revengerat | 08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779

Analysis

max time kernel
134s
max time network
184s
platform
windows7_x64
resource
win7-20220414-en
submitted
30-05-2022 21:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe
Size

345KB
MD5

b4f7d6c32fd88f6f0743eb92dead9508
SHA1

148dc196a6c47cf25e09b626d061c9ea1d5ba531
SHA256

08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779
SHA512

119fd596fbfe7e97a5bfdb2d39e681e038adcf31aaeea7c4c884a908dc6736ec36991b55e69a374832553bb41bfae02b35264b54a5ed076bde0db7bfa25f3a42

Score

10^/10

revengerat guest stealer trojan

Malware Config

Extracted

Family

revengerat

Botnet

Guest

185.29.10.15:6984

Mutex

RV_MUTEX-LuSAtYBxGgZH

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 4 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/1956-73-0x0000000000400000-0x0000000000408000-memory.dmp	revengerat
behavioral1/memory/1956-75-0x0000000000405DDE-mapping.dmp	revengerat
behavioral1/memory/1956-77-0x0000000000400000-0x0000000000408000-memory.dmp	revengerat
behavioral1/memory/1956-79-0x0000000000400000-0x0000000000408000-memory.dmp	revengerat

Suspicious use of SetThreadContext 1 IoCs

Processes:

08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe

description	pid	process	target process
PID 888 set thread context of 1956	888	08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe	08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe

description	pid	process
Token: SeDebugPrivilege	888	08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe
Token: SeDebugPrivilege	1956	08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe

description	pid	process	target process
PID 888 wrote to memory of 1956	888	08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe	08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe
PID 888 wrote to memory of 1956	888	08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe	08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe
PID 888 wrote to memory of 1956	888	08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe	08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe
PID 888 wrote to memory of 1956	888	08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe	08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe
PID 888 wrote to memory of 1956	888	08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe	08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe
PID 888 wrote to memory of 1956	888	08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe	08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe
PID 888 wrote to memory of 1956	888	08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe	08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe
PID 888 wrote to memory of 1956	888	08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe	08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe

C:\Users\Admin\AppData\Local\Temp\08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe
"C:\Users\Admin\AppData\Local\Temp\08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:888

C:\Users\Admin\AppData\Local\Temp\08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe
"C:\Users\Admin\AppData\Local\Temp\08812395ae9ee8cced9280aa0da4186a06d69e9bc2a1aef970ca383f504a4779.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/888-74-0x0000000007340000-0x000000000739E000-memory.dmp

Filesize
376KB

Download
memory/888-85-0x0000000070E30000-0x0000000071B4D000-memory.dmp

Filesize
13.1MB

Download
memory/888-56-0x0000000000270000-0x000000000027A000-memory.dmp

Filesize
40KB

Download
memory/888-57-0x0000000000450000-0x000000000046E000-memory.dmp

Filesize
120KB

Download
memory/888-58-0x00000000750C1000-0x00000000750C3000-memory.dmp

Filesize
8KB

Download
memory/888-59-0x0000000072560000-0x00000000738EF000-memory.dmp

Filesize
19.6MB

Download
memory/888-72-0x000000006FD30000-0x000000006FF01000-memory.dmp

Filesize
1.8MB

Download
memory/888-61-0x0000000074150000-0x00000000742E4000-memory.dmp

Filesize
1.6MB

Download
memory/888-62-0x0000000070E30000-0x0000000071B4D000-memory.dmp

Filesize
13.1MB

Download
memory/888-63-0x0000000074050000-0x000000007414C000-memory.dmp

Filesize
1008KB

Download
memory/888-64-0x000000006FF10000-0x000000007064E000-memory.dmp

Filesize
7.2MB

Download
memory/888-65-0x0000000070650000-0x0000000070E30000-memory.dmp

Filesize
7.9MB

Download
memory/888-66-0x0000000072560000-0x00000000738EF000-memory.dmp

Filesize
19.6MB

Download
memory/888-67-0x0000000000AF0000-0x0000000000B4E000-memory.dmp

Filesize
376KB

Download
memory/888-68-0x0000000071B50000-0x0000000072560000-memory.dmp

Filesize
10.1MB

Download
memory/888-69-0x0000000074150000-0x00000000742E4000-memory.dmp

Filesize
1.6MB

Download
memory/888-70-0x0000000070E30000-0x0000000071B4D000-memory.dmp

Filesize
13.1MB

Download
memory/888-54-0x0000000000AF0000-0x0000000000B4E000-memory.dmp

Filesize
376KB

Download
memory/888-60-0x0000000071B50000-0x0000000072560000-memory.dmp

Filesize
10.1MB

Download
memory/888-86-0x0000000072560000-0x00000000738EF000-memory.dmp

Filesize
19.6MB

Download
memory/888-71-0x0000000070650000-0x0000000070E30000-memory.dmp

Filesize
7.9MB

Download
memory/888-55-0x0000000000AF0000-0x0000000000B4E000-memory.dmp

Filesize
376KB

Download
memory/888-84-0x0000000074150000-0x00000000742E4000-memory.dmp

Filesize
1.6MB

Download
memory/888-83-0x0000000071B50000-0x0000000072560000-memory.dmp

Filesize
10.1MB

Download
memory/888-80-0x0000000000AF0000-0x0000000000B4E000-memory.dmp

Filesize
376KB

Download
memory/888-82-0x0000000070650000-0x0000000070E30000-memory.dmp

Filesize
7.9MB

Download
memory/1956-90-0x0000000071B50000-0x0000000072560000-memory.dmp

Filesize
10.1MB

Download
memory/1956-89-0x0000000072560000-0x00000000738EF000-memory.dmp

Filesize
19.6MB

Download
memory/1956-75-0x0000000000405DDE-mapping.dmp

Download
memory/1956-91-0x0000000074150000-0x00000000742E4000-memory.dmp

Filesize
1.6MB

Download
memory/1956-87-0x0000000074050000-0x000000007414C000-memory.dmp

Filesize
1008KB

Download
memory/1956-79-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1956-77-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1956-88-0x0000000000AF0000-0x0000000000B4E000-memory.dmp

Filesize
376KB

Download
memory/1956-93-0x0000000070650000-0x0000000070E30000-memory.dmp

Filesize
7.9MB

Download
memory/1956-92-0x0000000070E30000-0x0000000071B4D000-memory.dmp

Filesize
13.1MB

Download
memory/1956-73-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1956-94-0x000000006FD30000-0x000000006FF01000-memory.dmp

Filesize
1.8MB

Download
memory/1956-95-0x000000006FF10000-0x000000007064E000-memory.dmp

Filesize
7.2MB

Download
memory/1956-96-0x0000000000AF0000-0x0000000000B4E000-memory.dmp

Filesize
376KB

Download