Analysis
-
max time kernel
134s -
max time network
184s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
30-05-2022 21:44
Static task
static1
Behavioral task
behavioral1
Sample
08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe
Resource
win10v2004-20220414-en
General
-
Target
08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe
-
Size
345KB
-
MD5
b4f7d6c32fd88f6f0743eb92dead9508
-
SHA1
148dc196a6c47cf25e09b626d061c9ea1d5ba531
-
SHA256
08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779
-
SHA512
119fd596fbfe7e97a5bfdb2d39e681e038adcf31aaeea7c4c884a908dc6736ec36991b55e69a374832553bb41bfae02b35264b54a5ed076bde0db7bfa25f3a42
Malware Config
Extracted
revengerat
Guest
185.29.10.15:6984
RV_MUTEX-LuSAtYBxGgZH
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
RevengeRat Executable 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1956-73-0x0000000000400000-0x0000000000408000-memory.dmp revengerat behavioral1/memory/1956-75-0x0000000000405DDE-mapping.dmp revengerat behavioral1/memory/1956-77-0x0000000000400000-0x0000000000408000-memory.dmp revengerat behavioral1/memory/1956-79-0x0000000000400000-0x0000000000408000-memory.dmp revengerat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exedescription pid process target process PID 888 set thread context of 1956 888 08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe 08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exedescription pid process Token: SeDebugPrivilege 888 08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe Token: SeDebugPrivilege 1956 08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exedescription pid process target process PID 888 wrote to memory of 1956 888 08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe 08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe PID 888 wrote to memory of 1956 888 08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe 08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe PID 888 wrote to memory of 1956 888 08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe 08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe PID 888 wrote to memory of 1956 888 08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe 08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe PID 888 wrote to memory of 1956 888 08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe 08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe PID 888 wrote to memory of 1956 888 08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe 08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe PID 888 wrote to memory of 1956 888 08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe 08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe PID 888 wrote to memory of 1956 888 08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe 08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe"C:\Users\Admin\AppData\Local\Temp\08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe"C:\Users\Admin\AppData\Local\Temp\08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/888-74-0x0000000007340000-0x000000000739E000-memory.dmpFilesize
376KB
-
memory/888-85-0x0000000070E30000-0x0000000071B4D000-memory.dmpFilesize
13.1MB
-
memory/888-56-0x0000000000270000-0x000000000027A000-memory.dmpFilesize
40KB
-
memory/888-57-0x0000000000450000-0x000000000046E000-memory.dmpFilesize
120KB
-
memory/888-58-0x00000000750C1000-0x00000000750C3000-memory.dmpFilesize
8KB
-
memory/888-59-0x0000000072560000-0x00000000738EF000-memory.dmpFilesize
19.6MB
-
memory/888-72-0x000000006FD30000-0x000000006FF01000-memory.dmpFilesize
1.8MB
-
memory/888-61-0x0000000074150000-0x00000000742E4000-memory.dmpFilesize
1.6MB
-
memory/888-62-0x0000000070E30000-0x0000000071B4D000-memory.dmpFilesize
13.1MB
-
memory/888-63-0x0000000074050000-0x000000007414C000-memory.dmpFilesize
1008KB
-
memory/888-64-0x000000006FF10000-0x000000007064E000-memory.dmpFilesize
7.2MB
-
memory/888-65-0x0000000070650000-0x0000000070E30000-memory.dmpFilesize
7.9MB
-
memory/888-66-0x0000000072560000-0x00000000738EF000-memory.dmpFilesize
19.6MB
-
memory/888-67-0x0000000000AF0000-0x0000000000B4E000-memory.dmpFilesize
376KB
-
memory/888-68-0x0000000071B50000-0x0000000072560000-memory.dmpFilesize
10.1MB
-
memory/888-69-0x0000000074150000-0x00000000742E4000-memory.dmpFilesize
1.6MB
-
memory/888-70-0x0000000070E30000-0x0000000071B4D000-memory.dmpFilesize
13.1MB
-
memory/888-54-0x0000000000AF0000-0x0000000000B4E000-memory.dmpFilesize
376KB
-
memory/888-60-0x0000000071B50000-0x0000000072560000-memory.dmpFilesize
10.1MB
-
memory/888-86-0x0000000072560000-0x00000000738EF000-memory.dmpFilesize
19.6MB
-
memory/888-71-0x0000000070650000-0x0000000070E30000-memory.dmpFilesize
7.9MB
-
memory/888-55-0x0000000000AF0000-0x0000000000B4E000-memory.dmpFilesize
376KB
-
memory/888-84-0x0000000074150000-0x00000000742E4000-memory.dmpFilesize
1.6MB
-
memory/888-83-0x0000000071B50000-0x0000000072560000-memory.dmpFilesize
10.1MB
-
memory/888-80-0x0000000000AF0000-0x0000000000B4E000-memory.dmpFilesize
376KB
-
memory/888-82-0x0000000070650000-0x0000000070E30000-memory.dmpFilesize
7.9MB
-
memory/1956-90-0x0000000071B50000-0x0000000072560000-memory.dmpFilesize
10.1MB
-
memory/1956-89-0x0000000072560000-0x00000000738EF000-memory.dmpFilesize
19.6MB
-
memory/1956-75-0x0000000000405DDE-mapping.dmp
-
memory/1956-91-0x0000000074150000-0x00000000742E4000-memory.dmpFilesize
1.6MB
-
memory/1956-87-0x0000000074050000-0x000000007414C000-memory.dmpFilesize
1008KB
-
memory/1956-79-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/1956-77-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/1956-88-0x0000000000AF0000-0x0000000000B4E000-memory.dmpFilesize
376KB
-
memory/1956-93-0x0000000070650000-0x0000000070E30000-memory.dmpFilesize
7.9MB
-
memory/1956-92-0x0000000070E30000-0x0000000071B4D000-memory.dmpFilesize
13.1MB
-
memory/1956-73-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/1956-94-0x000000006FD30000-0x000000006FF01000-memory.dmpFilesize
1.8MB
-
memory/1956-95-0x000000006FF10000-0x000000007064E000-memory.dmpFilesize
7.2MB
-
memory/1956-96-0x0000000000AF0000-0x0000000000B4E000-memory.dmpFilesize
376KB