Overview

overview

10

Static

static

10

async1_ravengeRAT.exe

windows7_x64

1

async1_ravengeRAT.exe

windows10_x64

1

Analysis

  • max time kernel
    23s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    14-01-2021 11:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    async1_ravengeRAT.exe

  • Size

    47KB

  • MD5

    ddd27af6aa3c0cc0c1a423a413842a52

  • SHA1

    7533d2136cd2ca9caa3cf2e0762e2e2a70e6f52d

  • SHA256

    dd0f1ebf512a897e0a0130602febbe793a00d8751dc061bc8c40ada66ac220fe

  • SHA512

    cb93d4d1c71072db9068e0673d5bb2c1075c62263212488db18b483494d772308fff4ce26b11973f486e0b34516143f3a5bf38e2ca3c68797db8503350373eeb

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\async1_ravengeRAT.exe
    "C:\Users\Admin\AppData\Local\Temp\async1_ravengeRAT.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4688-2-0x00000000734D0000-0x0000000073BBE000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/4688-3-0x0000000000CB0000-0x0000000000CB1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4688-5-0x0000000005BC0000-0x0000000005BC1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4688-6-0x0000000006390000-0x0000000006391000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4688-7-0x0000000005F00000-0x0000000005F01000-memory.dmp
    Filesize

    4KB

    Download