revengerat | 38507211d1541b45f4aed046e1034ee39de3c735e867988d6685b94fe76b939b | Triage

Analysis

max time kernel
151s
max time network
49s
platform
windows7_x64
resource
win7-20220414-en
submitted
25-06-2022 20:26

Sharing

Report Analysis Logs

General

Target

38507211d1541b45f4aed046e1034ee39de3c735e867988d6685b94fe76b939b.exe
Size

124KB
MD5

0f0fa88fbd9f56a6ee06e5ad8ca2a22a
SHA1

ac0ccde522befaaabbfeec316d1813bd0e4cb198
SHA256

38507211d1541b45f4aed046e1034ee39de3c735e867988d6685b94fe76b939b
SHA512

7a455166ff91aa92354654645ec5400e438cc753b3688d6b569c1d7e85298531c27318a6888e5c9c2910ec04dd1499f0ded0cab2d7bedf37cff480833cddddf5

Score

10^/10

revengerat stealer trojan

Malware Config

Extracted

Family

revengerat

Mutex

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2040-55-0x00000000002E0000-0x00000000002E8000-memory.dmp	revengerat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

38507211d1541b45f4aed046e1034ee39de3c735e867988d6685b94fe76b939b.exe

description pid process

Token: SeDebugPrivilege 2040 38507211d1541b45f4aed046e1034ee39de3c735e867988d6685b94fe76b939b.exe

C:\Users\Admin\AppData\Local\Temp\38507211d1541b45f4aed046e1034ee39de3c735e867988d6685b94fe76b939b.exe
"C:\Users\Admin\AppData\Local\Temp\38507211d1541b45f4aed046e1034ee39de3c735e867988d6685b94fe76b939b.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-54-0x0000000000310000-0x0000000000336000-memory.dmp

Filesize
152KB

Download
memory/2040-55-0x00000000002E0000-0x00000000002E8000-memory.dmp

Filesize
32KB

Download