Overview

overview

10

Static

static

829982cc13...20.exe

windows7_x64

10

829982cc13...20.exe

windows10-2004_x64

1

Analysis

  • max time kernel
    146s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    20-05-2022 05:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    829982cc1319f90eb5cbace3ca5a2e52148ba1da618873156153815d7b983f20.exe

  • Size

    288KB

  • MD5

    e53b655b37b571125ea2756910e022fb

  • SHA1

    b42df4cfc8631e29af31744ba245714fa689eca3

  • SHA256

    829982cc1319f90eb5cbace3ca5a2e52148ba1da618873156153815d7b983f20

  • SHA512

    e38d03f4af30406af02caa517da1328f20cf1b5c31f5daa8a95e2f2a7fb25ccc05d6baab7106bdbb1e186d35982e4995de4e75c90f06d9c485a1de11bc24b5e6

Score
10/10
revengeratstealertrojan

Malware Config

Extracted

Family

revengerat

Mutex

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat
  • RevengeRat Executable 1 IoCs
    stealer
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\829982cc1319f90eb5cbace3ca5a2e52148ba1da618873156153815d7b983f20.exe
    "C:\Users\Admin\AppData\Local\Temp\829982cc1319f90eb5cbace3ca5a2e52148ba1da618873156153815d7b983f20.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/548-54-0x0000000000AC0000-0x0000000000B0A000-memory.dmp
    Filesize

    296KB

    Download
  • memory/548-55-0x0000000000340000-0x0000000000346000-memory.dmp
    Filesize

    24KB

    Download
  • memory/548-56-0x000007FEFC0F1000-0x000007FEFC0F3000-memory.dmp
    Filesize

    8KB

    Download
  • memory/548-57-0x00000000004A0000-0x00000000004A8000-memory.dmp
    Filesize

    32KB

    Download
  • memory/548-58-0x000000001A976000-0x000000001A995000-memory.dmp
    Filesize

    124KB

    Download