revengerat | 111d60990d8aaadbfcc5585ff56d7ed8d597978e1069b06a206ca0552b2150dd

General

Target

111d60990d8aaadbfcc5585ff56d7ed8d597978e1069b06a206ca0552b2150dd.exe
Size

99KB
MD5

36f59c964d963935ae77621ca6e57a41
SHA1

a81fba0cedfba66d84ffe2d2fd0b3803b099cbfc
SHA256

111d60990d8aaadbfcc5585ff56d7ed8d597978e1069b06a206ca0552b2150dd
SHA512

b7518ef642eb62c836ba8ea4256d815c877490b1e68906c2f099f7f484380eba22e6cbec6bcb61af4611f52218306993a356017f0c196fada2d6380f2bcd4c63

Score

10^/10

revengerat stealer trojan

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 5 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/572-63-0x0000000000400000-0x0000000000416000-memory.dmp	revengerat
behavioral1/memory/572-65-0x0000000000400000-0x0000000000416000-memory.dmp	revengerat
behavioral1/memory/572-67-0x0000000000400000-0x0000000000416000-memory.dmp	revengerat
behavioral1/memory/572-69-0x0000000000400000-0x0000000000416000-memory.dmp	revengerat
behavioral1/memory/572-71-0x0000000000400000-0x0000000000416000-memory.dmp	revengerat

Suspicious use of SetThreadContext 1 IoCs

Processes:

111d60990d8aaadbfcc5585ff56d7ed8d597978e1069b06a206ca0552b2150dd.exe

description	pid	process	target process
PID 804 set thread context of 572	804	111d60990d8aaadbfcc5585ff56d7ed8d597978e1069b06a206ca0552b2150dd.exe	111d60990d8aaadbfcc5585ff56d7ed8d597978e1069b06a206ca0552b2150dd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

111d60990d8aaadbfcc5585ff56d7ed8d597978e1069b06a206ca0552b2150dd.exe

description pid process

Token: SeDebugPrivilege 572 111d60990d8aaadbfcc5585ff56d7ed8d597978e1069b06a206ca0552b2150dd.exe

description	pid	process
Token: SeDebugPrivilege	572	111d60990d8aaadbfcc5585ff56d7ed8d597978e1069b06a206ca0552b2150dd.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

111d60990d8aaadbfcc5585ff56d7ed8d597978e1069b06a206ca0552b2150dd.exe

description	pid	process	target process
PID 804 wrote to memory of 572	804	111d60990d8aaadbfcc5585ff56d7ed8d597978e1069b06a206ca0552b2150dd.exe	111d60990d8aaadbfcc5585ff56d7ed8d597978e1069b06a206ca0552b2150dd.exe
PID 804 wrote to memory of 572	804	111d60990d8aaadbfcc5585ff56d7ed8d597978e1069b06a206ca0552b2150dd.exe	111d60990d8aaadbfcc5585ff56d7ed8d597978e1069b06a206ca0552b2150dd.exe
PID 804 wrote to memory of 572	804	111d60990d8aaadbfcc5585ff56d7ed8d597978e1069b06a206ca0552b2150dd.exe	111d60990d8aaadbfcc5585ff56d7ed8d597978e1069b06a206ca0552b2150dd.exe
PID 804 wrote to memory of 572	804	111d60990d8aaadbfcc5585ff56d7ed8d597978e1069b06a206ca0552b2150dd.exe	111d60990d8aaadbfcc5585ff56d7ed8d597978e1069b06a206ca0552b2150dd.exe
PID 804 wrote to memory of 572	804	111d60990d8aaadbfcc5585ff56d7ed8d597978e1069b06a206ca0552b2150dd.exe	111d60990d8aaadbfcc5585ff56d7ed8d597978e1069b06a206ca0552b2150dd.exe
PID 804 wrote to memory of 572	804	111d60990d8aaadbfcc5585ff56d7ed8d597978e1069b06a206ca0552b2150dd.exe	111d60990d8aaadbfcc5585ff56d7ed8d597978e1069b06a206ca0552b2150dd.exe
PID 804 wrote to memory of 572	804	111d60990d8aaadbfcc5585ff56d7ed8d597978e1069b06a206ca0552b2150dd.exe	111d60990d8aaadbfcc5585ff56d7ed8d597978e1069b06a206ca0552b2150dd.exe
PID 804 wrote to memory of 572	804	111d60990d8aaadbfcc5585ff56d7ed8d597978e1069b06a206ca0552b2150dd.exe	111d60990d8aaadbfcc5585ff56d7ed8d597978e1069b06a206ca0552b2150dd.exe
PID 804 wrote to memory of 572	804	111d60990d8aaadbfcc5585ff56d7ed8d597978e1069b06a206ca0552b2150dd.exe	111d60990d8aaadbfcc5585ff56d7ed8d597978e1069b06a206ca0552b2150dd.exe
PID 804 wrote to memory of 572	804	111d60990d8aaadbfcc5585ff56d7ed8d597978e1069b06a206ca0552b2150dd.exe	111d60990d8aaadbfcc5585ff56d7ed8d597978e1069b06a206ca0552b2150dd.exe

C:\Users\Admin\AppData\Local\Temp\111d60990d8aaadbfcc5585ff56d7ed8d597978e1069b06a206ca0552b2150dd.exe
"C:\Users\Admin\AppData\Local\Temp\111d60990d8aaadbfcc5585ff56d7ed8d597978e1069b06a206ca0552b2150dd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:804
- C:\Users\Admin\AppData\Local\Temp\111d60990d8aaadbfcc5585ff56d7ed8d597978e1069b06a206ca0552b2150dd.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/572-67-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/572-65-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/572-73-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/572-72-0x0000000074E50000-0x000000007553E000-memory.dmp

Filesize
6.9MB

Download
memory/572-71-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/572-59-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/572-63-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/572-61-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/572-69-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/804-54-0x0000000001370000-0x0000000001392000-memory.dmp

Filesize
136KB

Download
memory/804-55-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/804-58-0x0000000000290000-0x000000000029C000-memory.dmp

Filesize
48KB

Download
memory/804-57-0x0000000004950000-0x0000000004951000-memory.dmp

Filesize
4KB

Download
memory/804-56-0x0000000074E90000-0x000000007557E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads