revengerat | 4b418627dc8f28c34a79776bbd7ac1cc28789531036ccb542c1410b64d14afe6 | Triage

Analysis

max time kernel
149s
max time network
125s
platform
windows7_x64
resource
win7-en-20211208
submitted
09-03-2022 13:46

Sharing

Report Analysis Logs

General

Target

4b418627dc8f28c34a79776bbd7ac1cc28789531036ccb542c1410b64d14afe6.exe
Size

58KB
MD5

a805d5e21e949f58a30079d0e40c914c
SHA1

76e5225ea7358bf7c3b86c3a670ed75559f025fa
SHA256

4b418627dc8f28c34a79776bbd7ac1cc28789531036ccb542c1410b64d14afe6
SHA512

4c8d0710afc66b67d6edc695494b87e7516489382ddd805af881601db4241edf87e62d1e654cf4ac5e667a539ef02356f914028a673ffc1825ff225d562a761b

Score

10^/10

revengerat stealer trojan

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1368-57-0x00000000001D0000-0x00000000001E4000-memory.dmp	revengerat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4b418627dc8f28c34a79776bbd7ac1cc28789531036ccb542c1410b64d14afe6.exe

description pid process

Token: SeDebugPrivilege 1368 4b418627dc8f28c34a79776bbd7ac1cc28789531036ccb542c1410b64d14afe6.exe

C:\Users\Admin\AppData\Local\Temp\4b418627dc8f28c34a79776bbd7ac1cc28789531036ccb542c1410b64d14afe6.exe
"C:\Users\Admin\AppData\Local\Temp\4b418627dc8f28c34a79776bbd7ac1cc28789531036ccb542c1410b64d14afe6.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-55-0x0000000074450000-0x0000000074B3E000-memory.dmp

Filesize
6.9MB

Download
memory/1368-56-0x0000000000C60000-0x0000000000C74000-memory.dmp

Filesize
80KB

Download
memory/1368-57-0x00000000001D0000-0x00000000001E4000-memory.dmp

Filesize
80KB

Download
memory/1368-58-0x00000000048B0000-0x00000000048B1000-memory.dmp

Filesize
4KB

Download