revengerat | 37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69

General

Target
37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe
Size 55KB
Sample220502-wxedeafcej
SHA256 37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69
MD5 e62a598e2a43efb4aa080455d70ad9c4
SHA1 ec296fd2130c41479c9743fb93cdaab8675882d6
SHA512 593e714e18181f95b2f25bc556f0ee3e9ed26981d4611eeb7516c7453405387562ab693dd24df39019d226e14352b4095fe8a787e4c8723fa1e51649d9000d29
MD5 SHA1 SHA512

Score

10^/10

revengerat mr_ahmed trojan

Malware Config

Extracted

Family

revengerat

Botnet

MR_ahmed

C2

192.168.1.2:333

Mutex

9f8d2a8cc3e644

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4180 set thread context of 2568	4180	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe	85

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3676	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4180	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 2568	4180	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe	85
PID 4180 wrote to memory of 2568	4180	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe	85
PID 4180 wrote to memory of 2568	4180	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe	85
PID 4180 wrote to memory of 2568	4180	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe	85
PID 4180 wrote to memory of 2568	4180	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe	85
PID 4180 wrote to memory of 2568	4180	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe	85
PID 4180 wrote to memory of 2568	4180	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe	85
PID 4180 wrote to memory of 2568	4180	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe	85
PID 4180 wrote to memory of 2936	4180	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe	86
PID 4180 wrote to memory of 2936	4180	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe	86
PID 4180 wrote to memory of 2936	4180	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe	86
PID 2936 wrote to memory of 3676	2936	cmd.exe	88
PID 2936 wrote to memory of 3676	2936	cmd.exe	88
PID 2936 wrote to memory of 3676	2936	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe
"C:\Users\Admin\AppData\Local\Temp\37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Users\Admin\AppData\Local\Temp\37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe
  "C:\Users\Admin\AppData\Local\Temp\37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe"
  2⤵
  PID:2568
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 127.0.0.1 -n 10 & copy "C:\Users\Admin\AppData\Local\Temp\x.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe"
  2⤵
  - Drops startup file
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 10
    3⤵
    - Runs ping.exe
    PID:3676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

1

T1102

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x.exe

Path C:\Users\Admin\AppData\Local\Temp\x.exe
Size 11KB
SHA256 997f95070dd2348e0b2018c0f848a317a0bab05fd9befd3483508f9130572cb8
MD5 9b8b1fc82d2a8c79261cec2175c2a61e
SHA1 b7b1fccfe1e933593102ef3578406054df28dee8
SHA512 6894269391f398ed4c4e3c0a00257db2c862de4ef01648c6505f3aa72f1014c8f2282499f4e861e0c7d81828b9465006f17ecac5e608dcc5fb0561938211f7ef
SSDEEP 192:6Bc6pDWPgNZdmPNwX74JcZKAIW1YPZzfDDsbv/3VTRMpa:6Bc6pjZdANXcZKtZzfvsbv/3V1Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2568-132-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/2568-135-0x0000000074B90000-0x0000000075141000-memory.dmp

Download

memory/4180-130-0x0000000074B90000-0x0000000075141000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads