revengerat | 2bec03c697460563abadb89eaa555a5b7986aff01135a1ef39019e8b7a464f24

Analysis

max time kernel
181s
max time network
188s
platform
windows7_x64
resource
win7-20220414-en
submitted
15-06-2022 00:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2bec03c697460563abadb89eaa555a5b7986aff01135a1ef39019e8b7a464f24.exe
Size

195KB
MD5

0378d293a96ed6e8f25b8b68a5bcdf39
SHA1

31c28a89d053789b0489e39996f0b7f9f8a00851
SHA256

2bec03c697460563abadb89eaa555a5b7986aff01135a1ef39019e8b7a464f24
SHA512

88cc50160b8f3abde491dcff93147b36b29709f4d2929ce7b37de013e2ce12b8c0bad839f7a99cc9d7fbed1f15e3d92071f02d12d48ce08b7fdb3f428c8911c5

Score

10^/10

revengerat stealer trojan

Malware Config

Extracted

Family

revengerat

Mutex

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 1 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/800-55-0x0000000000260000-0x0000000000268000-memory.dmp	revengerat

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2bec03c697460563abadb89eaa555a5b7986aff01135a1ef39019e8b7a464f24.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0	2bec03c697460563abadb89eaa555a5b7986aff01135a1ef39019e8b7a464f24.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2bec03c697460563abadb89eaa555a5b7986aff01135a1ef39019e8b7a464f24.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2bec03c697460563abadb89eaa555a5b7986aff01135a1ef39019e8b7a464f24.exe

description pid process

Token: SeDebugPrivilege 800 2bec03c697460563abadb89eaa555a5b7986aff01135a1ef39019e8b7a464f24.exe

description	pid	process
Token: SeDebugPrivilege	800	2bec03c697460563abadb89eaa555a5b7986aff01135a1ef39019e8b7a464f24.exe

C:\Users\Admin\AppData\Local\Temp\2bec03c697460563abadb89eaa555a5b7986aff01135a1ef39019e8b7a464f24.exe
"C:\Users\Admin\AppData\Local\Temp\2bec03c697460563abadb89eaa555a5b7986aff01135a1ef39019e8b7a464f24.exe"
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:800

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/800-54-0x0000000000DA0000-0x0000000000DD8000-memory.dmp

Filesize
224KB

Download
memory/800-55-0x0000000000260000-0x0000000000268000-memory.dmp

Filesize
32KB

Download