revengerat | 37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69

General

Target

37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe
Size

55KB
MD5

e62a598e2a43efb4aa080455d70ad9c4
SHA1

ec296fd2130c41479c9743fb93cdaab8675882d6
SHA256

37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69
SHA512

593e714e18181f95b2f25bc556f0ee3e9ed26981d4611eeb7516c7453405387562ab693dd24df39019d226e14352b4095fe8a787e4c8723fa1e51649d9000d29

Score

10^/10

revengerat mr_ahmed trojan

Malware Config

Extracted

Family

revengerat

Botnet

MR_ahmed

C2

192.168.1.2:333

Mutex

9f8d2a8cc3e644

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

Drops startup file 2 IoCs

Processes:

cmd.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

Processes:

37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe

description	pid	process	target process
PID 4180 set thread context of 2568	4180	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3676 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe

description pid process

Token: SeDebugPrivilege 4180 37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe

pid	process
3676	PING.EXE

description	pid	process
Token: SeDebugPrivilege	4180	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.execmd.exe

description	pid	process	target process
PID 4180 wrote to memory of 2568	4180	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe
PID 4180 wrote to memory of 2568	4180	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe
PID 4180 wrote to memory of 2568	4180	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe
PID 4180 wrote to memory of 2568	4180	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe
PID 4180 wrote to memory of 2568	4180	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe
PID 4180 wrote to memory of 2568	4180	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe
PID 4180 wrote to memory of 2568	4180	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe
PID 4180 wrote to memory of 2568	4180	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe
PID 4180 wrote to memory of 2936	4180	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe	cmd.exe
PID 4180 wrote to memory of 2936	4180	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe	cmd.exe
PID 4180 wrote to memory of 2936	4180	37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe	cmd.exe
PID 2936 wrote to memory of 3676	2936	cmd.exe	PING.EXE
PID 2936 wrote to memory of 3676	2936	cmd.exe	PING.EXE
PID 2936 wrote to memory of 3676	2936	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe
"C:\Users\Admin\AppData\Local\Temp\37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4180

C:\Users\Admin\AppData\Local\Temp\37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe
"C:\Users\Admin\AppData\Local\Temp\37b319541d45bfb21b89977e579d81b161c55d24e580a455b0fb2d1dbb471e69.exe"
2⤵
PID:2568

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ping 127.0.0.1 -n 10 & copy "C:\Users\Admin\AppData\Local\Temp\x.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe"
2⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:2936

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 10
3⤵
- Runs ping.exe
PID:3676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

1

T1102

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\x.exe
Filesize
11KB

MD5
9b8b1fc82d2a8c79261cec2175c2a61e

SHA1
b7b1fccfe1e933593102ef3578406054df28dee8

SHA256
997f95070dd2348e0b2018c0f848a317a0bab05fd9befd3483508f9130572cb8

SHA512
6894269391f398ed4c4e3c0a00257db2c862de4ef01648c6505f3aa72f1014c8f2282499f4e861e0c7d81828b9465006f17ecac5e608dcc5fb0561938211f7ef

Download Submit
memory/2568-131-0x0000000000000000-mapping.dmp

Download
memory/2568-132-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2568-135-0x0000000074B90000-0x0000000075141000-memory.dmp

Filesize
5.7MB

Download
memory/2936-133-0x0000000000000000-mapping.dmp

Download
memory/3676-134-0x0000000000000000-mapping.dmp

Download
memory/4180-130-0x0000000074B90000-0x0000000075141000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads