revengerat | 8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5

General

Target

8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
Size

252KB
MD5

cddfcb26e8cf825911344503abeed368
SHA1

d15ef21fe133d47b2305925acdf139bff417062e
SHA256

8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5
SHA512

1d1b3e7701cf7d03079d677245980acb92eb1c23076ea2ff3325f4efdaac82cbd62efb0be436320fee2882e1830a34b77960c4cd9ed42bcaa1c159d008fba472

Score

10^/10

revengerat nov333 stealer trojan

Malware Config

Extracted

Family

revengerat

Botnet

Nov333

C2

80.82.68.21:3333

Mutex

RV_MUTEX-FtNHuiGGjjtnxDp

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

Beds Protector Packer 1 IoCs

Detects Beds Protector packer used to load .NET malware.

Processes:

resource	yara_rule
behavioral1/memory/1524-56-0x00000000004B0000-0x00000000004EC000-memory.dmp	beds_protector

RevengeRat Executable 3 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/852-61-0x0000000000400000-0x0000000000408000-memory.dmp	revengerat
behavioral1/memory/852-62-0x0000000000400000-0x0000000000408000-memory.dmp	revengerat
behavioral1/memory/852-63-0x0000000000400000-0x0000000000408000-memory.dmp	revengerat

Drops startup file 2 IoCs

Processes:

8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe

description	pid	process	target process
PID 1524 set thread context of 852	1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

Processes:

8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe

pid	process
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe

description	pid	process
Token: SeDebugPrivilege	1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
Token: SeDebugPrivilege	852	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe

description	pid	process	target process
PID 1524 wrote to memory of 852	1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
PID 1524 wrote to memory of 852	1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
PID 1524 wrote to memory of 852	1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
PID 1524 wrote to memory of 852	1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
PID 1524 wrote to memory of 852	1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
PID 1524 wrote to memory of 852	1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
PID 1524 wrote to memory of 852	1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
PID 1524 wrote to memory of 852	1524	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe	8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe

C:\Users\Admin\AppData\Local\Temp\8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
"C:\Users\Admin\AppData\Local\Temp\8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1524

C:\Users\Admin\AppData\Local\Temp\8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe
"C:\Users\Admin\AppData\Local\Temp\8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/852-59-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/852-60-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/852-61-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/852-62-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/852-63-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/852-65-0x00000000049C0000-0x00000000049C1000-memory.dmp

Filesize
4KB

Download
memory/852-64-0x0000000074A7E000-0x0000000074A7F000-memory.dmp

Filesize
4KB

Download
memory/1524-54-0x0000000000910000-0x0000000000954000-memory.dmp

Filesize
272KB

Download
memory/1524-55-0x0000000074A7E000-0x0000000074A7F000-memory.dmp

Filesize
4KB

Download
memory/1524-56-0x00000000004B0000-0x00000000004EC000-memory.dmp

Filesize
240KB

Download
memory/1524-57-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

Filesize
4KB

Download
memory/1524-58-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads