revengerat | fe614080646708a020532d8dac57d96767d07ac9f605e86ba306dbfd8f9d51cf

General

Target

df85f50f72f850fb70d6464e17053c4a.exe
Size

23KB
MD5

df85f50f72f850fb70d6464e17053c4a
SHA1

13962c04bafe361466cce63abd389f9ce149debb
SHA256

fe614080646708a020532d8dac57d96767d07ac9f605e86ba306dbfd8f9d51cf
SHA512

da2800fd3b91d99b09f44a22a2b9cd9da523d4b366ae2c0d62eeb0fc33fb9e5a0ecb96b9a6212eec070897f74672d24d312194aa4c04ee6863c3f08388618b6e

Score

10^/10

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 3 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/3440-10-0x0000000000400000-0x0000000000416000-memory.dmp	revengerat
behavioral2/memory/3440-11-0x000000000040F67E-mapping.dmp	revengerat
behavioral2/memory/3440-12-0x0000000000400000-0x0000000000416000-memory.dmp	revengerat

Suspicious use of SetThreadContext 1 IoCs

Processes:

df85f50f72f850fb70d6464e17053c4a.exe

description pid process target process

PID 496 set thread context of 3440 496 df85f50f72f850fb70d6464e17053c4a.exe df85f50f72f850fb70d6464e17053c4a.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

912 timeout.exe

description	pid	process	target process
PID 496 set thread context of 3440	496	df85f50f72f850fb70d6464e17053c4a.exe	df85f50f72f850fb70d6464e17053c4a.exe

pid	process
912	timeout.exe

Modifies registry class 2 IoCs

Processes:

df85f50f72f850fb70d6464e17053c4a.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings	df85f50f72f850fb70d6464e17053c4a.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

df85f50f72f850fb70d6464e17053c4a.exedf85f50f72f850fb70d6464e17053c4a.exe

description pid process

Token: SeDebugPrivilege 496 df85f50f72f850fb70d6464e17053c4a.exe
Token: SeDebugPrivilege 3440 df85f50f72f850fb70d6464e17053c4a.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

2160 OpenWith.exe

description	pid	process
Token: SeDebugPrivilege	496	df85f50f72f850fb70d6464e17053c4a.exe
Token: SeDebugPrivilege	3440	df85f50f72f850fb70d6464e17053c4a.exe

pid	process
2160	OpenWith.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

df85f50f72f850fb70d6464e17053c4a.execmd.exe

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 4
2⤵
- Suspicious use of WriteProcessMemory
PID:3336

C:\Windows\SysWOW64\timeout.exe
timeout 4
3⤵
- Delays execution with timeout.exe
PID:912

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\df85f50f72f850fb70d6464e17053c4a.exe.log
MD5
cdbd9fe47c260bed799dafd0bdfc3329

SHA1
7ec62a94a8d4392bf444dbe0b46a127ff25d9e71

SHA256
9f6dff49933c3303e611592c026350bd51269eff8dc54ddab1ded9673217762b

SHA512
e6c395f40f2deda16e7a445487e789778d2bf31531dc0b821c9bf830a5395129a64278941415c7684ff65b5e58987ac52f9cd2345c7ed51ef502ea46b658bc0d

Download Submit
memory/496-3-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Filesize
4KB

Download
memory/496-5-0x0000000005800000-0x0000000005801000-memory.dmp

Filesize
4KB

Download
memory/496-2-0x0000000073AD0000-0x00000000741BE000-memory.dmp

Filesize
6.9MB

Download
memory/496-8-0x0000000006BE0000-0x0000000006BE1000-memory.dmp

Filesize
4KB

Download
memory/496-9-0x0000000006430000-0x0000000006454000-memory.dmp

Filesize
144KB

Download
memory/912-7-0x0000000000000000-mapping.dmp

Download
memory/3336-6-0x0000000000000000-mapping.dmp

Download
memory/3440-11-0x000000000040F67E-mapping.dmp

Download
memory/3440-12-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3440-14-0x0000000073AE0000-0x00000000741CE000-memory.dmp

Filesize
6.9MB

Download
memory/3440-10-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3440-19-0x0000000005630000-0x0000000005631000-memory.dmp

Filesize
4KB

Download

description	pid	process	target process
PID 496 wrote to memory of 3336	496	df85f50f72f850fb70d6464e17053c4a.exe	cmd.exe
PID 496 wrote to memory of 3336	496	df85f50f72f850fb70d6464e17053c4a.exe	cmd.exe
PID 496 wrote to memory of 3336	496	df85f50f72f850fb70d6464e17053c4a.exe	cmd.exe
PID 3336 wrote to memory of 912	3336	cmd.exe	timeout.exe
PID 3336 wrote to memory of 912	3336	cmd.exe	timeout.exe
PID 3336 wrote to memory of 912	3336	cmd.exe	timeout.exe
PID 496 wrote to memory of 3440	496	df85f50f72f850fb70d6464e17053c4a.exe	df85f50f72f850fb70d6464e17053c4a.exe
PID 496 wrote to memory of 3440	496	df85f50f72f850fb70d6464e17053c4a.exe	df85f50f72f850fb70d6464e17053c4a.exe
PID 496 wrote to memory of 3440	496	df85f50f72f850fb70d6464e17053c4a.exe	df85f50f72f850fb70d6464e17053c4a.exe
PID 496 wrote to memory of 3440	496	df85f50f72f850fb70d6464e17053c4a.exe	df85f50f72f850fb70d6464e17053c4a.exe
PID 496 wrote to memory of 3440	496	df85f50f72f850fb70d6464e17053c4a.exe	df85f50f72f850fb70d6464e17053c4a.exe
PID 496 wrote to memory of 3440	496	df85f50f72f850fb70d6464e17053c4a.exe	df85f50f72f850fb70d6464e17053c4a.exe
PID 496 wrote to memory of 3440	496	df85f50f72f850fb70d6464e17053c4a.exe	df85f50f72f850fb70d6464e17053c4a.exe
PID 496 wrote to memory of 3440	496	df85f50f72f850fb70d6464e17053c4a.exe	df85f50f72f850fb70d6464e17053c4a.exe
PID 496 wrote to memory of 3440	496	df85f50f72f850fb70d6464e17053c4a.exe	df85f50f72f850fb70d6464e17053c4a.exe