revengerat | 4dd82c8cfe6e1bd52dc523ba8bb6bb1891f95fcc7187e4f4817400eb3547cda9

Analysis

max time kernel
127s
max time network
130s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-01-2023 05:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4DD82C8CFE6E1BD52DC523BA8BB6BB1891F95FCC7187E.exe
Size

152KB
MD5

f898e240cdab196a4a4045a9475e1641
SHA1

e4868eac22f6dda6160da5aa9929b5c732ce74f6
SHA256

4dd82c8cfe6e1bd52dc523ba8bb6bb1891f95fcc7187e4f4817400eb3547cda9
SHA512

f94f7dea04968910e89a33dc6ca749838c66c444d0920ea973b93f61709c68133c72714f88928fe41dd7006145598ce2e10ae15994ec3dea7c914c756eafdcb2
SSDEEP

3072:cYLvQhh2YZsMFw3GmQ8gM4fNXI614xGBD94lh4c0BoO5mkhltVhFFElbHF9FFFNK:lLIH2YTFhH5FFElbHF9FFFNABlFFFFNB

Score

10^/10

revengerat stealer trojan

Malware Config

Extracted

Family

revengerat

Mutex

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 1 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/880-55-0x0000000000180000-0x0000000000188000-memory.dmp	revengerat

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

4DD82C8CFE6E1BD52DC523BA8BB6BB1891F95FCC7187E.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0	4DD82C8CFE6E1BD52DC523BA8BB6BB1891F95FCC7187E.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	4DD82C8CFE6E1BD52DC523BA8BB6BB1891F95FCC7187E.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4DD82C8CFE6E1BD52DC523BA8BB6BB1891F95FCC7187E.exe

description pid process

Token: SeDebugPrivilege 880 4DD82C8CFE6E1BD52DC523BA8BB6BB1891F95FCC7187E.exe

description	pid	process
Token: SeDebugPrivilege	880	4DD82C8CFE6E1BD52DC523BA8BB6BB1891F95FCC7187E.exe

C:\Users\Admin\AppData\Local\Temp\4DD82C8CFE6E1BD52DC523BA8BB6BB1891F95FCC7187E.exe
"C:\Users\Admin\AppData\Local\Temp\4DD82C8CFE6E1BD52DC523BA8BB6BB1891F95FCC7187E.exe"
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:880

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/880-54-0x0000000000C90000-0x0000000000CBE000-memory.dmp

Filesize
184KB

Download
memory/880-55-0x0000000000180000-0x0000000000188000-memory.dmp

Filesize
32KB

Download