revengerat | cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f

General

Target
cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe
Size 111KB
Sample210228-psca76fz56
SHA256 cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f
MD5 b673b67c3aabf040db0565b1db1d81e3
SHA1 69bbd9984c2506d983730e31e060636fd589134c
SHA512 168bca5cfb2fb48d8c5febb7455b76c0a945ff76b288c9a7944a34230671a64aac27800bc0c53ccb3b73dc0ffbbb0f64a30a04059c9d44c13071dce47f9c112b
MD5 SHA1 SHA512

Score

10^/10

revengerat stealer trojan

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 3 IoCs

stealer

resource	yara_rule
behavioral1/memory/828-8-0x000000000040E5CE-mapping.dmp	revengerat
behavioral1/memory/828-7-0x0000000000400000-0x0000000000416000-memory.dmp	revengerat
behavioral1/memory/828-10-0x0000000000400000-0x0000000000416000-memory.dmp	revengerat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1852 set thread context of 828	1852	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe	30

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1852	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe
1852	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1852	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe
Token: SeDebugPrivilege	828	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 1676	1852	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe	29
PID 1852 wrote to memory of 1676	1852	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe	29
PID 1852 wrote to memory of 1676	1852	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe	29
PID 1852 wrote to memory of 1676	1852	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe	29
PID 1852 wrote to memory of 828	1852	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe	30
PID 1852 wrote to memory of 828	1852	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe	30
PID 1852 wrote to memory of 828	1852	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe	30
PID 1852 wrote to memory of 828	1852	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe	30
PID 1852 wrote to memory of 828	1852	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe	30
PID 1852 wrote to memory of 828	1852	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe	30
PID 1852 wrote to memory of 828	1852	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe	30
PID 1852 wrote to memory of 828	1852	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe	30
PID 1852 wrote to memory of 828	1852	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe	30
PID 1852 wrote to memory of 828	1852	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe	30

C:\Users\Admin\AppData\Local\Temp\cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe
"C:\Users\Admin\AppData\Local\Temp\cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Users\Admin\AppData\Local\Temp\cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe
  "C:\Users\Admin\AppData\Local\Temp\cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe"
  2⤵
  PID:1676
- C:\Users\Admin\AppData\Local\Temp\cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe
  "C:\Users\Admin\AppData\Local\Temp\cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/828-7-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/828-9-0x0000000074570000-0x0000000074C5E000-memory.dmp

Download

memory/828-10-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/828-13-0x00000000051A0000-0x00000000051A1000-memory.dmp

Download

memory/1852-2-0x0000000074570000-0x0000000074C5E000-memory.dmp

Download

memory/1852-3-0x00000000010B0000-0x00000000010B1000-memory.dmp

Download

memory/1852-5-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

Download

memory/1852-6-0x0000000000A10000-0x0000000000A21000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads