revengerat | cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f

Analysis

max time kernel
140s
max time network
151s
platform
windows10_x64
resource
win10v20201028
submitted
28/02/2021, 07:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe
Size 111KB
Sample210228-psca76fz56
SHA256 cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f
MD5 b673b67c3aabf040db0565b1db1d81e3
SHA1 69bbd9984c2506d983730e31e060636fd589134c
SHA512 168bca5cfb2fb48d8c5febb7455b76c0a945ff76b288c9a7944a34230671a64aac27800bc0c53ccb3b73dc0ffbbb0f64a30a04059c9d44c13071dce47f9c112b
MD5 SHA1 SHA512

Score

10^/10

revengerat stealer trojan

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 3 IoCs

stealer

resource	yara_rule
behavioral2/memory/2156-12-0x0000000000400000-0x0000000000416000-memory.dmp	revengerat
behavioral2/memory/2156-13-0x000000000040E5CE-mapping.dmp	revengerat
behavioral2/memory/2156-16-0x0000000000400000-0x0000000000416000-memory.dmp	revengerat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4768 set thread context of 2156	4768	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe	79

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4768	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe
4768	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4768	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe
Token: SeDebugPrivilege	2156	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 3172	4768	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe	78
PID 4768 wrote to memory of 3172	4768	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe	78
PID 4768 wrote to memory of 3172	4768	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe	78
PID 4768 wrote to memory of 2156	4768	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe	79
PID 4768 wrote to memory of 2156	4768	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe	79
PID 4768 wrote to memory of 2156	4768	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe	79
PID 4768 wrote to memory of 2156	4768	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe	79
PID 4768 wrote to memory of 2156	4768	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe	79
PID 4768 wrote to memory of 2156	4768	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe	79
PID 4768 wrote to memory of 2156	4768	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe	79
PID 4768 wrote to memory of 2156	4768	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe	79
PID 4768 wrote to memory of 2156	4768	cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe	79

C:\Users\Admin\AppData\Local\Temp\cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe
"C:\Users\Admin\AppData\Local\Temp\cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Users\Admin\AppData\Local\Temp\cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe
  "C:\Users\Admin\AppData\Local\Temp\cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe"
  2⤵
  PID:3172
- C:\Users\Admin\AppData\Local\Temp\cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe
  "C:\Users\Admin\AppData\Local\Temp\cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2156-12-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/2156-22-0x00000000058D0000-0x00000000058D1000-memory.dmp

Download

memory/2156-20-0x00000000054A0000-0x00000000054A1000-memory.dmp

Download

memory/2156-18-0x0000000005400000-0x0000000005401000-memory.dmp

Download

memory/2156-16-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/2156-15-0x00000000732D0000-0x00000000739BE000-memory.dmp

Download

memory/4768-7-0x00000000050A0000-0x00000000050A1000-memory.dmp

Download

memory/4768-11-0x0000000005280000-0x0000000005281000-memory.dmp

Download

memory/4768-10-0x00000000050B0000-0x00000000050C1000-memory.dmp

Download

memory/4768-9-0x0000000004F80000-0x0000000004F81000-memory.dmp

Download

memory/4768-8-0x00000000052D0000-0x00000000052D1000-memory.dmp

Download

memory/4768-2-0x00000000732D0000-0x00000000739BE000-memory.dmp

Download

memory/4768-6-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

Download

memory/4768-5-0x0000000005610000-0x0000000005611000-memory.dmp

Download

memory/4768-3-0x00000000007A0000-0x00000000007A1000-memory.dmp

Download