6464e17053c4a.exe
PID 1068 wrote to memory of 436	1068	df85f50f72f850fb70d6464e17053c4a.exe	df85f50f72f850fb70d6464e17053c4a.exe
PID 1068 wrote to memory of 436	1068	df85f50f72f850fb70d6464e17053c4a.exe	df85f50f72f850fb70d6464e17053c4a.exe
PID 436 wrote to memory of 1172	436	df85f50f72f850fb70d6464e17053c4a.exe	rundll32.exe
PID 436 wrote to memory of 1172	436	df85f50f72f850fb70d6464e17053c4a.exe	rundll32.exe
PID 436 wrote to memory of 1172	436	df85f50f72f850fb70d6464e17053c4a.exe	rundll32.exe
PID 436 wrote to memory of 1172	436	df85f50f72f850fb70d6464e17053c4a.exe	rundll32.exe
PID 436 wrote to memory of 1172	436	df85f50f72f850fb70d6464e17053c4a.exe	rundll32.exe
PID 436 wrote to memory of 1172	436	df85f50f72f850fb70d6464e17053c4a.exe	rundll32.exe
PID 436 wrote to memory of 1172	436	df85f50f72f850fb70d6464e17053c4a.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\df85f50f72f850fb70d6464e17053c4a.exe
"C:\Users\Admin\AppData\Local\Temp\df85f50f72f850fb70d6464e17053c4a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1068

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 4
2⤵
- Suspicious use of WriteProcessMemory
PID:848

C:\Windows\SysWOW64\timeout.exe
timeout 4
3⤵
- Delays execution with timeout.exe
PID:1972

C:\Users\Admin\AppData\Local\Temp\df85f50f72f850fb70d6464e17053c4a.exe
"C:\Users\Admin\AppData\Local\Temp\df85f50f72f850fb70d6464e17053c4a.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:436

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\System32
3⤵
- Modifies registry class
PID:1172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/436-9-0x000000000040F67E-mapping.dmp

Download
memory/436-8-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/436-10-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/436-11-0x0000000074EE0000-0x00000000755CE000-memory.dmp

Filesize
6.9MB

Download
memory/848-5-0x0000000000000000-mapping.dmp

Download
memory/1068-2-0x0000000074EE0000-0x00000000755CE000-memory.dmp

Filesize
6.9MB

Download
memory/1068-3-0x0000000000B40000-0x0000000000B41000-memory.dmp

Filesize
4KB

Download
memory/1068-7-0x0000000000730000-0x0000000000754000-memory.dmp

Filesize
144KB

Download
memory/1172-14-0x0000000000000000-mapping.dmp

Download
memory/1972-6-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads