revengerat | 56cd5749a3f4a237918a7a61488027f32daa321ff5bf4b7505cef0e4fa91a5b2

Analysis

max time kernel
88s
max time network
128s
platform
windows7_x64
resource
win7-20220414-en
submitted
16-05-2022 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56cd5749a3f4a237918a7a61488027f32daa321ff5bf4b7505cef0e4fa91a5b2.exe
Size

23KB
MD5

9f5f2fc905270a6f6c952c52f9b438b9
SHA1

66386b1e39842a9f843183829e8546fc82a61b16
SHA256

56cd5749a3f4a237918a7a61488027f32daa321ff5bf4b7505cef0e4fa91a5b2
SHA512

ea8d3d1937cfdd010b1ac6831eb7c77f32db2cf30eeb25919f7de1124f44eb7e07ef7a662ca33af63628b6405b1497dbc067673e6602793971a79adb85d231a6

Score

10^/10

revengerat stealer trojan

Malware Config

Extracted

Family

revengerat

Mutex

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 1 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/916-55-0x0000000000510000-0x0000000000518000-memory.dmp	revengerat

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1956 916 WerFault.exe 56cd5749a3f4a237918a7a61488027f32daa321ff5bf4b7505cef0e4fa91a5b2.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

56cd5749a3f4a237918a7a61488027f32daa321ff5bf4b7505cef0e4fa91a5b2.exe

description pid process

Token: SeDebugPrivilege 916 56cd5749a3f4a237918a7a61488027f32daa321ff5bf4b7505cef0e4fa91a5b2.exe

pid	pid_target	process	target process
1956	916	WerFault.exe	56cd5749a3f4a237918a7a61488027f32daa321ff5bf4b7505cef0e4fa91a5b2.exe

description	pid	process
Token: SeDebugPrivilege	916	56cd5749a3f4a237918a7a61488027f32daa321ff5bf4b7505cef0e4fa91a5b2.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

56cd5749a3f4a237918a7a61488027f32daa321ff5bf4b7505cef0e4fa91a5b2.exe

description	pid	process	target process
PID 916 wrote to memory of 1956	916	56cd5749a3f4a237918a7a61488027f32daa321ff5bf4b7505cef0e4fa91a5b2.exe	WerFault.exe
PID 916 wrote to memory of 1956	916	56cd5749a3f4a237918a7a61488027f32daa321ff5bf4b7505cef0e4fa91a5b2.exe	WerFault.exe
PID 916 wrote to memory of 1956	916	56cd5749a3f4a237918a7a61488027f32daa321ff5bf4b7505cef0e4fa91a5b2.exe	WerFault.exe
PID 916 wrote to memory of 1956	916	56cd5749a3f4a237918a7a61488027f32daa321ff5bf4b7505cef0e4fa91a5b2.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\56cd5749a3f4a237918a7a61488027f32daa321ff5bf4b7505cef0e4fa91a5b2.exe
"C:\Users\Admin\AppData\Local\Temp\56cd5749a3f4a237918a7a61488027f32daa321ff5bf4b7505cef0e4fa91a5b2.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 1488
2⤵
- Program crash
PID:1956

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/916-54-0x00000000010B0000-0x00000000010BC000-memory.dmp

Filesize
48KB

Download
memory/916-55-0x0000000000510000-0x0000000000518000-memory.dmp

Filesize
32KB

Download
memory/916-56-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download
memory/1956-57-0x0000000000000000-mapping.dmp

Download