revengerat | 7e41b7ef9b3a3df9b1e76c7dbf7e918a39e342702dd071c9e984ae6156c81f27

General

Target

7e41b7ef9b3a3df9b1e76c7dbf7e918a39e342702dd071c9e984ae6156c81f27.exe
Size

122KB
MD5

da30f3af9301ae1d6944fa9ff1990667
SHA1

364a1583ef9993827dd65ed61b2b8f28eb8e44bd
SHA256

7e41b7ef9b3a3df9b1e76c7dbf7e918a39e342702dd071c9e984ae6156c81f27
SHA512

9937368c9c36480459ad541cca916fbce6c6ce3d9225b0a1d149bd27971eec7e9c6e67697c736fa696bfb3cdea48c48a3874479568f070745d00dc686cc0e35f

Score

10^/10

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 3 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/2772-133-0x00000000003D0000-0x00000000003F6000-memory.dmp	revengerat
behavioral2/memory/2772-136-0x00000000003D0000-0x00000000003F6000-memory.dmp	revengerat
behavioral2/memory/2772-139-0x00000000003D0000-0x00000000003F6000-memory.dmp	revengerat

Suspicious use of SetThreadContext 1 IoCs

Processes:

7e41b7ef9b3a3df9b1e76c7dbf7e918a39e342702dd071c9e984ae6156c81f27.exe

description	pid	process	target process
PID 3528 set thread context of 2772	3528	7e41b7ef9b3a3df9b1e76c7dbf7e918a39e342702dd071c9e984ae6156c81f27.exe	RegSvcs.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4256 2772 WerFault.exe RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

7e41b7ef9b3a3df9b1e76c7dbf7e918a39e342702dd071c9e984ae6156c81f27.exe

description pid process

Token: SeDebugPrivilege 3528 7e41b7ef9b3a3df9b1e76c7dbf7e918a39e342702dd071c9e984ae6156c81f27.exe

pid	pid_target	process	target process
4256	2772	WerFault.exe	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	3528	7e41b7ef9b3a3df9b1e76c7dbf7e918a39e342702dd071c9e984ae6156c81f27.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

7e41b7ef9b3a3df9b1e76c7dbf7e918a39e342702dd071c9e984ae6156c81f27.exe

description	pid	process	target process
PID 3528 wrote to memory of 2772	3528	7e41b7ef9b3a3df9b1e76c7dbf7e918a39e342702dd071c9e984ae6156c81f27.exe	RegSvcs.exe
PID 3528 wrote to memory of 2772	3528	7e41b7ef9b3a3df9b1e76c7dbf7e918a39e342702dd071c9e984ae6156c81f27.exe	RegSvcs.exe
PID 3528 wrote to memory of 2772	3528	7e41b7ef9b3a3df9b1e76c7dbf7e918a39e342702dd071c9e984ae6156c81f27.exe	RegSvcs.exe
PID 3528 wrote to memory of 2772	3528	7e41b7ef9b3a3df9b1e76c7dbf7e918a39e342702dd071c9e984ae6156c81f27.exe	RegSvcs.exe
PID 3528 wrote to memory of 2772	3528	7e41b7ef9b3a3df9b1e76c7dbf7e918a39e342702dd071c9e984ae6156c81f27.exe	RegSvcs.exe
PID 3528 wrote to memory of 2772	3528	7e41b7ef9b3a3df9b1e76c7dbf7e918a39e342702dd071c9e984ae6156c81f27.exe	RegSvcs.exe
PID 3528 wrote to memory of 2772	3528	7e41b7ef9b3a3df9b1e76c7dbf7e918a39e342702dd071c9e984ae6156c81f27.exe	RegSvcs.exe
PID 3528 wrote to memory of 2772	3528	7e41b7ef9b3a3df9b1e76c7dbf7e918a39e342702dd071c9e984ae6156c81f27.exe	RegSvcs.exe
PID 3528 wrote to memory of 2772	3528	7e41b7ef9b3a3df9b1e76c7dbf7e918a39e342702dd071c9e984ae6156c81f27.exe	RegSvcs.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
2⤵
PID:2772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 200
3⤵
- Program crash
PID:4256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2772 -ip 2772
1⤵
PID:1352

memory/2772-131-0x0000000000000000-mapping.dmp

Download
memory/2772-133-0x00000000003D0000-0x00000000003F6000-memory.dmp

Filesize
152KB

Download
memory/2772-136-0x00000000003D0000-0x00000000003F6000-memory.dmp

Filesize
152KB

Download
memory/2772-139-0x00000000003D0000-0x00000000003F6000-memory.dmp

Filesize
152KB

Download
memory/3528-130-0x0000000075080000-0x0000000075631000-memory.dmp

Filesize
5.7MB

Download