revengerat | 94d9cfda3e2a60aea012b0948c9f9eaf55d1f7d90fb1bc9e9c094a3a064669ad

Analysis

max time kernel
182s
max time network
191s
platform
windows7_x64
resource
win7-20220414-en
submitted
25/06/2022, 09:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
94d9cfda3e2a60aea012b0948c9f9eaf55d1f7d90fb1bc9e9c094a3a064669ad.exe
Size 99KB
Sample220625-lda7jaefej
SHA256 94d9cfda3e2a60aea012b0948c9f9eaf55d1f7d90fb1bc9e9c094a3a064669ad
MD5 5391a62d2df63872a0cb74a6df44f832
SHA1 46f3c7bae6f4f3b71d79692585d154ddda84d1bb
SHA512 e2d2ae51a74ba02f61e2372569ddb31a70cd433f4e79ee390033d1e59ffe17fbd2f10803502297aebbdef039a2b039a17c1218c721f6e14476d1f59284d57617
MD5 SHA1 SHA512

Score

10^/10

revengerat poweershel stealer trojan

Malware Config

Extracted

Family

revengerat

Botnet

poweershel

40999up.sytes.net:1515
acecervolta.duckdns.org:1515

Mutex

RV_MUTEX-xgZblRvZwfRt

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral1/memory/912-55-0x0000000000700000-0x000000000070A000-memory.dmp	revengerat

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\outlookengimesP.lnk	94d9cfda3e2a60aea012b0948c9f9eaf55d1f7d90fb1bc9e9c094a3a064669ad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	912	94d9cfda3e2a60aea012b0948c9f9eaf55d1f7d90fb1bc9e9c094a3a064669ad.exe

C:\Users\Admin\AppData\Local\Temp\94d9cfda3e2a60aea012b0948c9f9eaf55d1f7d90fb1bc9e9c094a3a064669ad.exe
"C:\Users\Admin\AppData\Local\Temp\94d9cfda3e2a60aea012b0948c9f9eaf55d1f7d90fb1bc9e9c094a3a064669ad.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
PID:912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/912-54-0x00000000012F0000-0x000000000130E000-memory.dmp

Download

memory/912-55-0x0000000000700000-0x000000000070A000-memory.dmp